WordPress security checks & hardening
Detect exposed configuration files, missing security headers, and debug-log exposure on your WordPress site with non-destructive checks — and paste the fixes today.
Common WordPress exposures addressed
Perimeter checks detect severe exposure vectors before threat actors find them for you.
Exposed wp-config & backup dumps
Detection of misplaced wp-config.php.bak, .env, or raw SQL database dumps left publicly accessible. You get an alert with the exact URL path — we verify public accessibility only, and never store or read the raw database credentials inside.
Missing security headers
Evaluation of CSP, X-Frame-Options, and Strict-Transport-Security to prevent admin clickjacking and credential stuffing across your REST endpoints and login interfaces.
Public debug logs
Verification of unintended logging exposure such as /wp-content/debug.log, which can leak database errors, server paths, and user data.
XML-RPC & REST auth gates
Auditing for open pingback vectors and unauthenticated user-enumeration endpoints on /xmlrpc.php and the REST API.
What we inspect vs. what we cannot inspect
We operate on engineering honesty. External checks give unmatched speed with zero server load — but host-level inspection requires host access.
check_circle Audited externally
- done Exposed wp-config backups, database dumps, and sensitive files on public HTTP paths
- done HTTP security headers: HSTS, CSP, X-Content-Type-Options, Permissions-Policy
- done Public debug-log exposure
- done XML-RPC and REST authentication gates
lock Requires server access / host agent
- remove Core file integrity: scanning
/wp-admin/and/wp-includes/for modified files requires direct disk I/O. - remove Injected database web shells: inspecting raw MySQL rows requires database privileges.
- remove Obfuscated PHP in uploads: hidden
eval()shells can’t be executed externally. - remove Server-level persistence: crontab hooks outside the webroot.
info We will never promise full malware removal without server-level access. Where you need it, the host-agent mode covers internal telemetry.
Practical step-by-step remediation
Copy-ready configurations to mitigate common WordPress perimeter exposures immediately — no extra plugins required.
terminal 1. Restrict XML-RPC (Nginx)
Neutralize brute-force amplification against the legacy XML-RPC interface. Review whether your integrations (Jetpack, mobile apps) use it before blocking.
location = /xmlrpc.php {
deny all;
access_log off;
log_not_found off;
}block 2. Block PHP in uploads
Prevent uploaded scripts from executing even if an arbitrary file upload slips through.
location ~* /wp-content/uploads/.*\.php$ {
deny all;
return 403;
}edit_off 3. Disable file editing
Lock down the built-in theme/plugin editor in wp-config.php so a compromised admin session can’t edit your code.
define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', false);Keep DISALLOW_FILE_MODS false if you want one-click plugin updates to keep working.
key 4. Rotate credentials on exposure
If a config exposure is suspected: rotate database user passwords, and invalidate active sessions by regenerating your WordPress salts via the official WordPress salt generator. Always test plugin updates in staging first and confirm the author actively maintains the plugin before deploying.
WordPress security FAQ
Will scanning slow down my WooCommerce or high-traffic WordPress site?
No. Checks are rate-limited external probes. They avoid skewing server caches, triggering cloud WAFs, or competing with real customer traffic on checkouts.
Do I need to install a heavy WordPress plugin?
No plugin installation is required for perimeter checks. Traditional security plugins continuously write audit logs to your database, ballooning table sizes; CheckWebSecurity assesses externally instead.
How do I prove ownership of my WordPress site?
A cryptographic DNS TXT record, or a unique verification token file placed in your site’s well-known directory.
Can CheckWebSecurity clean up infected WordPress files automatically?
No. We provide verifiable telemetry and precise remediation instructions. Automated cleanup without manual review risks breaking custom code and prolonging downtime.
Check your WordPress perimeter
Get visibility into your exposed attack vectors without performance trade-offs or database hooks.
Start 7-Day Free TrialNo credit card required • 1 website slot included • Ownership verified before any check