CMS Telemetry & Perimeter Hardening

WordPress security checks & hardening

Detect exposed configuration files, missing security headers, and debug-log exposure on your WordPress site with non-destructive checks — and paste the fixes today.

bolt Start Free WordPress Scan (7-Day Trial)

check_circle Non-destructive passive checks check_circle 1 website slot included check_circle Cryptographic proof required

Detection Catalog

Common WordPress exposures addressed

Perimeter checks detect severe exposure vectors before threat actors find them for you.

file_open

Exposed wp-config & backup dumps

Detection of misplaced wp-config.php.bak, .env, or raw SQL database dumps left publicly accessible. You get an alert with the exact URL path — we verify public accessibility only, and never store or read the raw database credentials inside.

security

Missing security headers

Evaluation of CSP, X-Frame-Options, and Strict-Transport-Security to prevent admin clickjacking and credential stuffing across your REST endpoints and login interfaces.

bug_report

Public debug logs

Verification of unintended logging exposure such as /wp-content/debug.log, which can leak database errors, server paths, and user data.

settings_ethernet

XML-RPC & REST auth gates

Auditing for open pingback vectors and unauthenticated user-enumeration endpoints on /xmlrpc.php and the REST API.

Architectural Integrity Assessment

What we inspect vs. what we cannot inspect

We operate on engineering honesty. External checks give unmatched speed with zero server load — but host-level inspection requires host access.

check_circle Audited externally

done Exposed wp-config backups, database dumps, and sensitive files on public HTTP paths
done HTTP security headers: HSTS, CSP, X-Content-Type-Options, Permissions-Policy
done Public debug-log exposure
done XML-RPC and REST authentication gates

lock Requires server access / host agent

remove Core file integrity: scanning /wp-admin/ and /wp-includes/ for modified files requires direct disk I/O.
remove Injected database web shells: inspecting raw MySQL rows requires database privileges.
remove Obfuscated PHP in uploads: hidden eval() shells can’t be executed externally.
remove Server-level persistence: crontab hooks outside the webroot.

info We will never promise full malware removal without server-level access. Where you need it, the host-agent mode covers internal telemetry.

Hardening Playbook

Practical step-by-step remediation

Copy-ready configurations to mitigate common WordPress perimeter exposures immediately — no extra plugins required.

terminal 1. Restrict XML-RPC (Nginx)

Neutralize brute-force amplification against the legacy XML-RPC interface. Review whether your integrations (Jetpack, mobile apps) use it before blocking.

location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

block 2. Block PHP in uploads

Prevent uploaded scripts from executing even if an arbitrary file upload slips through.

location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

edit_off 3. Disable file editing

Lock down the built-in theme/plugin editor in wp-config.php so a compromised admin session can’t edit your code.

define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', false);

Keep DISALLOW_FILE_MODS false if you want one-click plugin updates to keep working.

key 4. Rotate credentials on exposure

If a config exposure is suspected: rotate database user passwords, and invalidate active sessions by regenerating your WordPress salts via the official WordPress salt generator. Always test plugin updates in staging first and confirm the author actively maintains the plugin before deploying.

Technical Clarifications

WordPress security FAQ

Will scanning slow down my WooCommerce or high-traffic WordPress site?

No. Checks are rate-limited external probes. They avoid skewing server caches, triggering cloud WAFs, or competing with real customer traffic on checkouts.

Do I need to install a heavy WordPress plugin?

No plugin installation is required for perimeter checks. Traditional security plugins continuously write audit logs to your database, ballooning table sizes; CheckWebSecurity assesses externally instead.

How do I prove ownership of my WordPress site?

A cryptographic DNS TXT record, or a unique verification token file placed in your site’s well-known directory.

Can CheckWebSecurity clean up infected WordPress files automatically?

No. We provide verifiable telemetry and precise remediation instructions. Automated cleanup without manual review risks breaking custom code and prolonging downtime.

Check your WordPress perimeter

Get visibility into your exposed attack vectors without performance trade-offs or database hooks.

Start 7-Day Free Trial

No credit card required • 1 website slot included • Ownership verified before any check