WordPress Security Audit
A passive hardening review of a WordPress site, for its owner. It reads only public pages and HTTP headers — nothing is submitted, no login is attempted, no weakness is tested — and reports the common hardening gaps that automated scanners look for, with a plain fix for each.
- Loading the home page
- Confirming it runs WordPress
- Reading public files and the REST index
- Checking what version information is exposed
- Reviewing the security headers
Want your WordPress site properly hardened?
This passive check sees only what the site reveals in public. A full audit goes deeper — safely, with your permission — and we fix what it finds.
- Plugins and themes checked against known advisories
- Hardening: logins, file permissions, admin access
- Security headers and a firewall set up correctly
- Malware scan, clean-up and reliable backups
- Monitoring so you hear about problems first
Most WordPress break-ins exploit the basics
Sites are rarely taken over by clever, targeted attacks. The overwhelming majority fall to automated bots that scan the whole web for the same handful of weaknesses: an out-of-date plugin with a known issue, a weak or reused admin password found by guessing, a version number that tells the bot exactly what to try, or a configuration left at its insecure default.
This review covers the part of that an owner can see from outside, without touching anything. It reads public pages and the HTTP headers the server already sends, and reports where the site is giving away more than it should or leaving a default open. It does not attempt to log in, submit data, reach private files or test any weakness — it only observes, and tells you what to tighten.
1. Exposure
Whether the WordPress version is published in the markup or the default readme file, and whether folders can be browsed directly.
2. Open defaults
XML-RPC left enabled, and whether the REST API hands out account names — both favourite targets of automated bots.
3. Headers & HTTPS
HTTPS and HSTS, plus the response headers that defend against framing, content-type tricks and injected scripts.
Questions and answers
Is this safe to run on my site? Does it attack it?
It is completely passive. It reads a few public pages and the HTTP headers your server already sends to every visitor, and it changes nothing. It does not try to log in, submit forms, reach private files or test any weakness.
What does the audit check?
Transport security (HTTPS, HSTS), information exposure (the WordPress version in the markup or readme.html, directory listing of the uploads folder), open defaults (XML-RPC, and whether the REST API lists usernames), and the main security response headers.
Should I only run this on my own site?
Yes. Although every check is passive and reads only public information, these tools are meant for auditing sites you own or are responsible for. That is also how you can act on the findings.
Is a good score the same as being secure?
No. This covers the hardening basics visible from outside. Real security also depends on strong passwords, up-to-date plugins, correct file permissions, reliable backups and server configuration — the things a full audit examines with your permission.
Need more than a one-page check?
We have been building and maintaining websites and WordPress since 2008. Tell us about your site and we will come back with a plan and an honest estimate.