WordPress configuration
The wp-config.php constants and admin settings that harden a WordPress install, and the ones that quietly leave it open.
40 checks in this group, 4 with a full write-up.
Two different kinds of setting, one group
WordPress configuration splits cleanly into two families, and it is worth knowing which one you are looking at before deciding how urgent a fix is. The first is wp-config.php constants: switches that do not exist until someone adds a line of PHP, covering everything from forcing SSL on the admin area to stopping the file editor inside wp-admin to capping how many post revisions the database keeps. None of these are set by default, which means every site that has them was either built by someone who knew to add them, or migrated from a host or starter theme that bundled a sensible wp-config already. The second family is the leftovers: the default tagline, the sample page, the “Hello World” post, the generator tag announcing the exact WordPress and plugin versions in the page source. Nobody decides to leave these; they just never get removed.
For an agency managing more than a handful of installs, the wp-config half is the one worth templating. A constant you remember to add once, in a starter config every new build inherits from, is a constant every future site gets for free. The leftovers half is the opposite: it cannot be templated away because it reappears on every fresh install by definition, so it has to be part of a launch checklist or it has to be caught by something that checks for it afterwards.
A handful of checks here matter for a different reason entirely: XML-RPC left enabled, application passwords available with no restriction, the admin login reachable with no extra layer in front of it. These are not tidiness items. They are the settings that decide whether a stolen or guessed password is the end of the story or the start of one, and they are worth treating with more urgency than the rest of this group.
WordPress
Changes To Core WordPress Files Should Be Avoided
Compares your WordPress core files against the official file hashes for your version and flags anything that has been altered, a common sign of tampering.
WordPress Version Must Be Up-to-date
Every WordPress release fixes security issues found in the one before it, so anything short of the latest version leaves published vulnerabilities unpatched.
Use A Valid SSL Certificate To Secure Traffic
Checks whether your site URL starts with https, since traffic sent over plain HTTP, including login credentials, can be read or altered on the network path.
WordPress Address Should Normally Equal Site Address
WP_HOME and WP_SITEURL control where WordPress thinks it lives, and an unexplained mismatch usually means an unfinished migration or a hijacked redirect.
Password Protect WP-Admin
A .htaccess/.htpasswd prompt on /wp-admin/ adds a second login before an attacker ever reaches WordPress's own login form, and that is hard to automate around.
WordPress Email Configuration Should Work
Sends a test email from your site and confirms it actually arrives, catching a broken mail setup before you notice password resets have stopped working.
Disable third party access to your site over XML-RPC for better security and prevent access, and brute force attempts
Fixable in one click48.7% of the WordPress sites we have this data for fail it
Allow Search Engines To Index This Site
Ensure you NEVER discourage search engines from crawling your live site by checking this WordPress feature is not enabled.
Fixable in one click3.3% of the WordPress sites we have this data for fail it
Avoid Using Default Distributed Salt Values
The authentication salts in wp-config.php protect login cookies, so leaving them as "put your unique phrase here" makes forging a session trivial.
Remove Default Tagline "Just Another WordPress Site"
The unedited "Just Another WordPress Site" tagline is one of the clearest signals to an attacker scouting for abandoned or badly maintained sites.
Remove The Default "Sample Page"
WordPress installs with a placeholder "Sample Page" by default, and a live copy signals an unfinished or unmaintained site to anyone who lands on it.
Remove The Default "Hello World!" Post
WordPress installs with a sample "Hello World!" post by default, and leaving it published is one of the clearest signs nobody has ever touched the site.
Config Constant: Disable WP_DEBUG In Production
Ensure that your live sites dont have the WP_DEBUG constant enabled in production
Fixable in one click
Config Constant: Disable WP_DEBUG_LOG In Production
Ensure that your live sites dont have the WP_DEBUG_LOG constant enabled in production
Fixable in one click
Config Constant: Disable WP_DEBUG_DISPLAY In Production
Ensure that your live sites dont have the WP_DEBUG_DISPLAY constant enabled in production
Fixable in one click
Config Constant: Disable File Editing Through Admin Console with DISALLOW_FILE_EDIT
Use DISALLOW_FILE_EDIT to lock down important parts of your admin
Fixable in one click60.7% of the WordPress sites we have this data for fail it
Config Constant: Enable FORCE_SSL_ADMIN to secure admin connections
Use FORCE_SSL_ADMIN to ensure secure connections to your WordPress Admin Console
Fixable in one click
Config Constant: Enable FORCE_SSL_LOGIN to secure login connections (@Deprecated)
FORCE_SSL_LOGIN forces the login page over HTTPS but was deprecated in WordPress 4.0 for FORCE_SSL_ADMIN, and some plugins still look for the old name.
Fixable in one click
Config Constant: Prohibit Database Repair with WP_ALLOW_REPAIR constant
Use WP_ALLOW_REPAIR to set to false to prohibit repairing of the db on production sites
Fixable in one click
Config Constant: Disallow Unfiltered Content with DISALLOW_UNFILTERED_HTML
Use DISALLOW_UNFILTERED_HTML to increase security on WordPress sites and not allow users full HTML use.
Fixable in one click
Config Constant: Disable unfiltered file uploads with ALLOW_UNFILTERED_UPLOADS
We highly recommend you disable ALLOW_UNFILTERED_UPLOADS to filter all uploads by users - and only enable when you need to.
Fixable in one click
Config Constant: Enable Auto Upgrades with AUTOMATIC_UPDATER_DISABLED constant
WordPress can install its own security releases unattended, which for most sites closes a known hole faster than anyone would get round to it by hand.
Fixable in one click
Config Constant: Enable Minor Upgrades only with WP_AUTO_UPDATE_CORE constant
Force WordPress to only apply minor updates instead of major ones automatically
Fixable in one click
Config Constant: Disable Plugin Installs with DISALLOW_FILE_MODS constant
Disabling plugin and theme installations when in WordPress Admin on a live site can ensure stability and stop admins breaking sites.
Fixable in one click91.9% of the WordPress sites we have this data for fail it
Config Constant: Disable Script debugging with SCRIPT_DEBUG constant
Disable SCRIPT_DEBUG so that minified assets (Javascript files) are loaded
Fixable in one click
Config Constant: Disable save queries debug with SAVEQUERIES constant
Disable SAVEQUERIES unless you are debugging a problem on a development site
Fixable in one click
Config Constant: Enable WP_POST_REVISIONS to limit number of revisions saved to 10
Use WP_POST_REVISIONS to limit number of revisions saved to the database
Fixable in one click
Config Constant: Set AUTOSAVE_INTERVAL to 30 seconds to prevent data loss
Use AUTOSAVE_INTERVAL to change the interval between auto-saves to prevent losing your drafts
Fixable in one click
Disable Emojis
Disable the script to render emojis in WordPress posts as a micro-optimisation
Fixable in one click
Remove jQuery Migrate Script
Disable the jQuery script in WordPress if you dont need if
Fixable in one click
Remove WordPress Admin Footer Banner
Disable the this for fewer bytes to transfer and less visual clutter.
Fixable in one click
Remove WordPress & Plugin Generator Tags And Version Numbers
Remove the WordPress Generator HTML tag and version numbers from your public pages
Fixable in one click
Remove post shortlink head tags
Remove the WordPress post shortlink HTML head tags if not needed
Fixable in one click
Remove WordPress Logo Menu top left of Admin Console
Remove the WordPress logo, fewer bytes to transfer and less visual clutter!
Fixable in one click
Disable WordPress Application Passwords for APIs
We highly recommend you disable WordPress Application Passwords for APIs unless you know of a reason that you need it enabled.
Fixable in one click
Disable Links In User Comments To Prevent Spam
Deter users spamming your comments with links, by removing the hyperlinks in comments
Fixable in one click
Disable the "Howdy," greeting
Because its not the 1990's anymore...
Fixable in one click
Remove Plugin Admin Nag Screens
Because plugin developers abuse your admin console far too much nowadays
Fixable in one click
Disable Frontend Menu Bar When Logged In
If you dont need the menubar on the frontend, disable it!
Fixable in one click
Config Constant: Disable WP_AI_SUPPORT to turn off WordPress AI features
Disable the WordPress 7.0+ built-in AI client by defining WP_AI_SUPPORT to false in wp-config.php
Fixable in one click
Find out which of these your sites fail
Connect a site and every check in this group runs against it automatically, with the result and the fix in one place. The quick checks here run twice a day; the deeper file scans run with the full audit, which most sites schedule weekly.
Run a free audit