Security and backup
Configuration mistakes that make WordPress easier to attack.
Security Checker is part of the free Site Toolkit plugin, not a separate download: install Site Toolkit and switch it on under Site Toolkit → Modules.
Download Site Toolkit free 0.12.2Checks accounts, settings and the files the public can reach.
Free
- An "admin" user, too many administrators, public login names
- The file editor, visible PHP errors, weak security keys, XML-RPC
- Config backups, database dumps and .git folders in the web root
- Folder listing and security headers
Free in full: Clearyvo Pro adds nothing to this checker.
Good to Know
- HTTPS and the certificate are checked by SSL Checker.
Where to Get It
Part of the Site Toolkit plugin: switch it on under Site Toolkit → Modules.
How to Check WordPress Security Settings
- Install the free Site Toolkit plugin and switch on Security Checker under Site Toolkit → Modules.
- Open Security Checker in the WordPress admin (under Site Toolkit when you use more than one checker) and run the check. It works in short steps, so it finishes on shared hosting and large sites too.
- Read the report. Nothing on the site changes until you tick an item and confirm.
Related Checkers
- Plugin Health: Outdated, abandoned, closed and vulnerable plugins, and fresh-install leftovers.
- SSL Checker: Certificate, HTTPS redirects and mixed content.
- Site Backup: Backups in small, resumable steps, with a size report and a standalone restorer.