A site you have taken on
See how an inherited or client site is set up before you change anything.
Review your WordPress site's security configuration
A free plugin that checks updates, PHP support, HTTPS, the file editors, wp-config.php and administrator accounts from inside your site. Every finding shows the evidence the check observed and a practical next step.
Get the pluginCheck from outside
- Free on WordPress.org
- Runs on your server
- Sends nothing to Ironfang
- No account needed
Example finding
The dashboard file editors are turned on
LowConfirmedDashboard file editor
What the check found
2 accounts can change theme and plugin code from the dashboard. If an administrator account is taken over, the attacker can run code on the server straight away.
Evidence
- DISALLOW_FILE_EDIT
- false
- Turned off by Ironfang Security
- No
- Accounts that can use the editors
- 2
What to do
Add this to wp-config.php, or turn the editors off from this check's page:
define( 'DISALLOW_FILE_EDIT', true );Run the check again to confirm
Why it matters
Small settings add up
A plugin left installed after a test, a debug log inside the site's files, an administrator nobody remembers, a PHP version past its security fixes. None of it shows on the site, and little of it is visible from outside.
The plugin reads these settings from inside WordPress and lists what it finds by priority, each with its evidence and guidance. Administrators can run it from the dashboard or from WP-CLI.
# Run every check
wp ironfang-security scan --user=admin
# A report as JSON, without the site address
wp ironfang-security report --format=json \
--no-site-address --user=admin
# Turn off the dashboard file editors,
# as DISALLOW_FILE_EDIT does
wp ironfang-security hardening apply file_editor \
--user=adminCapabilities
What it checks
Local checks of WordPress's settings, files and accounts. Every finding has a severity and a separate confidence.
Updates and software
Available WordPress, plugin and theme updates, from the update information WordPress already stores, and how old it is. Plugins and themes installed but not in use, and a list of the installed software.
PHP and updating
Whether the server's PHP version still receives security fixes, and how the site is set to update.
HTTPS and errors
Whether WordPress is set up for HTTPS, whether PHP errors are shown to visitors and whether a debug log is kept inside the site's files.
wp-config.php and the file editors
Who on the server can read or change wp-config.php, whether it sets its own security keys and salts, and whether the dashboard file editors are on.
Files that should not be there
Files named to run as PHP in the uploads directory, and copies of wp-config.php, .env files, database dumps, archives or .git folders in public directories. Found by name only: files are never opened or requested.
Accounts
What public registration grants, which accounts have administrator-level access, and which administrators have application passwords that are not being used.
Use cases
When to run it
When you take a site on, before it changes and after.
Before a launch
Check HTTPS, error display and the debug log before visitors arrive.
After updates
Scan again after updating WordPress, plugins or PHP, and recheck the findings you fixed.
Tidying up
Find plugins and themes no longer in use, and administrator accounts and application passwords nobody needs.
In Site Health
Administrators see the last scan's open findings in Tools > Site Health, and a prompt when it is more than a week old.
Sharing results
Download a report as readable text or JSON, without server paths or account details, for a client or a colleague.
Pricing
Free on WordPress.org
Open source under the GPL and free to install, with no Ironfang account. To check a domain's DNS, TLS, headers and exposed services from outside, use the External Security Check.
Questions
FAQ
Privacy, the file editors and what the plugin leaves alone.
- Does it protect my site from attacks?
- No. It is not a firewall and does not block traffic. It finds configuration risks so you can act on them.
- Does it send data to Ironfang?
- No. It does not contact Ironfang or any other service, collect analytics or set cookies. Check results store counts and settings, not account details, and Ironfang Security > Settings lists everything the plugin stores.
- Why do some results say "Could not be determined"?
- A check says so when it cannot observe enough to answer: for example when WordPress has not stored recent update information. Such a result is never counted as passed, and it explains what is missing and what to do.
- Can it turn off the file editors?
- Yes, if you ask it to, from the "Dashboard file editor" check's page or with WP-CLI. It has the same effect as DISALLOW_FILE_EDIT, can be undone and is logged. It lasts only while the plugin is active; for a permanent change, add DISALLOW_FILE_EDIT to wp-config.php.
- Which sites does it support?
- Single-site WordPress 6.8 or later, on PHP 8.1 or later. It does not load on multisite networks. It has been tested with WordPress 6.8, 7.0 and 7.1 on Apache and nginx, behind an HTTPS reverse proxy, and alongside WooCommerce, WP Super Cache and Wordfence.
- What happens when I uninstall it?
- Deactivating keeps its data, and turns the file editors back on if the plugin turned them off. Deleting it removes the data it created and nothing else. To keep the results, download a report from Ironfang Security > Settings first.
- How do I report a vulnerability in the plugin?
- Email security@ironfang.com privately, not in the support forum, with the plugin, WordPress and PHP versions and the steps to reproduce it. Ironfang's vulnerability disclosure policy explains what happens next.
Less to operate. More to ship.
Review your site
Install it from Plugins > Add New Plugin, activate it and open Ironfang Security in the admin menu. Activation changes no setting.
Free. No Ironfang account needed.