Security Guides
Understand what your scan found
Every finding explained in plain English — what it is, why it matters, and exactly how to fix it. No security degree required.
Fix guides
PHP Version Exposed
HIGHYour server is broadcasting which version of PHP it runs. Learn how to hide it in a few steps.
Read guide →
Server Version in HTTP Headers
INFOYour web server is announcing its software and version number. Learn how to suppress it.
Read guide →
WordPress Version in Page Source
MEDIUMYour WordPress version is visible in every page's HTML. Learn how to remove it with one line of code.
Read guide →
Sensitive Files Publicly Accessible
HIGHWordPress ships with files that reveal your site version. Learn how to block public access in minutes.
Read guide →
XML-RPC Enabled
HIGHXML-RPC lets attackers run thousands of login attempts at once. Learn how to disable it in two steps.
Read guide →
Login Page Exposed
INFOYour WordPress login page is publicly accessible. Learn how to protect it from brute-force attacks.
Read guide →
User Enumeration
MEDIUMWordPress is exposing your admin usernames via its REST API. Block it with one code snippet.
Read guide →
Directory Listing Enabled
HIGHAnyone can browse your WordPress uploads folder. One line in .htaccess closes this immediately.
Read guide →
Missing HTTP Security Headers
MEDIUMYour server isn't sending the HTTP headers that tell browsers how to protect your visitors. Learn which headers to add and how.
Read guide →
HTTP to HTTPS Redirect Missing
HIGHVisitors who type your address without 'https://' load the site over plain HTTP. Learn how to force every visitor onto the encrypted version.
Read guide →
Cookies Missing Security Flags
MEDIUMCookies without Secure, HttpOnly, or SameSite flags can be stolen over plain HTTP, read by JavaScript, or used in CSRF attacks. Learn how to set them correctly.
Read guide →
Vulnerable Plugins Detected
CRITICALOne or more WordPress plugins has known security vulnerabilities. Learn how to find and update them.
Read guide →
WordPress Security Checklist
A complete checklist of all 11 security checks — with links to each fix guide. Work through it to see where your site stands.
Diagnosis & help
Is My WordPress Site Hacked?
DiagnosisHow to tell if your WordPress site has been hacked — the warning signs, what to check, and exactly what to do next. No technical knowledge required.
Read →
My WordPress Site Was Flagged by Google — What Now?
DiagnosisYour WordPress site is showing a Google malware warning or security flag. Here's what it means, how to check if it's real, and exactly how to get it removed.
Read →
How Often Should You Scan Your WordPress Site?
DiagnosisThe honest answer to how often you should run a WordPress security scan — and why the timing matters more than most site owners realise.
Read →
WordPress Security Myths: What Actually Matters
DiagnosisThe most common WordPress security myths, debunked. What actually protects your site — and what's just noise that gives you false confidence.
Read →
Why Does My WordPress Site Keep Getting Hacked?
DiagnosisCleaned up your WordPress site and got hit again? You missed something. The five places backdoors hide, the forensic checklist, and when to rebuild.
Read →
WordPress Hardening: The Complete Checklist
DiagnosisA prioritised WordPress hardening checklist — 25 items across three urgency tiers, with inline fixes and two contested practices most guides still get wrong.
Read →
How to Detect a WordPress Backdoor
DiagnosisFind WordPress backdoors yourself — what they look like, where they hide, and the file + database checks that uncover them, with honest time estimates.
Read →
How to Find WordPress Malware After You've Cleaned It Up
DiagnosisCleaned up a hacked WordPress site but worried something survived? The verification checklist — what to check, where sleepers hide, when to call it clean.
Read →
How to Detect WordPress Database Malware
DiagnosisFile scanners miss WordPress database malware. The SQL queries that find malicious entries in wp_options, wp_postmeta, wp_posts and wp_users — safely.
Read →
WordPress REST API Security: Don't Disable It, Restrict It
DiagnosisMost guides tell you to disable the WordPress REST API and break Gutenberg. The real problem is one endpoint leaking usernames — two filters fix it.
Read →
How to Clean a Hacked WordPress Site (Step by Step)
DiagnosisA practical walkthrough to clean a hacked WordPress site — file scan, database pass, vulnerability close, verification, and when DIY stops being worth it.
Read →
WordPress 2FA Setup: Which Plugin, How to Install It
DiagnosisHow to add two-factor authentication to your WordPress admin in 2026 — which plugin to pick, the setup walkthrough, backup codes, and rollout to other admins.
Read →
Brute-Force Attacks on WordPress: How They Work, Stop Them
DiagnosisWhat modern WordPress brute-force attacks look like, the four defenses that actually work in priority order, and which popular protections are theatre.
Read →
Remove Google's 'Site May Be Hacked' Warning (Walkthrough)
DiagnosisThe Search Console review-request flow end-to-end — what to write, what to do if Google rejects, and the exact UI sequence to remove the hacked warning.
Read →
WordPress Malware: Files vs Database (and Why It Matters)
DiagnosisWhere WordPress malware actually hides — files, database, or both — why most scanners miss one of them, and the order of operations for a cleanup that holds.
Read →
WordPress Plugin Vulnerabilities Explained
DiagnosisPlugins cause 91% of WordPress hacks. Learn how to detect vulnerable plugins, read CVE advisories without panic, and protect your site before attackers act.
Read →
By business type
WordPress Security for WooCommerce Stores
IndustryWooCommerce stores face the same WordPress vulnerabilities as any site — plus the stakes of customer data and payment processing. Here's what matters.
Read →
WordPress Security for Agencies and Freelancers
IndustryIf you build or maintain WordPress sites for clients, security isn't just their problem — it's yours. Here's how to manage it without it taking over your life.
Read →
Taking Over a WordPress Site: Audit Checklist for Agencies
IndustryInheriting a WordPress site you didn't build? Step-by-step audit workflow — scan, forensic check, fix, re-scan — for agencies, freelancers, and VAs.
Read →
Tool guides
Which WordPress Security Tool Do You Need?
Tool GuideGuardingWP, Wordfence, WPScan, Sucuri — what each one actually does and when to use it. A plain-English guide to WordPress security tools.
Read →
Best Free WordPress Security Plugins (2026)
Tool GuideThe best free WordPress security plugins compared — plus when good hosting and Cloudflare make one redundant, and the Wordfence free-tier delay most skip.
Read →
Not sure where to start? Scan your site to see exactly which checks it passes and fails.
Run a free scan →