Security Guides
Understand what your scan found
Every finding explained in plain English — what it is, why it matters, and exactly how to fix it. No security degree required.
Fix guides
PHP Version Exposed
HIGHYour server is broadcasting which version of PHP it runs. Learn how to hide it in a few steps.
Read guide →
Server Version in HTTP Headers
INFOYour web server is announcing its software and version number. Learn how to suppress it.
Read guide →
WordPress Version in Page Source
MEDIUMYour WordPress version is visible in every page's HTML. Learn how to remove it with one line of code.
Read guide →
Sensitive Files Publicly Accessible
HIGHWordPress ships with files that reveal your site version. Learn how to block public access in minutes.
Read guide →
XML-RPC Enabled
HIGHXML-RPC lets attackers run thousands of login attempts at once. Learn how to disable it in two steps.
Read guide →
Login Page Exposed
INFOYour WordPress login page is publicly accessible. Learn how to protect it from brute-force attacks.
Read guide →
User Enumeration
MEDIUMWordPress is exposing your admin usernames via its REST API. Block it with one code snippet.
Read guide →
Directory Listing Enabled
HIGHAnyone can browse your WordPress uploads folder. One line in .htaccess closes this immediately.
Read guide →
Missing HTTP Security Headers
MEDIUMYour server isn't sending the HTTP headers that tell browsers how to protect your visitors. Learn which headers to add and how.
Read guide →
HTTP to HTTPS Redirect Missing
HIGHVisitors who type your address without 'https://' load the site over plain HTTP. Learn how to force every visitor onto the encrypted version.
Read guide →
Cookies Missing Security Flags
MEDIUMCookies without Secure, HttpOnly, or SameSite flags can be stolen over plain HTTP, read by JavaScript, or used in CSRF attacks. Learn how to set them correctly.
Read guide →
Vulnerable Plugins Detected
CRITICALOne or more WordPress plugins has known security vulnerabilities. Learn how to find and update them.
Read guide →
WordPress Security Checklist
A complete checklist of all 11 security checks — with links to each fix guide. Work through it to see where your site stands.
Diagnosis & help
Is My WordPress Site Hacked?
DiagnosisHow to tell if your WordPress site has been hacked — the warning signs, what to check, and exactly what to do next. No technical knowledge required.
Read →
My WordPress Site Was Flagged by Google — What Now?
DiagnosisYour WordPress site is showing a Google malware warning or security flag. Here's what it means, how to check if it's real, and exactly how to get it removed.
Read →
How Often Should You Scan Your WordPress Site?
DiagnosisThe honest answer to how often you should run a WordPress security scan — and why the timing matters more than most site owners realise.
Read →
WordPress Security Myths: What Actually Matters
DiagnosisThe most common WordPress security myths, debunked. What actually protects your site — and what's just noise that gives you false confidence.
Read →
Why Does My WordPress Site Keep Getting Hacked?
DiagnosisCleaned up your WordPress site and got hit again? You missed something. The five places backdoors hide, the forensic checklist, and when to rebuild.
Read →
How to Harden WordPress: The Complete Checklist
DiagnosisAn end-to-end checklist for hardening WordPress — what an automated scan catches, what it misses, what your host needs to handle. Built for site owners.
Read →
How to Detect a WordPress Backdoor
DiagnosisFind WordPress backdoors yourself — what they look like, where they hide, and the file + database checks that uncover them, with honest time estimates.
Read →
How to Find WordPress Malware After You've Cleaned It Up
DiagnosisCleaned up a hacked WordPress site but worried something survived? The verification checklist — what to check, where sleepers hide, when to call it clean.
Read →
How to Detect WordPress Database Malware
DiagnosisFile scanners miss WordPress database malware. The SQL queries that find malicious entries in wp_options, wp_postmeta, wp_posts and wp_users — safely.
Read →
By business type
WordPress Security for WooCommerce Stores
IndustryWooCommerce stores face the same WordPress vulnerabilities as any site — plus the stakes of customer data and payment processing. Here's what matters.
Read →
WordPress Security for Agencies and Freelancers
IndustryIf you build or maintain WordPress sites for clients, security isn't just their problem — it's yours. Here's how to manage it without it taking over your life.
Read →
Taking Over a WordPress Site: Audit Checklist for Agencies
IndustryInheriting a WordPress site you didn't build? Step-by-step audit workflow — scan, forensic check, fix, re-scan — for agencies, freelancers, and VAs.
Read →
Tool guides
Not sure where to start? Scan your site to see exactly which checks it passes and fails.
Run a free scan →