To check and secure WordPress installations:
- Go to Websites & Domains > WordPress.
- Do one of the following:
- To check the security of all WordPress installations, click Check Security.
- To secure a single WordPress installation, click the icon in the S column next to the name of the desired WordPress installation.
- To secure two or more WordPress installations, select the checkboxes for the corresponding WordPress installations, then click Check Security.
- Select the checkboxes corresponding to the security improvements you want to apply, then click Secure.
Caution: Keep in mind that not all security improvements can be rolled back. It is recommended to back up the corresponding subscription before securing WordPress installations.
The complete list of WordPress security improvements
The wp-content folder. The
wp-contentdirectory may contain insecure PHP files that can be used to damage your site. After WordPress installation, PHP files can be executed from the
wp-contentdirectory. The security check verifies that the execution of PHP files in the
wp-contentdirectory is forbidden. Note that custom directives in the
web.configfiles might override this security measure. Also note that some of your plugins might stop working after securing the wp-content folder.
The wp-includes folder. The
wp-includesdirectory may contain insecure PHP files that can be used to damage your site. After WordPress installation, PHP files can be executed from the
wp-includesdirectory. The security check verifies that the execution of PHP files in the
wp-includesdirectory is forbidden. Note that custom directives in the
web.configfiles might override this security measure. Also note that some of your plugins might stop working after securing the wp-includes folder.
The configuration file. The
wp-config.phpfile contains credentials for database access and other sensitive information. After WordPress installation, the
wp-config.phpfile can be executed. If, for some reason, processing of PHP files by the web server is turned off, hackers can access the content of the
wp-config.phpfile. The security check verifies that unauthorized access to the
wp-config.phpfile is blocked. Note that custom directives in the
web.configfiles might override this security measure.
- Directory browsing permissions. If directory browsing is turned on, hackers can obtain information about your site (what plugins you use and so on). By default, directory browsing is turned off in Plesk. The security check verifies that directory browsing on the WordPress installation is turned off.
Database prefix. WordPress database tables have the same names in all WordPress installations. When the standard
wp_database table name prefix is used, the whole WordPress database structure is not a secret and anyone can obtain any data from it. The security check changes the database table name prefix to something other than
wp_. The maintenance mode is turned on, all plugins are deactivated, the prefix is changed in the configuration file, the prefix is changed in the database, the plugins are re-activated, the permalink structure is refreshed, and then the maintenance mode is turned off.
Security keys. WordPress uses security keys (
NONCE_KEY) to encrypt information stored in the user's cookies. A good security key should be long (60 characters or longer), random and complicated. This security check verifies that the security keys are set up and that they at least contain both alphabetic and numeric characters.
Permissions for files and directories. If permissions for files and directories do not comply with the security policy, these files can be used to hack your site. After WordPress installation, files and directories can have various permissions. The security check verifies that the permissions for the
wp-config.phpfile are set to
600, for other files to
644, and for directories to
Administrator’s username. When a WordPress copy is installed, by default there is a user with administrative privileges and the username
admin. As a user's username cannot be changed in WordPress, one only needs to guess the password to access the system as the administrator. The security check verifies that there is no user with the administrative privileges and the username
Version information. There are known security vulnerabilities for each WordPress version. For this reason, displaying the version of your WordPress installation makes it an easier target for hackers. The version of an unprotected WordPress installation can be seen in the pages' meta data and
readme.htmlfiles. The security check verifies that all
readme.htmlfiles are empty and that every theme has a
functions.phpfile which contains the line:
Leave your comments on this page
Leave your feedback or question on this documentation topic below. For technical assistance, contact your hosting service provider or submit a request to Plesk support. Suggest new features for Plesk here. Discuss general questions on the Plesk forum. All offtopic comments will be removed.