Po polsku

WordPress security check

You run a WordPress site and want to check its security. There are two free checks. The scan on this page looks at the site from the outside in about 90 seconds, with no account and no password. Our free plugin, Ensomedia Security, checks the files, accounts and settings inside WordPress.

Want to know whether a shop or a link is safe before you buy or click? This check is not for that. It is for people who run the site. For a site you do not know, Google's Safe Browsing site status shows whether Google has flagged it.

What the outside scan checks on WordPress

Bots try every site they find for an outdated plugin, a forgotten backup file or a form that lets anything through. The scan looks at what they see.

• WordPress, plugin and theme versions. The versions your pages give away, compared with public lists of known security holes.
• The certificate and HTTPS. Whether the certificate is valid, when it expires, and whether pages load over a secure connection.
• Browser protections. Security headers and cookie settings.

That is the quick check, free without an account. With a free account, once you confirm the site is yours, the full check runs more than 20 checks. It looks deeper at WordPress and adds forms, malware and spam links in the pages, backups and configuration files anyone can download, email settings (SPF, DKIM and DMARC), open ports and old subdomains. Our plugin is one of the ways to confirm the site.

A plugin that adds nothing to your pages leaves no version to read, so the outside scan cannot judge it. That is where the plugin comes in.

What the free plugin checks inside

Ensomedia Security is in the official WordPress.org directory. It is free, needs no account and has no limits on checks, scheduled scans or email alerts. Its 25 checks cover:

• Malware and backdoors in files WordPress.org cannot vouch for: web shells, obfuscated code, PHP hidden in images, spam mailers, hidden administrators, injected JavaScript and malicious redirects.
• Core, plugin and theme files compared with the copies WordPress.org published for your version, plus PHP files the releases do not contain.
• File changes since the first scan, and PHP files in the uploads folder.
• Known vulnerabilities in plugins, themes and WordPress, premium ones included, with the version that fixes each one. You turn this on yourself.
• Closed, abandoned and unused plugins and themes, waiting updates and the PHP version.
• Injected content: scripts, hidden iframes and spam links in posts, widgets and site options.
• Accounts and settings: administrators, user registration, debug output, the file editor and XML-RPC.

It also limits failed logins and adds two-step login with an authenticator app or a passkey. Scheduled scans run once a day. It never changes files, users or settings by itself: only when you press a button or turn on a switch. It needs WordPress 6.2 and PHP 7.4 or newer.

To install it, go to Plugins, Add New in your dashboard and search for "Ensomedia Security". The details are on the plugin page.

What neither of them does

• They do not clean a hacked site. The plugin can put back the WordPress.org original of a changed core, plugin or theme file. Other fixes it explains, and your developer or hosting company makes them.
• They make no backups. Keep backups off the server, and check that a restore works.
• They do not replace a penetration test. A person testing how your shop works for days finds things no automated check does.

Is my WordPress hacked? The signs

• Under Users, filtered by Administrator, there is an account you do not know. Or the number next to "Administrator" does not match the people listed below it: malicious code sometimes hides an account.
• A plugin appeared that nobody installed.
• Customers report redirects to scams that you cannot reproduce on your own computer. They often show only on phones and only to visitors from Google.
• Searching site:yourdomain.com in Google lists spam pages nobody created.
• Google or Chrome warns about your site, or your hosting company writes about malicious files.

The article Signs your website was hacked lists what to do in the first hour. The Is my website safe? page covers sites on any system.

What to do after the check

1. Update WordPress, the theme and every plugin. An outdated plugin is the most common way into a WordPress site.
2. Delete plugins you do not use. A deactivated plugin's files stay on the server and can often still be reached.
3. Go through the administrators. Remove accounts of people who no longer work with you, and turn on two-step login for the rest.
4. Ask where the backups are. A backup in the site's own folder can be downloaded by anyone who guesses its name.
5. Forward the report. The full report has a brief for your developer with what to fix this week, this month and later.

Back to the free check