Run the WP Toolkit security checks and fix weak spots in your WordPress site.
The WP Toolkit checks your WordPress site for common weak spots and fixes most of them with one click.
Running the checks
- Sign in to HostPanel and go to WP Toolkit → Security.
- Select your site and open the Hardening tab.
- Each check shows whether your site is secure. Click Fix on any that are not.
What each check does
| Check | What the fix does |
|---|---|
| File Editor | Disables WordPress's built-in code editor, so a stolen admin password cannot be used to change your files. |
| Debug Mode | Turns off debug output that reveals details about your server. |
| wp-config Permissions | Makes wp-config.php, which holds your database password, readable only by your account. |
| Info Files | Removes readme.html and license.txt, which reveal your WordPress version. |
| PHP in Uploads | Stops PHP files from running in the uploads folder, where attackers often hide them. |
| XML-RPC | Blocks xmlrpc.php, which is often used for password-guessing attacks. Leave it allowed if you use the Jetpack plugin or the WordPress mobile app. |
| Comments | Turns comments off across the site. Only fix this if you do not want comments. |
| DB Table Prefix | Warns when the default wp_ prefix is used. This one is not fixed automatically. |
| Auto Updates | Warns if automatic security updates are switched off. |
Changed your mind? Click Undo on any fix.
More protection
- Turn on the web application firewall with WordPress rules.
- Use a unique, strong admin password and two-factor authentication in WordPress.
- Consider freezing a site that rarely changes.