WPShadow

All Shadow checks

WordPress security checks in Shadow

Hardening and everyday hygiene: updates, HTTPS and SSL, login protection, two-factor sign-in for admins, file permissions and editing, exposed files, security headers, spam protection and privacy pages.

There are 46 checks in this family. Shadow reports what it finds, and nothing is changed until you approve a fix.

In this family

What each check looks at

Admin Account Count Minimized

Checks whether the number of administrator accounts exceeds a safe threshold, which increases the attack surface for privilege abuse or compromised credentials.

Admin Session Expiration Hardened

Checks whether the WordPress admin authentication cookie lifetime has been reduced from the default 14-day period to limit the window for session hijacking.

Application Passwords Policy

Checks whether WordPress Application Passwords are enabled and, if so, whether a REST API integration plugin is active that would justify the feature being on by default.

Why it matters. Since WordPress 5.6, Application Passwords are enabled by default on any HTTPS site. They allow authenticated users to generate long-lived tokens for programmatic REST API access without entering their main password. Most site owners are unaware this feature is active. On sites that do not use headless frameworks, mobile apps, or REST API automation, Application Passwords represent an additional authentication surface that warrants an intentional decision rather than silent default enablement.

Auth Keys And Salts Set

Checks whether all WordPress authentication keys and salts are set to unique, non-default values in wp-config.php to protect session security.

Auto Update Policy

Checks whether a WordPress core auto-update policy has been explicitly configured rather than left to the default behavior, which may leave security patches unapplied.

Backup Files Not Public

Searches web-accessible directories for archive and database dump files that could allow an attacker to download your site database or source code.

Why it matters. Searches shallow web-accessible directories for archive and database files that could expose sensitive data if reachable via a browser.

Checks whether WordPress limits the number of links allowed in a comment submission, which reduces the appeal of the comment form for spam bots.

Comment Moderation Enabled

Checks whether WordPress comment moderation is enabled so that submitted comments are held for review before appearing publicly on the site.

Database Prefix

Checks whether the WordPress database table prefix is still the default "wp_", which makes automated SQL injection attempts easier to craft.

DB Credentials Not Exposed

Checks whether debug modes or misconfigured error display settings could expose database credentials or errors to the public.

Why it matters. Scans for conditions that could leak database credentials or connection details to the public, such as debug mode exposing error output.

Default Admin Username Removed

Checks whether a user account with the username "admin" exists, which is a high-value target for automated brute-force attacks.

Default Role is Subscriber

Checks whether the default role assigned to newly registered users is set to Subscriber, minimizing capabilities granted automatically on registration.

Why it matters. Checks whether the default role assigned to new user registrations is "subscriber", the least-privileged role, to minimise privilege escalation risk.

Directory Listing Disabled

Checks whether web server directory listing is disabled to prevent attackers from browsing the site's file structure when no index file is present.

Why it matters. Verifies that web server directory listing is disabled for the uploads folder to prevent attackers from enumerating uploaded files.

File Modifications Policy Defined

Checks whether a file modifications policy (DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT) is explicitly defined in wp-config.php to lock down the admin panel.

File Permissions

Checks wp-config.php, .htaccess, and the uploads directory for world-readable or world-writable permission modes that could expose credentials or allow code injection.

Why it matters. Checks critical WordPress files and directories for unsafe permission modes that could allow unauthorised reading or modification of site files.

Force SSL Admin

Checks whether FORCE_SSL_ADMIN is enabled to ensure all WordPress admin panel sessions are served exclusively over HTTPS.

Why it matters. Checks whether the WordPress admin dashboard is forced to use HTTPS via the FORCE_SSL_ADMIN constant or equivalent server configuration.

Form Rate Limiting Active

Checks whether an active plugin enforces rate limiting or anti-spam protection on WordPress forms to block bot submissions.

Why it matters. Checks whether rate limiting or anti-abuse controls are active on WordPress forms to prevent brute-force and submission flooding attacks.

HTTPS Enabled

Checks whether both the WordPress Address and Home URL are configured to use HTTPS, ensuring all site traffic is encrypted in transit.

Login Throttling Active

Checks whether a login throttling or brute-force protection plugin is active to limit repeated failed login attempts on the WordPress login page.

Login URL Hardening

Checks whether a login hardening plugin is active or whether the default wp-login.php URL remains publicly accessible without rate-limiting, making it vulnerable to brute-force attacks.

Mixed Content Eliminated

Checks whether an HTTPS site is serving any mixed content (HTTP assets), which triggers browser security warnings and degrades trust.

Plugin Auto Updates

Checks whether automatic plugin updates are enabled to ensure security patches are applied promptly without requiring manual action.

Plugins Updated

Checks whether any installed plugins have available updates, as outdated plugins are a leading source of WordPress security vulnerabilities.

Checks that a privacy policy page is assigned in WordPress settings, published, and linked in a navigation menu to meet GDPR, CCPA, and other privacy regulation requirements.

Privacy Policy Page Set

Checks whether a privacy policy page has been created and designated in WordPress settings, as required for legal compliance under GDPR and similar regulations.

Query Debug Logging Disabled In Production

Checks whether SAVEQUERIES is enabled in production, which logs all database queries in memory and may expose sensitive query data or degrade performance.

readme.html Not Publicly Accessible

Checks that the WordPress readme.html file is not publicly accessible. The file prints the exact WordPress version number and is actively sought by automated vulnerability scanners.

REST API Sensitive Routes Protected

Tests whether the /wp-json/wp/v2/users endpoint is publicly accessible without authentication, which would allow attackers to enumerate valid usernames on the site.

Why it matters. Tests whether the WordPress REST API users endpoint exposes user account data without authentication, enabling username enumeration attacks.

Security Headers Present

Checks whether the site sends essential HTTP security headers such as X-Content-Type-Options, X-Frame-Options, and Content-Security-Policy.

Sensitive Files Protected

Checks the webroot and wp-content directory for sensitive files including .env configs, WordPress config backups, SQL dumps, debug logs, and exposed git repositories.

Spam Protection Enabled

Checks whether a spam protection plugin is active to filter bot submissions from WordPress comments and contact forms.

SSL Certificate Valid

Verifies that the site SSL certificate is trusted, not expired, and not expiring soon.

Theme and Plugin Editor Disabled

Checks whether the WordPress built-in theme and plugin file editor is disabled to prevent code modification directly from the admin panel.

Themes Updated

Checks whether any installed themes have available updates, as outdated themes can contain unpatched security vulnerabilities.

Two-Factor for Admin Enabled

Checks whether a two-factor authentication plugin is active to require a second verification step for administrator logins.

Why it matters. Checks whether a two-factor authentication plugin is active and verifies that all admin accounts have enrolled in 2FA.

Unused Plugins Removed

Checks whether inactive plugins remain installed, as deactivated plugins still represent an attack surface through outdated or vulnerable code.

Unused Themes Removed

Checks whether unused themes remain installed on the site, reducing the attack surface from outdated or unmaintained theme files.

Uploads PHP Execution Blocked

Checks whether PHP execution is blocked in the WordPress uploads directory to prevent uploaded malicious files from executing as PHP scripts.

User Enumeration Reduced

Checks whether WordPress user enumeration via the author query parameter or REST API is restricted to prevent attackers from harvesting valid usernames.

WordPress Core Updated

Checks whether a WordPress core update is available, as running an outdated version may expose the site to known security vulnerabilities.

WP Debug Display Off

Checks whether WP_DEBUG_DISPLAY is enabled along with WP_DEBUG, which would cause PHP errors and potentially sensitive information to leak to site visitors.

WP Debug Log Private

Checks whether the WordPress debug log file is publicly accessible via a direct URL when WP_DEBUG_LOG is enabled, which could expose sensitive server details.

wp-config Location

Checks whether wp-config.php has been moved above the web root or otherwise protected from direct web access, preventing credential exposure.

wp-config Permissions Hardened

Checks whether wp-config.php has restrictive file permissions to prevent other system users or web processes from reading database credentials.

wp-content Write Scope Minimized

Checks whether key wp-content subdirectories have overly permissive write permissions that could allow unauthorized file modifications on the server.

XML-RPC Policy

Checks whether XML-RPC is intentionally enabled, as an unmanaged xmlrpc.php endpoint is a common vector for brute-force and amplification attacks.

The other check families

Shadow is free and runs on your own server, with no account. The source is on GitHub, and these descriptions come from it.

Find me online: LinkedIn · Bluesky · X · Mastodon · YouTube · GitHub · WordPress.org