Security Measures in WP Toolkit
Knowledgebase Article
}
Knowledgebase Article
WP Toolkit’s Security Measures tab like a Swiss Army knife security tool for your WordPress site. It’s packed with useful tools to strengthen your defences, helping protect against common vulnerabilities, unauthorised access, and potential exploits.
There are key security measures (the must-haves, always-on-by-default stuff) and recommended security measures (the slightly more advanced, optional extras that can make you even more secure, but you might want to proceed with caution). Some of these changes are reversible if you ever need to backtrack, while others are more permanent. So, before you dive in, it’s smart to back up your site—just in case things don’t go as planned.
But just like a Swiss Army knife isn’t the only tool you’ll ever need, WP Toolkit's security measures aren't the be-all and end-all of site security. Security is a multi-layered approach, and this is why we also have extremely robust firewalls and automated vulnerability patching for WordPress.
All of these tools help improve protection, but you still need to keep an eye out for known vulnerabilities as they arise. For more information on how to stay vigilant about security threats, check out our article on vulnerability detection.
By combining these tools with proactive security practices, you can build a strong, reliable defence for your WordPress site. Ready to get started?
First, we’ll walk through how to locate and apply these security measures in WP Toolkit. Then, we’ll go through each measure in detail, explaining what it does, why it’s important, and whether it can be reverted.
To apply these security measures, follow these steps:

The following security measures are key and should be enabled on all WordPress websites for best security. They will be enabled by default on new WP installations via WP Toolkit and we strongly recommend you keep these on, or enable them if they are not applied.
What it does: This feature ensures that your WordPress files and directories are set to the appropriate permissions to prevent unauthorised access. Typically, WordPress files should have 644 permissions (readable by everyone but writable only by the owner), and directories should have 755 permissions (readable and executable by everyone, but writable only by the owner). This option automatically corrects any incorrect permissions.
In addition to this, it sets the wp-config.php file—a critical file containing your database credentials—to 600 permissions. This means only the file’s owner can read and write to it, adding an extra layer of security by further restricting access to this sensitive file.
Possible Complications:
Recommendation:
What it does: By default, if a directory in WordPress doesn’t have an index file (like index.php or index.html), anyone can access and view the contents of that directory by simply entering the URL in a browser. For example, visiting example.com/wp-content/uploads/2021/11 would display a list of all files uploaded in that folder. This can expose sensitive information, such as media files or data you didn’t intend to be publicly visible.
The Block Directory Browsing measure adds a rule to your server configuration that disables directory listings, preventing unauthorised users from viewing the contents of your folders.
Possible Complications:
Recommendation:
What it does: The wp-config.php file is one of the most important files in your WordPress installation. It contains sensitive information like your database credentials, security keys, and other critical configuration settings. Blocking access to this file prevents unauthorized users from viewing or modifying its content.
If, for some reason, your server stops processing PHP files, an attacker could potentially view the raw contents of wp-config.php through a web browser. This security measure ensures that the file remains protected, even if there are issues with PHP processing.
This measure works by adding rules to the server configuration (Apache, nginx) to block any direct access to wp-config.php. However, it's important to note that custom .htaccess directives may override this setting, so ensure any manual configurations don't unintentionally expose the file.
Possible Complications:
Recommendation:
What it does: Cache directories are used to store static files like HTML, CSS, or images, allowing your site to load faster by reducing server processing time. There should never be any PHP scripts in these directories, as they are meant only for storing cached content.
The Disable PHP Execution in Cache Directories measure adds a rule that prevents any PHP scripts from being executed within these cache folders. This significantly reduces the risk of malicious code being executed from files that may have been improperly placed or uploaded in the cache directory.
Possible Complications:
Recommendation:
What it does: The Block Access to Sensitive Files security measure protects your WordPress site by denying access to certain files that could inadvertently expose sensitive information. For example, when you edit the wp-config.php file, your text editor may create temporary backup files like wp-config.php.swp or wp-config.php.bak. These temporary files can potentially expose sensitive data, such as database credentials, if they are publicly accessible.
In addition, this measure blocks access to default WordPress files such as readme.html, license.txt, and wp-config.php.bak. While these files might not seem dangerous on the surface, they should be protected as a general security practice. Blocking access ensures that unintentional copies or redundant files aren’t available to malicious actors.
Possible Complications:
Recommendation:
What it does: WordPress often creates an administrator account with the username admin during installation. This username is commonly targeted in brute-force attacks because it’s predictable. The Change Default Administrator’s Username feature in WP Toolkit eliminates this vulnerability by creating a new administrator account with a randomly generated username and removing the admin user.
How it works:
Possible Complications:
Recommendation:
For further security enhancements, consider using a plugin to:
The following security measures are strongly recommended to be enabled on all WordPress websites, however, may not be appropriate for all sites.
The xmlrpc.php file in WordPress is used for remote communication with your site. It allows for features like remote publishing and connects your site to external applications like the WordPress mobile app and some Jetpack functionalities.
However, because it is a gateway for remote access, it is also a common target for attackers. Blocking access to xmlrpc.php can prevent several types of attacks, particularly brute force and DDoS attacks, which attempt to overload your site or guess passwords through repeated attempts.
Possible Complications:
Recommendation:
The wp-includes directory is a core part of WordPress, containing essential files and libraries that power the platform. By default, it doesn't require the execution of custom PHP scripts (and probably shouldn’t!). Forbidding the execution of PHP scripts in this directory enhances security by ensuring that only the necessary core files run, thereby reducing the risk of malicious code execution in this critical area.
Possible Complications:
Recommendation:
Similar to the above measure, this security setting prevents the execution of PHP scripts in the wp-content/uploads directory. This directory is where WordPress stores all media files, such as images, videos, and documents, that you upload through the media library.
This carries the same complications as the previous security measure, but in general, you don’t want PHP scripts to execute in this directory and this should ideally be enabled for best security.
Disabling script concatenation prevents WordPress from combining multiple JavaScript and CSS files into single files in the admin panel. While concatenation can improve load times by reducing the number of HTTP requests, it can sometimes be exploited by attackers to inject malicious code or manipulate existing scripts.
Possible Complications:
Recommendation:
Turning off pingbacks disables WordPress's ability to notify other websites when you link to their content. While this feature was once popular for tracking backlinks, it has largely fallen out of favor due to its association with various security vulnerabilities, including Distributed Denial of Service (DDoS) attacks and XML-RPC exploits. Additionally, pingbacks are often exploited by spammers to flood sites with unwanted traffic.
Possible Complications:
Recommendation:
Disabling pingbacks is a straightforward and effective way to enhance your site's security by protecting against potential DDoS attacks, spam, and other vulnerabilities. In the current web landscape, pingbacks are largely unnecessary and mainly used by spammers, making this measure a smart choice for most WordPress sites.
Disabling file editing in the WordPress dashboard prevents users from editing theme and plugin files directly from the admin area. This measure reduces the risk of malicious code being injected into your site, whether by accident or through unauthorized access.
Possible Complications:
Recommendation:
Disabling file editing in the WordPress dashboard is a simple yet effective security measure that minimizes the risk of malicious code injections. By enforcing this setting, you can help ensure that only authorized users with appropriate access levels can modify critical files, thereby protecting your site from potential threats.
Enabling bot protection activates security measures designed to block malicious bots from accessing your site. These bots often engage in automated attacks, data scraping, and other harmful activities that can compromise your site’s security and performance.
Possible Complications:
Our Solution: We have already implemented measures to block problematic bots using ModSecurity, which includes a comprehensive and up-to-date set of rules. These rules cover the bots that WP Toolkit aims to block and more, ensuring that your site is protected against a wide range of malicious bot activities.
Recommendation:
Enabling bot protection is an additional safeguard against malicious bots that perform automated attacks and data scraping. While our ModSecurity rules already offer robust protection, this measure can still provide an extra layer of security if desired.
What it does: This security measure blocks public access to files that could pose a security risk if left exposed on your WordPress website. These files may include log files, shell scripts, and other executables that could contain sensitive information about your site’s configuration or offer a way for attackers to gain unauthorized access. If these files are accessible to the public, they can potentially compromise your site's security by revealing critical information or enabling malicious actions.
Possible Complications:
Recommendation:
Blocking access to .htaccess and .htpasswd files prevents unauthorised users from accessing or modifying these critical configuration files. The .htaccess file is used to manage various server settings, including redirects, access controls, and security rules, while the .htpasswd file is used to store usernames and passwords for basic authentication.
Possible Complications:
Recommendation:
Note: At Kualo, our Apache configuration already restricts direct access to these files by default. This makes some of the WP Toolkit measures redundant on our servers. However, enabling these measures adds an extra layer of security. The only potential downside is that access might be denied twice, which doesn't cause any issues.
What it does: Blocking author scans prevents attackers from identifying the usernames of your site’s authors, which could be used in brute-force attacks. Hackers often attempt to discover usernames by scanning for author profiles, using this information to try and crack the corresponding passwords.
Possible Complications:
Recommendation:
How it works: This security measure blocks access to URLs that contain "author=" followed by a numeric value, a common technique used in scans to reveal usernames. By preventing these scans, you reduce the chances of an attacker identifying login names, making your site less vulnerable to brute-force attacks.
What it does: WordPress uses eight security keys, which are defined in the wp-config.php file, to secure login sessions and protect cookies from being compromised. These keys help encrypt and secure the information stored in cookies for logged-in users, making it harder for attackers to read or hijack the sessions.
By default, these keys are not set, and you'll often see placeholder text like this in a fresh WordPress install:
define( 'AUTH_KEY', 'put your unique phrase here' );
define( 'SECURE_AUTH_KEY', 'put your unique phrase here' );
define( 'LOGGED_IN_KEY', 'put your unique phrase here' );
define( 'NONCE_KEY', 'put your unique phrase here' );
define( 'AUTH_SALT', 'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT', 'put your unique phrase here' );
define( 'NONCE_SALT', 'put your unique phrase here' );
The Configure Security Keys feature in WP Toolkit automates this process by generating unique, random phrases and inserting them into the wp-config.php file for you, enhancing the security of your site.
Possible Complications:
Recommendation:
What it does: The database prefix is a string added to the beginning of each table name in a WordPress database, allowing multiple WordPress installations to share a single database without conflicts. By default, WordPress uses the prefix wp_, resulting in tables like wp_posts and wp_users.
Changing the default table prefix to something random is often recommended as a basic security measure. The idea is that automated scripts targeting WordPress sites may assume the prefix is wp_, and changing it can make those attacks less effective. The Change Database Prefix feature in WP Toolkit automatically generates a random prefix and updates the $table_prefix variable in wp-config.php, while renaming all the associated database tables.
Possible Complications:
Recommendation:
Powered by WHMCompleteSolution