Steel Security & Hardening – Site Audit Tools

Steel Security & Hardening – Site Audit Tools focuses on practical security hygiene for WordPress administrators.

The free plugin provides:

• on-demand security scans
• a clear manual workflow: run a scan, review findings, take action, and run again
• risk summaries grouped by severity and category
• dashboard summary panels for scan risk, hardening posture, last scan state, and Recommended Actions
• dashboard Recommended Actions that point administrators to the highest-value next step
• checks for common WordPress hardening gaps
• checks for exposed root-level artifacts such as .env, SQL dumps, phpinfo files, and backup archives
• a quarantine vault for operator-reviewed file isolation, restore, and permanent deletion
• server protection checks for Fail2Ban and cPHulk relevance without requiring elevated server privileges
• uploads PHP execution blocking on supported server environments
• manual guidance when automatic server hardening is not safely supported

This plugin is positioned as an auditing and hardening tool. It helps surface risk and apply selected preventive controls, but it does not promise malware removal, incident response, or complete server protection.

Included checks

The scan currently looks for items such as:

• PHP error display exposure
• WP_DEBUG and debug.log exposure
• default admin administrator username
• open public registration with dangerous default role configuration
• XML-RPC availability
• author and REST user enumeration exposure
• theme/plugin file editor availability
• WordPress generator meta output
• comments enabled by default
• uploads PHP execution hardening status
• public readme and license files in the website root
• root-level sensitive files and archives
• recursive SQL dump and backup archive discovery

Dashboard and Recommended Actions

The Dashboard is meant to answer two questions quickly:

• what is the current scan risk posture?
• what should I deal with next?

It summarizes:

• the most recent scan state, including never-scanned, failed, and stale results
• current scan risk score and grouped finding counts
• current hardening posture and recent hardening activity
• Recommended Actions that point administrators to the most useful next page or task

When no urgent action is needed, Steel Security shows a reassuring empty state instead of leaving the area blank.

Hardening controls

The Hardening page is organized into focused groups:

• Access & Authentication: rename default admin, disable XML-RPC, disable public user registration, hide login error detail, hide the default login URL, advisory FORCE_SSL_ADMIN
• Public Exposure: restrict author enumeration, restrict REST user endpoints, hide WordPress generator output
• Content & Editing: disable theme/plugin file editor, disable comments by default, advisory DISALLOW_FILE_MODS
• Uploads & Execution: block PHP execution in uploads with supported Apache/IIS handling and Nginx manual guidance

Login path hardening

Steel Security can hide the default public WordPress login entry by moving it to a custom path that you choose.

• no default slug is suggested
• the path must be unique and valid for WordPress
• collisions with public content and important internal routes are blocked
• direct wp-login.php access is hidden while signed-in administration continues to work normally
• logout, lost-password, and related login flows continue to use the configured login path
• rollback is available from the Hardening page

Server protection checks

The Server Protection page reports safe, non-privileged environment signals for:

• Fail2Ban
• cPanel / cPHulk

These checks are intended to help administrators understand whether host-level protection appears present, healthy, unavailable, or unsupported. Steel Security does not attempt to manage those systems from inside WordPress.

For Fail2Ban, Steel Security can also validate whether an expected read-only JSON reporter appears current, stale, unreadable, or malformed before treating it as trustworthy visibility.

For cPanel / cPHulk, Steel Security reports conservative visibility states such as detected, possible, not detected, or unable to determine based on safe non-privileged indicators only.

Server-aware behavior

This plugin only auto-applies server config changes where it can do so in a scoped and reversible way.

• Apache and LiteSpeed: uploads PHP blocking is managed through a Steel Security-marked .htaccess block
• IIS: uploads PHP blocking is managed through a Steel Security-marked web.config section
• Nginx and unsupported environments: Steel Security provides manual guidance instead of claiming automatic protection

Pro companion

This plugin can work with a separate Pro companion plugin that adds features such as scheduled scans, scan history, reports, and managed server-level controls such as directory listing protection and baseline security headers. The free plugin remains usable on its own.