Most security plugins switch settings on and assume they work. Tuning4Web – Security Check verifies the result. It requests key URLs of your site the way an anonymous visitor (or an attacker) would, reads your WordPress configuration, and reports what is really exposed, how serious it is, and how to fix it.

It is not a firewall and not a malware scanner, and it works alongside the security plugin you already use. Typical findings it catches that a settings screen cannot show:

A rule that should block a file is not active, because the server, a cache or a CDN ignores it.
PHP code really runs inside the uploads directory. The plugin proves it with a harmless, temporary test file.
Your login names leak through the REST API, ?author=N redirects, oEmbed data or the authors sitemap, even though you disabled one of these.
Security headers are set by a plugin but stripped by page caching.

Results are judged by the content of each response, not only by the status code. A blank wp-config.php page, the empty “Silence is golden” index file and a 405 from xmlrpc.php are not reported as leaks. The plugin also warns when maintenance mode, “soft 404” pages or a firewall blocking its own requests make the answers unreliable.

The checks are requests from your own server to your site, without logging in. A firewall or CDN that treats your server’s IP address differently from visitors can change a result; the plugin warns when it detects this.

Hardening check

Every failed check has a severity (critical, high, medium, low). The check runs step by step with a progress bar, so it works on slow hosting too.

Theme and plugin file editor (DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS)
wp-config.php: blocked by the server, or worse, source code visible
Security keys and salts: missing, default, short or duplicated
Public debug.log
PHP execution in the uploads directory (optional active test; a temporary file is created and deleted right away)
XML-RPC: which methods the endpoint really offers (pingback, multicall, logins)
Username enumeration: REST API users endpoint, ?author=N, oEmbed author data, authors sitemap
Security headers (X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, HSTS) and version disclosure (Server, X-Powered-By, WordPress version in the page)
Directory listing in wp-includes, uploads and plugins
readme.html, license.txt, .htaccess, install.php

For problems that can only be fixed on the server, the plugin shows the exact Apache or Nginx rule to add.

Protections (all off by default)

Simple switches applied through WordPress hooks only. Nothing is written to wp-config.php or .htaccess, so deactivating the plugin turns them all off.

Disable XML-RPC
Block username enumeration (REST users endpoints, ?author=N, oEmbed author, users sitemap)
Disable the theme and plugin file editor
Disable application passwords
Hide version information (generator tag, WordPress version in script and style URLs, X-Powered-By)
Basic security headers (nosniff, SAMEORIGIN, Referrer-Policy)
HSTS (HTTPS sites only; enabled only after a certificate check, and cleared with max-age=0 when turned off)

One-click security key rotation

Writes eight new random keys into wp-config.php and logs everyone out, which is the right move after a suspected break-in. The keys are generated on your server. Only those eight values are replaced, the file is written atomically, and the original is restored if the site stops responding. If the keys are defined in any other way (for example from environment variables), nothing is changed.

External scripts

Lists scripts loaded from other domains on a sample of pages: home page, newest posts and pages, the main category, the newest product, and pages with custom templates. Scripts from domains you have not marked as trusted are highlighted for verification; you keep your own list of trusted domains (empty by default). It also shows whether each script uses Subresource Integrity (SRI). Only the HTML sent by the server is scanned; scripts added later by JavaScript are not visible.

Privacy

The plugin does not contact any external server and does not collect or send any data. All checks are requests from your server to your own site. New security keys are generated locally.