Secure your WordPress site, without being a developer
Contents
On a WordPress site, the flaw rarely comes from WordPress itself. It comes from an outdated plugin, a setting left open or a forgotten file. Here are the seven points to look at, how to do it yourself, and what Rustine checks for you.
At a glance
| Risk | Where Rustine checks it |
|---|---|
| Outdated plugins and themes | Free scan |
| An outdated WordPress version | Free scan |
| xmlrpc.php open for nothing | Not checked yet |
| Your list of users | Not checked yet |
| Sensitive files online | Free scanFull audit · Solo, Pro |
| A login that's too easy | Full audit · Solo, Pro |
| Your custom theme or plugin | GitHub code · Solo, Pro |
1. Outdated plugins and themes
Flaws are published all the time for plugins and themes, and the Wordfence Intelligence database lists them. An outdated plugin is a flaw everyone knows about, on your site.
Check it yourself
In your dashboard, open Updates and apply them. Delete deactivated plugins: WordPress's hardening guide recommends it.
What Rustine checks
From the free scan, Rustine recognises the plugins and themes your home page loads, estimates their version and compares it with Wordfence's known flaws. A plugin that loads nothing on that page stays invisible to it. With Solo and Pro, an email when a new flaw hits a version you use.
Free scan
2. An outdated WordPress version
WordPress core gets security fixes too. An old version, shown in your page's code, says exactly which flaws to try.
Check it yourself
Dashboard, Updates: WordPress should be on the latest version. Turn on automatic security updates if your host doesn't.
What Rustine checks
From the free scan, Rustine reads the version your site announces and compares it with known flaws.
Free scan
Sources: [2]
3. xmlrpc.php open for nothing
xmlrpc.php serves old apps and some plugins, such as Jetpack. Left open with no use, it accepts several password guesses in a single request, which slips past the login page's protections.
Check it yourself
If you use neither the WordPress mobile app nor Jetpack, ask your host or a security plugin to block xmlrpc.php.
What Rustine checks
Not checked by Rustine yet.
Not checked yet
Sources: [3]
4. Your list of users
WordPress's API and author pages can give away your accounts' login names. With the login name in hand, only the password is left to guess.
Check it yourself
In a private window, open your-site.com/wp-json/wp/v2/users. If you can read your login names there, a security plugin can hide that list. Avoid login names such as admin or webmaster.
What Rustine checks
Not checked by Rustine yet.
Not checked yet
5. Sensitive files online
A wp-config.php.bak copy holds your database password. A listable wp-content folder shows everything you've uploaded.
Check it yourself
Open your-site.com/wp-content/uploads/: you should see a blank page or an error, not a list of files. Delete wp-config.php copies left by an edit.
What Rustine checks
From the free scan, Rustine spots listable folders, wp-content included. After proof, the full audit looks for wp-config.php copies. The debug.log file isn't checked yet.
Free scanFull audit · Solo, Pro
Sources: [2]
6. A login that's too easy
The /wp-admin/ page is the same on every WordPress site. A weak password and no two-factor authentication, and your admin account is within reach.
Check it yourself
A long, unique password for each admin, two-factor authentication through a plugin, and as few admins as possible.
What Rustine checks
After proof, the full audit notes the admin page, without ever trying to sign in.
Full audit · Solo, Pro
Sources: [2]
7. Your custom theme or plugin
Code written for you, or by your agent, gets no security updates. A badly built SQL query or a route with no permission check stays there until someone reads it.
Check it yourself
Have the code reviewed before each release, and keep it on GitHub rather than only on FTP.
What Rustine checks
On GitHub, with Solo and Pro: routes without permission checks, SQL queries without prepare, output without escaping, and dependencies.
GitHub code · Solo, Pro
Scan your site, it's free
Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.
Free toolsSecurity headers test
Questions
Does Rustine replace a security plugin such as Wordfence?
No. A plugin protects your site from the inside. Rustine looks at it from the outside, like a visitor, and tells you what sticks out. The two go well together.
Does Rustine see all my plugins?
It sees those that load a file on your home page, and their version is an estimate. A plugin invisible from the page is still yours to follow in your dashboard.
Sources
- Wordfence, Wordfence Intelligence, vulnerability database, read on 15/10/2026
- WordPress, Hardening WordPress, read on 15/10/2026
- Sucuri, Brute Force Amplification Attacks Against WordPress XMLRPC (2015), read on 15/10/2026
- WordPress, REST API Handbook, Users, read on 15/10/2026
- OWASP, WSTG, Testing for Account Enumeration and Guessable User Account, read on 15/10/2026