PROTECT

WordPress hardening

Hardening is a separate job from malware removal. It audits and, with Apply, locks down uploads, reviews wp-config, and tightens permissions. It does not uninstall plugins, themes, or xmlrpc.php.

PROTECT plan Engine constraints

What hardening will not do

It will not overwrite a hostile .htaccess that it cannot safely replace.
Rotating salts is off unless explicitly enabled; salt values are never logged.
It will not run through the Connector plugin. Clean and harden need SSH.

PROTECT also adds a baseline (inventory snapshot) and monitor (added/modified/deleted vs that snapshot). Unexpected changes are a verdict, not an automatic rollback.

Use hardening after cleanup, or on a clean site you want to keep that way. See FAQ.

Lock the site after you clean it

Start with a FREE HTTP scan, then move to CLEAN / PROTECT.

Run a FREE HTTP scan

Ready to scan

Scan a public WordPress site in seconds

No account. No passwords. HTTP surface only. The engine never executes site PHP.

FREE HTTP scan Create account