Free WordPress Security Audit — Claude AI Skill

Why a security plugin can't certify its own environment

Most WordPress security tooling runs as a plugin. Think about what that means: the scanner executes inside the same PHP runtime the malware controls. A compromised site can feed the plugin clean results, hide files from PHP-level scans, or quietly modify the scanner itself. You cannot certify an environment from inside it. This is the same reason forensics teams pull the disk instead of running antivirus on a machine they suspect is infected.

This skill takes the opposite approach. It inspects your site from the outside: over SSH at the shell level, where WordPress-level malware can't intercept the checks, and over plain HTTP for the externally visible surface. Core files get verified against wordpress.org's official checksums, not against what your dashboard claims. That distinction matters more than any feature list.

What it actually checks

The audit focuses effort where WordPress breaches happen. Core itself is rarely the problem; plugins, themes, configuration, and already-present compromises are.

• Every plugin and theme version cross-checked against the WPScan and Patchstack vulnerability databases
• Abandoned plugins (no update in 2+ years) and premium plugins bundled inside themes, which chronically lag behind patched versions
• Core file integrity via wordpress.org checksums, catching injected or modified files
• wp-config.php hardening: debug flags, salts, file-edit lockdown, exposed backup copies
• Malware signatures: PHP files in uploads, obfuscated code, rogue admin accounts, injected .htaccess redirects, known backdoor families like wp-vcd
• File permissions, exposed database dumps, leaked .env and .git directories
• External surface: user enumeration, directory listing, security headers, and xmlrpc.php — separating harmless method disclosure from the pingback and multicall methods that actually carry amplification risk
• Targeted code review of your highest-risk plugins: anything handling uploads, forms, AJAX, or payments

Everything is read-only. No exploit attempts, no brute forcing, no payloads. You can run it against a production site without risk.

An audit, not a code review

Most AI-assisted WordPress security tooling reviews code you're writing: it reads a repository and flags bad patterns before you ship. Useful, but that's not where sites get hacked. Sites get hacked in production, through plugins someone installed three years ago and a configuration nobody has looked at since launch.

This skill audits the site you're running right now. Four things follow from that, and each is rare in this space:

• It works against the live server. Real installed versions, real file permissions, real exposed files, checked over SSH, not what a repository or a dashboard claims.
• It checks whether you're already compromised. Code review assumes a clean starting state. This skill doesn't: it hunts for rogue admin accounts, PHP planted in your uploads folder, poisoned .htaccess redirects, and known backdoor families before judging anything else.
• The report is written for two readers at once. Plain-language risk descriptions a business owner can act on, with the technical detail underneath for whoever does the fixing. Agencies can put their own name on it as preparer.
• It states its own limits. The report says which mode ran, what was verified, and what wasn't. An audit that overstates its coverage is a liability, not a deliverable.

Two modes, depending on what access you have

Full mode is where the real value is. If your host gives you SSH, use it. The skill will tell you plainly which mode it ran in and what the other mode would have added, because a partial audit presented as a complete one is worse than no audit.

What to ask, and what comes back

You don't need special syntax or a command to memorize. Ask in plain English. These are real starting points — and more importantly, what a useful answer looks like, so you know whether you're getting one.

Starting cold: "Is my site safe?"

"Can you check example.com for WordPress security problems?"

Expect something like: WordPress 6.4.2, three versions behind. Eleven plugins detected from page source. Slider Revolution appears to be 6.5.x, which has a published vulnerability — but the version is inferred from asset URLs, so treat it as unconfirmed. Author archives are leaking usernames. And then the honest part: I can't see your files or database from out here. If you have SSH access, I can check the things that actually get sites hacked.

Notice what that answer does — it separates what it knows from what it's guessing, and names what it couldn't see. If a security tool ever sounds more certain than that, be suspicious of it.

Going deeper: "Here's my server"

"I do have SSH. Here are my details."

Now it reads your actual files: every plugin's true version, whether core files have been tampered with, wp-config settings, file permissions, admin accounts, and whether malware is already sitting in your uploads folder. Fifteen minutes to an hour, ending in the full tiered report.

Something feels wrong: the compromise check

"My site redirects to a spam page, but only sometimes, and only for visitors coming from Google. Can you look?"

That specific symptom is a known malware pattern — conditional redirects are why site owners never see the problem themselves. The skill goes hunting: injected .htaccess rules, PHP hidden in uploads, modified theme files, admin accounts you didn't create. It will also tell you when the damage is bad enough that you should stop and call someone rather than cleaning it yourself.

Just the important bit: "Check my plugins"

"I don't need a full audit. Which of my plugins have known vulnerabilities?" — then paste the plugin list from your dashboard.

Skips everything else and runs the CVE cross-check. No server access needed, and it's the single highest-value check, because outdated plugins are how most WordPress sites get compromised.

For agencies: "Write it up for my client"

"Run a full audit on clientsite.com, then write it as a report I can send to a non-technical client. My agency is [name]."

Same findings, plain language, your agency named as preparer. Useful for justifying a maintenance retainer or showing a prospect what they've been ignoring.

After the report: "What do I fix first?"

"I can't do all of this. If I only have two hours this weekend, what matters most?"

It ranks by real risk reduction per hour of effort rather than by tier label. Sometimes the fastest meaningful win is deleting three plugins nobody uses.

The report: three tiers, exact fixes

Every finding lands in one of three tiers:

Critical — actively exploitable or evidence of existing compromise. Fix within 24–48 hours.
Important — meaningful risk reduction. Fix within two weeks.
Polish — hardening and hygiene, when convenient.

Every finding comes with the exact fix, the command, config line, or plugin action, because "consider improving your security posture" is not advice anyone can act on. The report also lists what passed: an audit that's all failures reads as fear-selling, and we don't do that.

We've maintained WordPress sites for clients since 2002, and the pattern never changes: sites that look fine in the dashboard carry abandoned plugins with public CVEs, bundled slider plugins three versions behind their patches, and occasionally something already living in the uploads folder. The checklist in this skill is the one we run internally, the same discipline behind our writing on hidden technical debt in WordPress and keeping AI coding under control.

Giving it away costs us nothing and might save your site. If you're an agency, run it for your own clients: put your name as the preparer on the report, the tool credit stays in the footer, everyone wins. And while you're here, our other free tool checks the opposite side of site health: the AEO Readiness Checker tests whether AI search engines can read and cite your site.

Frequently asked questions