Ironfang Security

Ironfang Security reviews a WordPress site’s configuration, update information and privileged accounts for common security risks. It explains each finding, shows the evidence it observed and suggests a practical next step.

It checks:

• whether WordPress, plugin and theme updates are available, using the update information WordPress has already stored, and how old that information is;
• which plugins and themes are installed but not in use, keeping one default theme as WordPress advises;
• whether the server’s PHP version still receives security fixes, and how the site is set to update;
• whether WordPress is set up for HTTPS;
• whether PHP errors are shown to visitors, and whether a debug log is kept inside the site’s files;
• whether the dashboard file editors are on, and who on the server can read or change wp-config.php;
• whether wp-config.php sets its own security keys and salts, or WordPress is using ones stored in the database;
• whether the uploads directory holds files named to run as PHP, which WordPress never puts there (by name only: files are never opened);
• whether copies of wp-config.php, .env files, database dumps, archives or .git folders are in the site’s public directories (by name only: files are never opened or requested);
• what public registration grants, and which accounts have administrator-level access;
• which administrator accounts have application passwords, and which of those passwords are not being used.

It also lists the installed software. An available update is maintenance information; this plugin does not report known vulnerabilities.

The last scan’s results also appear in Tools › Site Health, for administrators: open findings by severity, or a prompt to scan when the last scan is missing, more than a week old or incomplete. Site Health never runs a scan, and never says the site is safe.

Findings are listed by priority, each with its evidence and practical guidance. You can recheck a finding after fixing it, or ignore one you have reviewed; an ignored finding is still reported by its check and is never counted as passed.

You can download a report of the results as readable text or JSON. It leaves out server paths and account details.

One hardening change is available, and only if you ask for it: turning off the dashboard’s theme and plugin file editors. It has the same effect as DISALLOW_FILE_EDIT, without editing wp-config.php. The check confirms the change, you can undo it, and each change is logged. It works only while the plugin is active.

What the plugin does not do:

• It does not change your site’s settings, unless you turn off the file editors with it.
• It does not contact Ironfang or any other service.
• It is not a firewall or malware scanner, and it does not block attacks.
• It does not give your site a security score or certify that it is safe.

The plugin supports single-site WordPress installations. It does not load on multisite networks.

Privacy

This plugin does not send data to Ironfang or any third party, does not collect analytics and does not set cookies.

Check results store counts and settings, not account details. The lists of administrator accounts and their application passwords are read when an administrator opens them and are not stored. The passwords themselves, and the IP addresses WordPress records for them, are never read out. If you turn the file editors off or back on with the plugin, it logs when, and the ID of the account that did it.

Reports are made only when an administrator asks for one and are sent straight to the browser; no copy is kept on the server. Reports leave out server paths and account details. The site address is included unless you untick it, and the reasons given for ignoring findings only if you choose them.

Ironfang Security › Settings lists everything the plugin stores.