sweetwatermedia

<p>Steel Security & Hardening – Site Audit Tools focuses on practical security hygiene for WordPress administrators.</p>
<p>The free plugin provides:</p>
<ul>
<li>on-demand security scans</li>
<li>risk summaries grouped by severity and category</li>
<li>checks for common WordPress hardening gaps</li>
<li>checks for exposed root-level artifacts such as <code>.env</code>, SQL dumps, <code>phpinfo</code> files, and backup archives</li>
<li>a quarantine vault for operator-reviewed file isolation</li>
<li>uploads PHP execution blocking on supported server environments</li>
<li>manual guidance when automatic server hardening is not safely supported</li>
</ul>
<p>This plugin is positioned as an auditing and hardening tool. It helps surface risk and apply selected preventive controls, but it does not promise malware removal, incident response, or complete server protection.</p>
<h4>Included checks</h4>
<p>The scan currently looks for items such as:</p>
<ul>
<li>PHP error display exposure</li>
<li><code>WP_DEBUG</code> and <code>debug.log</code> exposure</li>
<li>XML-RPC availability</li>
<li>author and REST user enumeration exposure</li>
<li>theme/plugin file editor availability</li>
<li>WordPress generator meta output</li>
<li>comments enabled by default</li>
<li>uploads PHP execution hardening status</li>
<li>root-level sensitive files and archives</li>
</ul>
<h4>Server-aware behavior</h4>
<p>This plugin only auto-applies server config changes where it can do so in a scoped and reversible way.</p>
<ul>
<li>Apache and LiteSpeed: uploads PHP blocking is managed through a Steel Security-marked <code>.htaccess</code> block</li>
<li>IIS: uploads PHP blocking is managed through a Steel Security-marked <code>web.config</code> section</li>
<li>Nginx and unsupported environments: Steel Security provides manual guidance instead of claiming automatic protection</li>
</ul>
<h4>Pro companion</h4>
<p>This plugin can work with a separate Pro companion plugin that adds features such as scheduled scans, scan history, reports, and managed server-level controls such as directory listing protection and baseline security headers. The free plugin remains usable on its own.</p>


Steel Security & Hardening – Site Audit Tools

High-signal WordPress security auditing and hardening with practical site audit tools for administrators.

WebFiable

<p><strong>Improve your site’s security posture and configuration health with monitoring and recommendations.</strong></p>
<p>Webfiable Info is the on-site companion for the Webfiable security service (https://webfiable.com). It securely gathers information about your site’s WordPress version, plugins, themes, and basic site metadata and registers your site with Webfiable so you can receive ongoing reports via email. You stay in control: consent is explicit, and the public endpoint is opt-in and verified on save.</p>
<p>During the white march period, there is no separate signup or billing – the plugin registers your site automatically from the settings screen and you can use the service for free. A subscription may be required in the future; we will notify administrators well in advance.</p>
<h3>Features</h3>
<ul>
<li><strong>One-click registration</strong>: Enter a report recipient email, grant consent, and enable the endpoint; Webfiable Info verifies the endpoint and registers the site automatically.</li>
<li><strong>Opt-in endpoint</strong>: The public <code>/webfiable</code> endpoint is disabled by default and verified when enabled. If verification or registration fails, the plugin safely disables it.</li>
<li><strong>Consent-aware behavior</strong>: Turning off consent simply saves your choice and disables the endpoint; you can re-enable later.</li>
<li><strong>Lightweight by design</strong>: No heavy background jobs; the endpoint serves inventory on demand and runs in milliseconds.</li>
<li><strong>Secure by default</strong>: Uses hybrid encryption (AES-256 + RSA-2048) to transport data.</li>
<li><strong>Part of the Webfiable service</strong>: Currently in white march (early access) and free to use; a subscription may be required in the future. Learn more at https://webfiable.com.</li>
</ul>
<h3>Security Features</h3>
<p>Webfiable Info is built with security at its core, ensuring that your website’s data is protected at every stage:</p>
<ul>
<li><strong>Hybrid Encryption</strong>: Combines AES and RSA. The inventory is encrypted with AES-256-CBC; the AES key is encrypted with RSA-2048.</li>
<li><strong>Fresh IV per response</strong>: Each response uses a new IV so ciphertext is always unique.</li>
<li><strong>Public endpoint, private content</strong>: The <code>/webfiable</code> endpoint can be accessed by anyone, but the payload is encrypted for Webfiable only.</li>
<li><strong>Rate limiting</strong>: Basic per-IP rate limiting reduces abuse.</li>
</ul>
<h3>Why It Is Secure</h3>
<ol>
<li><strong>Strong transport</strong>: AES-256 for data, RSA-2048 for the key – only Webfiable can decrypt.</li>
<li><strong>Unique IVs</strong>: Each response is unique even for identical content.</li>
<li><strong>Minimal inventory</strong>: Only software inventory and basic metadata needed for analysis; no credentials or content are collected.</li>
</ol>
<h3>License</h3>
<p>This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.</p>


Webfiable Info

Connect your site to Webfiable (webfiable.com) to track config health and get security recommendations. Public early access (white march). Free.

Steel Security & Hardening – Site Audit Tools vs Webfiable Info