Tuning4Web – Security Check

Most security plugins switch settings on and assume they work. Tuning4Web – Security Check verifies the result. It requests key URLs of your site the way an anonymous visitor (or an attacker) would, reads your WordPress configuration, and reports what is really exposed, how serious it is, and how to fix it. It is not a firewall and not a malware scanner, and it works alongside the security plugin you already use. Typical findings it catches that a settings screen cannot show:

• A rule that should block a file is not active, because the server, a cache or a CDN ignores it.
• PHP code really runs inside the uploads directory. The plugin proves it with a harmless, temporary test file.
• Your login names leak through the REST API, ?author=N redirects, oEmbed data or the authors sitemap, even though you disabled one of these.
• Security headers are set by a plugin but stripped by page caching.

Results are judged by the content of each response, not only by the status code. A blank wp-config.php page, the empty "Silence is golden" index file and a 405 from xmlrpc.php are not reported as leaks. The plugin also warns when maintenance mode, "soft 404" pages or a firewall blocking its own requests make the answers unreliable. Hardening check Every failed check has a severity (critical, high, medium, low). The check runs step by step with a progress bar, so it works on slow hosting too.

• Theme and plugin file editor (DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS)
• wp-config.php: blocked by the server, or worse, source code visible
• Security keys and salts: missing, default, short or duplicated
• Public debug.log
• PHP execution in the uploads directory (optional active test; a temporary file is created and deleted right away)
• XML-RPC: which methods the endpoint really offers (pingback, multicall, logins)
• Username enumeration: REST API users endpoint, ?author=N, oEmbed author data, authors sitemap
• Security headers (X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, HSTS) and version disclosure (Server, X-Powered-By, WordPress version in the page)
• Directory listing in wp-includes, uploads and plugins
• readme.html, license.txt, .htaccess, install.php

For problems that can only be fixed on the server, the plugin shows the exact Apache or Nginx rule to add. Protections (all off by default) Simple switches applied through WordPress hooks only. Nothing is written to wp-config.php or .htaccess, so deactivating the plugin turns them all off.

• Disable XML-RPC
• Block username enumeration (REST users endpoints, ?author=N, oEmbed author, users sitemap)
• Disable the theme and plugin file editor
• Disable application passwords
• Hide version information (generator tag, WordPress version in script and style URLs, X-Powered-By)
• Basic security headers (nosniff, SAMEORIGIN, Referrer-Policy)
• HSTS (HTTPS sites only; enabled only after a certificate check, and cleared with max-age=0 when turned off)

One-click security key rotation Writes eight new random keys into wp-config.php and logs everyone out, which is the right move after a suspected break-in. The keys are generated on your server. Only those eight values are replaced, the file is written atomically, and the original is restored if the site stops responding. If the keys are defined in any other way (for example from environment variables), nothing is changed. External scripts Lists scripts loaded from other domains on a sample of pages: home page, newest posts and pages, the main category, the newest product, and pages with custom templates. Scripts from domains you have not marked as trusted are highlighted for verification; you keep your own list of trusted domains (empty by default). It also shows whether each script uses Subresource Integrity (SRI). Only the HTML sent by the server is scanned; scripts added later by JavaScript are not visible. Privacy The plugin does not contact any external server and does not collect or send any data. All checks are requests from your server to your own site. New security keys are generated locally.

1.3.7

• Changed: the built-in list of "known CDN" domains was removed. External scripts are compared with your own list of trusted domains (empty by default), editable on the External scripts tab.
• Changed: server rules use the real uploads and content directory paths.

1.3.6

• New: server rules are shown for the detected web server (Apache / LiteSpeed or Nginx); rules for other servers are folded below.
• Changed: the security headers rule contains only the headers that are actually missing; HSTS comes with a warning.
• Changed: a missing HSTS header alone is reported as low severity.

1.3.5

• New: when security headers are missing or X-Powered-By is shown, the check compares the cached home page with a freshly generated one and tells you when only the page cache is the cause.
• New: server rules (Apache, Nginx, PHP settings) for security headers and for hiding X-Powered-By, shown with the results.
• Changed: switch notes explain that pages served by a page cache before plugins load do not get headers from the switches.

1.3.4

• New: warning when the site refuses the plugin's own request for the home page (firewall, password protection), because "blocked" results would then be unreliable.
• Fixed: the "Hide version information" note now explains correctly where X-Powered-By can remain (page cache served before plugins load, PHP scripts outside WordPress) and how to remove it everywhere.

1.3.3

• Changed: HSTS is turned on only after the HTTPS version of the site loads with a valid certificate.
• New: after HSTS is turned off, the plugin sends max-age=0 for a year so that returning visitors' browsers forget it.
• Changed: the HSTS warning is shown in red and explains that it is hard to undo.

1.3.2

• New: check for the WordPress version visible in the home page (generator tag, ?ver= on scripts and styles).
• Changed: "Hide version information" also replaces the WordPress version in script and style URLs with a short hash, so browser caches still refresh after updates.

1.3.1

• Changed: the active PHP-in-uploads test has a checkbox next to the button (on by default, the choice is remembered).
• Changed: translations are loaded by WordPress from translate.wordpress.org.
• Changed: nonce verification moved into each AJAX handler.

1.3.0

• New: the hardening check runs one step at a time with a progress bar, so it no longer risks a timeout on slow hosting.
• New: severity levels (critical, high, medium, low); results are sorted by severity.
• Changed: results are stored as codes and translated when displayed, so they follow the current admin language.
• Changed: assets moved to separate CSS and JavaScript files.

1.2.0

• Renamed from "Check External Scripts" to "Tuning4Web – Security Check".
• New: Protections tab with opt-in, reversible switches.
• New: one-click security key rotation.
• New checks: security keys, XML-RPC methods, oEmbed author, ?author=N based on real responses, sitemaps discovered through robots.txt and WordPress itself, debug.log content, maintenance mode / soft 404 detection.
• Changed: wp-config.php is reported when the server does not block it.
• Changed: external scripts scan is deterministic, treats www and the bare domain as the same site, and reports SRI.
• Fixed: log download was truncated when URLs contained "&".
• Security: all actions go through admin-post.php with capability and nonce checks.

1.1.0

• Added the WordPress hardening check.

1.0.0

• First release as "Check External Scripts".