Title: Steel Security & Hardening – Site Audit Tools Author: sweetwatermedia Published: Avrigl 28, 2026 Last modified: Avust 9, 2026 --- Search plugins ![](https://ps.w.org/steel-security/assets/banner-772x250.png?rev=3517816) ![](https://ps.w.org/steel-security/assets/icon-256x256.png?rev=3517818) # Steel Security & Hardening – Site Audit Tools By [sweetwatermedia](https://profiles.wordpress.org/sweetwatermedia/) [Telechargiada](https://downloads.wordpress.org/plugin/steel-security.1.1.0.zip) * [Details](https://roh.wordpress.org/plugins/steel-security/#description) * [Reviews](https://roh.wordpress.org/plugins/steel-security/#reviews) * [Installation](https://roh.wordpress.org/plugins/steel-security/#installation) * [Development](https://roh.wordpress.org/plugins/steel-security/#developers) [Support](https://wordpress.org/support/plugin/steel-security/) ## Descripziun Steel Security & Hardening – Site Audit Tools focuses on practical security hygiene for WordPress administrators. The free plugin provides: * on-demand security scans * a clear manual workflow: run a scan, review findings, take action, and run again * risk summaries grouped by severity and category * dashboard summary panels for scan risk, hardening posture, last scan state, and Recommended Actions * dashboard Recommended Actions that point administrators to the highest-value next step * checks for common WordPress hardening gaps * checks for exposed root-level artifacts such as `.env`, SQL dumps, `phpinfo` files, and backup archives * a quarantine vault for operator-reviewed file isolation, restore, and permanent deletion * server protection checks for Fail2Ban and cPHulk relevance without requiring elevated server privileges * uploads PHP execution blocking on supported server environments * manual guidance when automatic server hardening is not safely supported This plugin is positioned as an auditing and hardening tool. It helps surface risk and apply selected preventive controls, but it does not promise malware removal, incident response, or complete server protection. #### Included checks The scan currently looks for items such as: * PHP error display exposure * `WP_DEBUG` and `debug.log` exposure * default `admin` administrator username * open public registration with dangerous default role configuration * XML-RPC availability * author and REST user enumeration exposure * theme/plugin file editor availability * WordPress generator meta output * comments enabled by default * uploads PHP execution hardening status * public readme and license files in the website root * root-level sensitive files and archives * recursive SQL dump and backup archive discovery #### Dashboard and Recommended Actions The Dashboard is meant to answer two questions quickly: * what is the current scan risk posture? * what should I deal with next? It summarizes: * the most recent scan state, including never-scanned, failed, and stale results * current scan risk score and grouped finding counts * current hardening posture and recent hardening activity * Recommended Actions that point administrators to the most useful next page or task When no urgent action is needed, Steel Security shows a reassuring empty state instead of leaving the area blank. #### Hardening controls The Hardening page is organized into focused groups: * Access & Authentication: rename default `admin`, disable XML-RPC, disable public user registration, hide login error detail, hide the default login URL, advisory` FORCE_SSL_ADMIN` * Public Exposure: restrict author enumeration, restrict REST user endpoints, hide WordPress generator output * Content & Editing: disable theme/plugin file editor, disable comments by default, advisory `DISALLOW_FILE_MODS` * Uploads & Execution: block PHP execution in uploads with supported Apache/IIS handling and Nginx manual guidance #### Login path hardening Steel Security can hide the default public WordPress login entry by moving it to a custom path that you choose. * no default slug is suggested * the path must be unique and valid for WordPress * collisions with public content and important internal routes are blocked * direct `wp-login.php` access is hidden while signed-in administration continues to work normally * logout, lost-password, and related login flows continue to use the configured login path * rollback is available from the Hardening page #### Server protection checks The Server Protection page reports safe, non-privileged environment signals for: * Fail2Ban * cPanel / cPHulk These checks are intended to help administrators understand whether host-level protection appears present, healthy, unavailable, or unsupported. Steel Security does not attempt to manage those systems from inside WordPress. For Fail2Ban, Steel Security can also validate whether an expected read-only JSON reporter appears current, stale, unreadable, or malformed before treating it as trustworthy visibility. For cPanel / cPHulk, Steel Security reports conservative visibility states such as detected, possible, not detected, or unable to determine based on safe non-privileged indicators only. #### Server-aware behavior This plugin only auto-applies server config changes where it can do so in a scoped and reversible way. * Apache and LiteSpeed: uploads PHP blocking is managed through a Steel Security- marked `.htaccess` block * IIS: uploads PHP blocking is managed through a Steel Security-marked `web.config` section * Nginx and unsupported environments: Steel Security provides manual guidance instead of claiming automatic protection #### Pro companion This plugin can work with a separate Pro companion plugin that adds features such as scheduled scans, scan history, reports, and managed server-level controls such as directory listing protection and baseline security headers. The free plugin remains usable on its own. ## Installaziun 1. Upload the plugin files to the `/wp-content/plugins/steel-security` directory, or install the plugin through the WordPress plugins screen. 2. Activate the plugin through the ‚Plugins‘ screen in WordPress. 3. Open `Steel Security` in wp-admin to review the dashboard, run a scan, and configure hardening controls. ## FAQ ### Does this plugin make remote calls? The free plugin does not rely on a third-party service for core scanning or hardening, and it does not require remote API calls for its free feature set. ### Does this plugin remove malware automatically? No. This plugin is designed to audit, surface risk, and help with selective hardening and operator-reviewed quarantine workflows. It should not be described as an automatic malware removal tool. ### Does Steel Security rename the `wp-admin` directory? No. Steel Security uses a safer custom login-path approach. It hides the default public login entry by moving it to a unique path that you configure, rather than renaming WordPress core directories. ### Can Steel Security rename the default `admin` username? Yes. If an administrator account is still using the default `admin` login, Steel Security can offer an in-plugin rename workflow with validation and collision checks. ### Will this plugin edit my server configuration? Only for specific controls where the plugin can write a clearly delimited, reversible block on supported servers. Unsupported environments receive manual guidance instead. ### What happens on uninstall? The plugin removes its stored scan data, settings, and hardening rollback metadata. Quarantine payloads are intentionally preserved so operators can review and handle them manually. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Steel Security & Hardening – Site Audit Tools” is open source software. The following people have contributed to this plugin. Contributors * [ sweetwatermedia ](https://profiles.wordpress.org/sweetwatermedia/) [Translate “Steel Security & Hardening – Site Audit Tools” into your language.](https://translate.wordpress.org/projects/wp-plugins/steel-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/steel-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/steel-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/steel-security/) by [RSS](https://plugins.trac.wordpress.org/log/steel-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 * added Server Protection Checks with safe, non-privileged environment indicators for Fail2Ban and cPHulk relevance * added educational guidance for host/admin follow-up without privileged control from inside WordPress * completed the manual scan workflow with explicit Run Scan actions and clearer scan state messaging * added Dashboard Recommended Actions and improved dashboard triage flow * reorganized the Hardening page into grouped control sections * added default `admin` username rename hardening * added hidden login URL hardening with validation and rollback * expanded the vault workflow to support restore and permanent deletion #### 1.0.4 * refreshed the free plugin release package for the latest WordPress.org submission #### 1.0.3 * finalized the WordPress.org review follow-up fixes, removed dormant Pro-only local hardening code from Free, moved rollback metadata out of uploads, and refreshed the release package #### 1.0.2 * rebuilt the free plugin package after final WordPress.org review fixes and packaging updates #### 1.0.1 * clarified advisory-only handling for `DISALLOW_FILE_MODS` and excluded it from hardening posture scoring * moved managed directory listing and baseline security headers fully into the Pro companion plugin * replaced hardening-page Pro placeholders with a contextual upgrade section * moved admin-page JavaScript to enqueued assets and tightened WordPress.org review compliance #### 1.0.0 * finalized WordPress.org-compliant free plugin naming and packaging * aligned Pro package naming to Steel Security Pro for clearer installs * refreshed the Steel Security logo asset in the admin header #### 0.1.2 * narrowed backup archive detection to avoid false positives from plugin files in backup-related paths * improved first-scan dashboard messaging so new installs prompt for a scan instead of showing a misleading high-risk empty state * improved action button labels and tooltips for quarantine workflows * tightened uninstall cleanup for Free and Pro-owned data and rollback metadata #### 0.1.1 * refreshed release packaging * improved dashboard and scan presentation ## Meta * Version **1.1.0** * Last updated **avant 2 dis** * Active installations **20+** * WordPress version ** 6.4 or higher ** * Tested up to **7.0.3** * PHP version ** 8.0 or higher ** * Language * [English (US)](https://wordpress.org/plugins/steel-security/) * Tags * [audit](https://roh.wordpress.org/plugins/tags/audit/)[hardening](https://roh.wordpress.org/plugins/tags/hardening/) [scanner](https://roh.wordpress.org/plugins/tags/scanner/)[security](https://roh.wordpress.org/plugins/tags/security/) * [Advanced View](https://roh.wordpress.org/plugins/steel-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/steel-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/steel-security/reviews/) ## Contributors * [ sweetwatermedia ](https://profiles.wordpress.org/sweetwatermedia/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/steel-security/)