Title: Ironfang Security
Author: ironfang
Published: October 28, 2026
Last modified: October 28, 2026
---
Search plugins
# Ironfang Security
By [ironfang](https://profiles.wordpress.org/ironfang/)
[Download](https://downloads.wordpress.org/plugin/ironfang-security.1.1.0.zip)
* [Details](https://wordpress.org/plugins/ironfang-security/#description)
* [Reviews](https://wordpress.org/plugins/ironfang-security/#reviews)
* [Installation](https://wordpress.org/plugins/ironfang-security/#installation)
* [Development](https://wordpress.org/plugins/ironfang-security/#developers)
[Support](https://wordpress.org/support/plugin/ironfang-security/)
## Description
Ironfang Security reviews a WordPress site’s configuration, update information and
privileged accounts for common security risks. It explains each finding, shows the
evidence it observed and suggests a practical next step.
It checks:
* whether WordPress, plugin and theme updates are available, using the update information
WordPress has already stored, and how old that information is;
* whether the server’s PHP version still receives security fixes, and how the site
is set to update;
* whether WordPress is set up for HTTPS;
* whether PHP errors are shown to visitors, and whether a debug log is kept inside
the site’s files;
* whether the dashboard file editors are on, and who on the server can read or
change wp-config.php;
* what public registration grants, and which accounts have administrator-level
access.
It also lists the installed software. An available update is maintenance information;
this plugin does not report known vulnerabilities.
Findings are listed by priority, each with its evidence and practical guidance.
You can recheck a finding after fixing it, or ignore one you have reviewed; an ignored
finding is still reported by its check and is never counted as passed.
You can download a report of the results as readable text or JSON. It leaves out
server paths and account details.
One hardening change is available, and only if you ask for it: turning off the dashboard’s
theme and plugin file editors. It has the same effect as DISALLOW_FILE_EDIT, without
editing wp-config.php. The check confirms the change, you can undo it, and each
change is logged. It works only while the plugin is active.
What the plugin does not do:
* It does not change your site’s settings, unless you turn off the file editors
with it.
* It does not contact Ironfang or any other service.
* It is not a firewall or malware scanner, and it does not block attacks.
* It does not give your site a security score or certify that it is safe.
The plugin supports single-site WordPress installations. It does not load on multisite
networks.
### Privacy
This plugin does not send data to Ironfang or any third party, does not collect
analytics and does not set cookies.
Check results store counts and settings, not account details. The list of administrator
accounts is read when an administrator opens it and is not stored. If you turn the
file editors off or back on with the plugin, it logs when, and the ID of the account
that did it.
Reports are made only when an administrator asks for one and are sent straight to
the browser; no copy is kept on the server. Reports leave out server paths and account
details. The site address is included unless you untick it, and the reasons given
for ignoring findings only if you choose them.
**Ironfang Security › Settings** lists everything the plugin stores.
## Screenshots
[⌊The overview after the checks have run: open findings by severity and the next
actions, most urgent first.⌉⌊The overview after the checks have run: open findings
by severity and the next actions, most urgent first.⌉[
The overview after the checks have run: open findings by severity and the next actions,
most urgent first.
[⌊Every open finding, ranked by severity and confidence.⌉⌊Every open finding, ranked
by severity and confidence.⌉[
Every open finding, ranked by severity and confidence.
[⌊A finding with the evidence the check observed and what to do about it.⌉⌊A finding
with the evidence the check observed and what to do about it.⌉[
A finding with the evidence the check observed and what to do about it.
[⌊Settings: download a report, and see everything the plugin stores and what deleting
it removes.1. The overview after the checks have run: open findings by severity
and the next actions, most urgent first.⌉⌊Settings: download a report, and see everything
the plugin stores and what deleting it removes.1. The overview after the checks
have run: open findings by severity and the next actions, most urgent first.⌉[
Settings: download a report, and see everything the plugin stores and what deleting
it removes.1. The overview after the checks have run: open findings by severity
and the next actions, most urgent first.
## Installation
1. Upload the plugin ZIP from Plugins › Add New Plugin › Upload Plugin, or extract
it into `wp-content/plugins/ironfang-security`.
2. Activate the plugin. Activation does not change any site setting.
3. Open **Ironfang Security** in the admin menu. Only users who can manage site options
can see it.
## FAQ
### Does this plugin protect my site from attacks?
No. It is not a firewall and does not block traffic. It is intended to identify
configuration risks so you can act on them.
### Why do some results say “Could not be determined”?
A check reports that when it cannot observe enough to give an answer: for example
when WordPress has not stored recent update information, or when a scan started
from WP-CLI cannot see the web server’s PHP settings. Such a result is never counted
as passed. Each one explains what is missing and what to do.
### What has it been tested with?
WordPress 6.8, 7.0 and 7.1, with PHP 8.1 to 8.5 (not every combination); Apache
and nginx; a site behind an HTTPS reverse proxy; a site in a subdirectory; read-
only site files; a Redis object cache; and alongside WooCommerce, WP Super Cache
and Wordfence. Other set-ups have not been tested.
### Where can I get help or send feedback?
Email hello@ironfang.com. If a check fails to run, include the reason it shows.
### How do I report a security vulnerability in this plugin?
Email security@ironfang.com, privately, not in the support forum. Include the plugin,
WordPress and PHP versions, steps to reproduce and the access an attacker needs.
We acknowledge reports within 3 business days and give an assessment within 7 days.
We aim to fix critical and high severity issues within 14 days of confirming them,
and others within 90 days. We coordinate disclosure with you, publish an advisory
once the fix is released, and credit you unless you prefer not to be. There is no
paid bug bounty.
### Can it turn off the file editors?
Yes, if you ask it to. On the “Dashboard file editor” check’s page, choose “Turn
off the file editors”. Nobody, administrators included, can then edit theme or plugin
code from the dashboard, as with DISALLOW_FILE_EDIT. Installing and updating plugins
and themes keeps working. The check runs again to confirm it, and you can turn the
editors back on there.
It works only while the plugin is active: deactivating or deleting the plugin turns
the editors back on. For a permanent change, add DISALLOW_FILE_EDIT to wp-config.
php. If something already turns the editors off, the plugin says so and does not
offer the change.
From WP-CLI, run `wp ironfang-security hardening apply file_editor --user=`, or `undo` to turn them back on. `wp ironfang-security hardening list` shows
the current state, and `log` shows who changed it and when.
### What happens when I uninstall it?
Deactivating stops any running scan and keeps the plugin’s stored data. If you turned
the file editors off with the plugin, they turn back on while it is deactivated,
and off again if you reactivate it. Deleting the plugin removes the data it created
and nothing else. To keep the results, download a report from **Ironfang Security›
Settings** before deleting it; a deactivated plugin cannot make a report, so reactivate
it first if needed.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Ironfang Security” is open source software. The following people have contributed
to this plugin.
Contributors
* [ ironfang ](https://profiles.wordpress.org/ironfang/)
[Translate “Ironfang Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/ironfang-security)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/ironfang-security/),
check out the [SVN repository](https://plugins.svn.wordpress.org/ironfang-security/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/ironfang-security/)
by [RSS](https://plugins.trac.wordpress.org/log/ironfang-security/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.1.0
* New: turn off the dashboard’s theme and plugin file editors from the “Dashboard
file editor” check’s page, or with `wp ironfang-security hardening apply file_editor`.
It has the same effect as DISALLOW_FILE_EDIT without editing wp-config.php. The
check confirms it, you can undo it, and each change is logged. It works only
while the plugin is active, and is not offered when something already turns the
editors off.
* Changed: the file editor check reports when Ironfang Security turns the editors
off, and reports a finding if other code turns them back on.
#### 1.0.1
* Fixed: reports called the directory above WordPress the site root. It is now
labelled “[directory above WordPress]”.
#### 1.0.0
* First release: twelve local checks covering updates, PHP support, update policy,
HTTPS, PHP error display, the debug log, the dashboard file editors, wp-config.
php permissions, registration and administrator accounts; a software inventory;
findings with evidence and guidance, recheck and ignore; scan recovery; and a
redacted report download.
## Meta
* Version **1.1.0**
* Last updated **19 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.8 or higher **
* Tested up to **7.1.4**
* PHP version ** 8.1 or higher **
* Tags
* [configuration](https://wordpress.org/plugins/tags/configuration/)[security](https://wordpress.org/plugins/tags/security/)
[updates](https://wordpress.org/plugins/tags/updates/)
* [Advanced View](https://wordpress.org/plugins/ironfang-security/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/ironfang-security/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/ironfang-security/reviews/)
## Contributors
* [ ironfang ](https://profiles.wordpress.org/ironfang/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/ironfang-security/)