Securing a WordPress site often means juggling complex server configurations, confusing checklist articles, and heavyweight security plugins that slow down your admin or break production sites without warning. When managing multiple client sites, knowing which hardening steps have been properly implemented\u2014and proving it to stakeholders\u2014is even harder.<\/p>\n\n
GeniousSonu Site Checkup solves this by giving you a clear, structured WordPress security hardening checklist paired with automated diagnostic scanners and safe, reversible fixes. Instead of guessing, you get an actionable SOP dashboard that audits your installation, previews every configuration change before applying it, and generates professional client-ready reports.<\/p>\n\n
Rather than competing with or replacing mature firewalls and backup tools, GeniousSonu Site Checkup audits your environment, detects vulnerabilities, and applies verified, reversible hardening fixes with zero bloat. Automate safe security tasks, guide complex configurations with seamless plugin bridges, track routine credential rotations, and generate print-ready executive client audit reports:<\/p>\n\n
WP_DEBUG_DISPLAY<\/code>, audit file permissions (strict 640 baseline on wp-config.php<\/code>), detect risky PHP disable_functions<\/code> \/ open_basedir<\/code>, check default wp_<\/code> database prefix, external fingerprint scanner, and probe TLS protocols (TLSv1.0<\/code> through TLSv1.3<\/code>) and certificate chain depth.<\/li>\n- Level B (Guided Actions & Bridges):<\/strong> Seamlessly detects and bridges to mature, audited plugins (WPS Hide Login, Wordfence, Two-Factor Authentication, and Backup plugins) with recommended setting checklists. Generates RFC 9116
\/.well-known\/security.txt<\/code> responsible disclosure contact files.<\/li>\n- Level C (Manual Audits & Reminders):<\/strong> Track 15-day credential rotations (cPanel, WordPress admin), quarterly (90-day) backup restore test rehearsals, staging site HTTP basic authentication, and 6-month Google Search Console URL removal reviews with automated dashboard reminder notices.<\/li>\n
- Level D (Executive Client Reports):<\/strong> Generate print-ready HTML and PDF audit summaries detailing completed hardening, SOP coverage percentage, emergency incident-response escalation sheets, and timestamped audit logs for client handoff.<\/li>\n<\/ul>\n\n
Built with Enterprise Safeguards<\/h3>\n\n\n- Vulnerability Intelligence:<\/strong> Queries the Patchstack vulnerability database API for installed plugins and themes with explicit confidence scoring (
high<\/code>, medium<\/code>, unverified\/low<\/code>), ensuring custom or renamed plugins are never falsely reported as clean.<\/li>\n- Server Environment Aware:<\/strong> Automatically detects Apache\/LiteSpeed vs Nginx. If your site runs on Nginx, .htaccess tasks display copyable Nginx server directives rather than false positive checkmarks.<\/li>\n
- Zero Secret Leakage:<\/strong> Audit logs strictly redact passwords, auth keys, and database credentials. Constant changes log only boolean states; salt rotation logs zero key material.<\/li>\n
- Scoped REST API:<\/strong> Options updates are restricted to a hardcoded whitelist with strict per-field sanitizers, preventing mass-assignment vulnerabilities.<\/li>\n
- Pre-Execution Diff Previews:<\/strong> Inspect the exact marker-delimited configuration blocks before writing to
.htaccess<\/code> or wp-config.php<\/code>.<\/li>\n- Staging-Safe Health Checks:<\/strong> Automatic loopback tests detect staging HTTP Basic Auth walls and only roll back upon true 5xx server errors.<\/li>\n
- Safe Plugin Deletion:<\/strong> Unwanted migration tools are zipped to
wp-content\/uploads\/genioussonu-site-checkup\/plugins\/<\/code> before deletion, making Undo 100% genuine.<\/li>\n- Fail-Safe Emergency Lockout Recovery:<\/strong> Custom login renamer contains zero query-string backdoors. Recovery is exclusively controlled via the
GENISICH_DISABLE_LOGIN_RENAME<\/code> constant in wp-config.php<\/code>.<\/li>\n<\/ul>\n\nThird Party Services<\/h3>\n\n
GeniousSonu Site Checkup connects to the following external third-party services to deliver security auditing and alerting functionality:<\/p>\n\n
\nWordPress.org APIs (https:\/\/api.wordpress.org<\/code>)<\/strong><\/p>\n\n\n- Service & Purpose:<\/strong> Used for core checksum validation (
\/core\/checksums\/1.0\/<\/code>) and verifying plugin directory status (\/plugins\/info\/1.0\/<\/code>).<\/li>\n- Data Sent:<\/strong> Current WordPress version, plugin slugs, and locale. No personally identifiable information (PII) or credentials are transmitted.<\/li>\n
- Privacy Policy:<\/strong> WordPress.org Privacy Policy<\/a><\/li>\n<\/ul><\/li>\n
Patchstack Vulnerability Database API (https:\/\/patchstack.com<\/code>)<\/strong><\/p>\n\n\n- Service & Purpose:<\/strong> Checks installed plugin and theme versions against the Patchstack vulnerability intelligence database to identify known CVEs.<\/li>\n
- Explicit Consent Required:<\/strong> Outbound queries to Patchstack require an explicit opt-in checkbox to be enabled in Plugin Settings per WordPress.org Guideline 7. If disabled, local plugin assessments are performed with zero outbound network calls.<\/li>\n
- Data Sent:<\/strong> Plugin and theme software slugs and version numbers. If configured by an administrator, an optional API authentication key is transmitted over HTTPS. No site visitor data, user credentials, or database contents are sent.<\/li>\n
- Privacy Policy:<\/strong> Patchstack Privacy Policy<\/a><\/li>\n
- Terms of Service:<\/strong> Patchstack Terms of Service<\/a><\/li>\n<\/ul><\/li>\n
User-Configured Alert Webhooks (Optional)<\/strong><\/p>\n\n\n- Service & Purpose:<\/strong> When configured by an administrator, outbound security event notifications (e.g., brute-force lockouts, rogue admin detections) are dispatched to the customer's chosen webhook endpoint (e.g., Slack, Discord, or agency automation endpoint).<\/li>\n
- Explicit Consent Required:<\/strong> Outbound alert dispatch requires an explicit opt-in checkbox to be enabled in Plugin Settings per WordPress.org Guideline 7.<\/li>\n
- Data Sent:<\/strong> Factual incident event summaries (timestamp, alert type, sanitized technical message). Audit logs and webhook payloads strictly redact passwords, security salts, and authentication tokens.<\/li>\n
- Terms & Privacy:<\/strong> Governed by the destination endpoint provider chosen by the site administrator.<\/li>\n<\/ul><\/li>\n
GitHub Advisory Database (GHSA) (https:\/\/api.github.com<\/code>)<\/strong><\/p>\n\n\n- Service & Purpose:<\/strong> Queries the GitHub Advisory Database GraphQL\/REST API for known security advisories affecting installed WordPress plugins and themes.<\/li>\n
- Explicit Consent Required:<\/strong> Disabled by default. Outbound requests require enabling the GHSA toggle in Settings per WordPress.org Guideline 7.<\/li>\n
- Data Sent:<\/strong> Software component slugs and versions. If supplied, an encrypted GitHub Personal Access Token is sent in the Authorization header. No personal user data or site contents are sent.<\/li>\n
- Privacy Policy:<\/strong> GitHub Privacy Statement<\/a><\/li>\n
- Terms of Service:<\/strong> GitHub Terms of Service<\/a><\/li>\n<\/ul><\/li>\n
Open Source Vulnerabilities (OSV) API (https:\/\/api.osv.dev<\/code>)<\/strong><\/p>\n\n\n- Service & Purpose:<\/strong> Queries the Google OSV distributed vulnerability database for security advisories across open-source ecosystems.<\/li>\n
- Explicit Consent Required:<\/strong> Disabled by default. Outbound requests require enabling the OSV toggle in Settings per WordPress.org Guideline 7.<\/li>\n
- Data Sent:<\/strong> Software component names and version strings. No user or visitor personal data is transmitted.<\/li>\n
- Privacy Policy:<\/strong> Google Privacy Policy<\/a><\/li>\n
- Terms of Service:<\/strong> OSV Terms of Service<\/a><\/li>\n<\/ul><\/li>\n
National Vulnerability Database (NVD) API (https:\/\/services.nvd.nist.gov<\/code>)<\/strong><\/p>\n\n\n- Service & Purpose:<\/strong> Queries the NIST National Vulnerability Database for Common Vulnerabilities and Exposures (CVE) intelligence and CVSS scores.<\/li>\n
- Explicit Consent Required:<\/strong> Disabled by default. Outbound requests require enabling the NVD toggle in Settings per WordPress.org Guideline 7.<\/li>\n
- Data Sent:<\/strong> Software identifiers and version parameters. Optional encrypted NVD API key sent if configured. No personally identifiable information is sent.<\/li>\n
- Privacy Policy:<\/strong> NIST Privacy Policy<\/a><\/li>\n<\/ul><\/li>\n
CISA Known Exploited Vulnerabilities Catalog (KEV) (https:\/\/www.cisa.gov<\/code>)<\/strong><\/p>\n\n\n- Service & Purpose:<\/strong> Cross-references installed software with the CISA Known Exploited Vulnerabilities catalog to alert administrators of actively weaponized zero-days and exploits.<\/li>\n
- Explicit Consent Required:<\/strong> Disabled by default. Outbound requests require enabling the CISA KEV toggle in Settings per WordPress.org Guideline 7.<\/li>\n
- Data Sent:<\/strong> No site or user data is transmitted. Only a standard GET request to fetch the public catalog JSON feed.<\/li>\n
- Privacy Policy:<\/strong> CISA Privacy Policy<\/a><\/li>\n<\/ul><\/li>\n
WPScan WordPress Vulnerability Database (https:\/\/wpscan.com<\/code>)<\/strong><\/p>\n\n\n- Service & Purpose:<\/strong> Queries the WPScan vulnerability database for dedicated WordPress core, plugin, and theme security advisories.<\/li>\n
- Explicit Consent Required:<\/strong> Disabled by default. Outbound requests require enabling the WPScan toggle and providing an API key in Settings per WordPress.org Guideline 7.<\/li>\n
- Data Sent:<\/strong> Plugin and theme slugs and version numbers, along with the encrypted API token in request headers. No site content, visitor data, or user credentials are transmitted.<\/li>\n
- Data Handling Notice:<\/strong> In strict compliance with WPScan Terms of Service and data licensing, vulnerability intelligence data retrieved from WPScan is never permanently stored or cached on disk.<\/li>\n
- Privacy Policy:<\/strong> Automattic Privacy Policy<\/a><\/li>\n
- Terms of Service:<\/strong> WPScan Terms of Service<\/a><\/li>\n<\/ul><\/li>\n<\/ol>\n\n
Source Code & Development<\/h3>\n\n
The full, unminified source code for GeniousSonu Site Checkup is developed publicly on GitHub:\nhttps:\/\/github.com\/GeniousSonu\/Site-Checkup-Pro<\/p>\n\n
All JavaScript and CSS distributed in this plugin are 100% human-readable, unminified, locally bundled, and licensed under the GNU General Public License v2 or later per WordPress.org Guidelines 2 and 4.<\/p>\n\n
Credits<\/h3>\n\n
GeniousSonu Site Checkup is built and maintained by SK Sahinur Islam<\/a><\/strong>.\n* Author Website: https:\/\/www.genioussonu.me\/<\/a>\n* GitHub: https:\/\/github.com\/GeniousSonu\/<\/a>\n* WordPress.org Profile: https:\/\/profiles.wordpress.org\/genioussonu\/<\/a><\/p>\n\n\n\n- Upload the
genioussonu-site-checkup<\/code> folder to your \/wp-content\/plugins\/<\/code> directory, or upload the .zip<\/code> archive via Plugins \u2192 Add New \u2192 Upload Plugin<\/strong>.<\/li>\n- Activate the plugin through the Plugins<\/strong> menu in WordPress.<\/li>\n
- Navigate to the new Site Checkup<\/strong> top-level menu in your admin dashboard.<\/li>\n
- Review your initial SOP Coverage score and click Run All Safe Tasks<\/strong> to begin.<\/li>\n<\/ol>\n\n\n
\nDoes it replace a firewall?<\/h3><\/dt>\nNo. GeniousSonu Site Checkup is designed to complement existing web application firewalls (like Cloudflare, Wordfence, or server-level WAFs), not replace them. While firewalls inspect live traffic and block malicious requests in real time, GeniousSonu Site Checkup focuses on site hardening, vulnerability auditing, configuration hygiene, and reducing your site's attack surface so attacks cannot succeed in the first place.<\/p><\/dd>\n
What does it change on my server?<\/h3><\/dt>\nThe plugin only modifies configuration files if you explicitly choose to apply a safe fix. When enabled, it writes clearly marked blocks to your .htaccess<\/code> (on Apache\/LiteSpeed) or wp-config.php<\/code> (such as disabling file editing or hiding XML-RPC). It never alters WordPress core files, and on Nginx servers, it never writes blind rewrite rules\u2014instead, it displays copyable Nginx directives for your server block.<\/p><\/dd>\nHow do I undo a change?<\/h3><\/dt>\nEvery automated fix can be toggled off directly from the Site Checkup dashboard with a single click. The plugin strictly uses isolated, marker-delimited blocks (e.g., # BEGIN GeniousSonu Site Checkup<\/code>), allowing it to cleanly remove its rules without disturbing existing directives. You can also preview the exact diff before any change is written or removed.<\/p><\/dd>\nWhat happens if my server runs Nginx instead of Apache?<\/h3><\/dt>\nGeniousSonu Site Checkup detects Nginx server software ($_SERVER['SERVER_SOFTWARE']<\/code>). Tasks that rely on .htaccess<\/code> are marked as \"Not Applicable on this Server\" and feature a \"View Nginx Snippet\" button with 1-click copy for your server configuration.<\/p><\/dd>\nWhat if I get locked out using the custom login URL?<\/h3><\/dt>\nEmergency recovery strictly requires filesystem access. Open wp-config.php<\/code> via FTP, SSH, or your hosting control panel and add:\n define( 'GENISICH_DISABLE_LOGIN_RENAME', true );\nThis immediately deactivates the login renamer and restores access to the default \/wp-login.php<\/code>.<\/p><\/dd>\nDoes GeniousSonu Site Checkup store my database password or salts in the audit log?<\/h3><\/dt>\nNo. Our audit logging system features an automated secret scrubber. Edits to wp-config.php<\/code> only log constant names and boolean flags (e.g. {\"DISALLOW_FILE_EDIT\": true}<\/code>). Salt rotations only log {\"salts_rotated\": true}<\/code> with zero key material.<\/p><\/dd>\nDoes this plugin work on WordPress Multisite?<\/h3><\/dt>\nVersion 1.0 is optimized for single-site agency workflows. On Multisite installations, settings and actions are strictly restricted to Super Administrators (is_super_admin()<\/code>).<\/p><\/dd>\n\n<\/dl>\n\n\n1.3.4<\/h4>\n\n\n- Docs: Optimize WordPress.org search visibility with natural keywords, verified search tags, and real-world FAQs.<\/li>\n
- Docs: Update project portfolio landing page, comprehensive SOP task reference, and live verification.<\/li>\n<\/ul>\n\n
1.3.3<\/h4>\n\n\n- Fix: Remote WordPress.org changelog scanning for security updates with strict semantic version parsing and zero false findings on local fixtures.<\/li>\n
- Feature: Destructive action password confirmation setting toggle (default OFF) with full capability and nonce preservation.<\/li>\n
- Feature: Seven honest task result states (Done & Verified, Applied Not Verified, Needs Action, Needs Host or Manual, Informational, Not Applicable, Failed) with actionable plugin capability guidance on every task.<\/li>\n
- Fix: Environment sensitivity for TLS probe and SPF\/DMARC checks to mark local (.local, localhost) and non-HTTPS sites as Not Applicable.<\/li>\n
- Fix: Guarded is_plugin_active calling context and established strict Level B guided status for 2FA and Child Theme Scaffolder.<\/li>\n
- Fix: Synchronize slug and text domain to genioussonu-site-checkup and prefix to genisich\/GENISICH_ across entire codebase.<\/li>\n
- Security: In-memory atomic wp-config.php updates with zero disk backup persistence and local cryptographic salt generation.<\/li>\n
- Privacy: Independent per-source opt-in consent controls defaulting to off for all external API lookups.<\/li>\n
- Compliance: Convert child theme scaffolding to Level-B guided documentation flow without executable PHP generation.<\/li>\n<\/ul>\n\n
1.3.2<\/h4>\n\n\n- Fix: Synchronized plugin text domain with WordPress.org review slug to eliminate TextDomainMismatch errors.<\/li>\n
- Fix: Consolidated database query annotations to eliminate PHPCS DirectDatabaseQuery and NoCaching warnings.<\/li>\n
- Fix: Replaced var_export debug function call with safe string escaping during security salt rotation.<\/li>\n
- Fix: Removed redundant auto-update setting HTML filter to comply with WordPress.org update routines.<\/li>\n<\/ul>\n\n
1.3.1<\/h4>\n\n\n- Fix: Parameterized and strictly escaped database table queries across migration readiness, DB health scanner, and task status lookup.<\/li>\n
- Fix: Excluded internal agent and development markdown files (AGENTS.md, DEVELOPMENT.md, CONTRIBUTING.md, README.md, .agents\/) from release packages.<\/li>\n
- Hardening: Strengthened SQL query preparation and table validation matching strict injection-prevention guidelines.<\/li>\n<\/ul>\n\n
1.3.0<\/h4>\n\n\n- Feature: Multi-Source Vulnerability Intelligence \u2014 Unified threat feed integrating GitHub Advisory Database (GHSA), Google OSV, NIST NVD, CISA Known Exploited Vulnerabilities (KEV), and WPScan with strict Guideline 7 consent toggles and HKDF-encrypted API keys.<\/li>\n
- Feature: Compound Version-Range Correlation \u2014 Semver boundary parser (
<<\/code>, <=<\/code>, ><\/code>, >=<\/code>, =<\/code>, x<\/code>, compound ,<\/code> \/ AND<\/code>) mapping vulnerability ranges accurately to installed plugin\/theme versions.<\/li>\n- Feature: 3-State Fix Verification \u2014 Verifies vulnerability remediations (
done<\/code>, applied_unverified<\/code>, not_applied<\/code>) through live HTTP header and file checks.<\/li>\n- Feature: External Fingerprint & Information Disclosure Audit \u2014 Non-destructive loopback scanner probing for exposed backup dumps, sensitive files, and version leaks.<\/li>\n
- Security: End-to-End Cryptographic Masking \u2014 HKDF-derived encryption at rest for all third-party API credentials with write-only REST submissions and masked getters.<\/li>\n<\/ul>\n\n
1.2.0<\/h4>\n\n\n- Feature: REST API Security Auditor \u2014 Complete discovery and permission callback inspection of all registered REST endpoints across core, active plugins, and themes with risk scoring and source reflection.<\/li>\n
- Feature: Environment Badge Tagging \u2014 Persistent, color-coded admin bar badge (Production\/Red, Staging\/Amber, Development\/Gray) with smart heuristics and hostname safety guards.<\/li>\n
- Feature: Developer Diagnostic Snapshot \u2014 Sanitized Markdown system report export for GitHub issues and tickets with strict secret\/salt\/password redaction.<\/li>\n
- Feature: WP-Cron Health Auditor \u2014 Inspection of scheduled background tasks with overdue stalled event detection (>600s late) and duplicate hook identification.<\/li>\n
- Feature: Database Health Scanner & Bloat Cleanup \u2014 Detection of orphaned postmeta, orphaned usermeta, expired transients, and excess revisions with protected Level-B cleanup gated by administrator re-authentication and recent backup validation.<\/li>\n
- Feature: Migration Serialization Readiness \u2014 Bounded scanning for absolute site URLs embedded inside serialized PHP objects with actionable WP-CLI search-replace guidance.<\/li>\n
- Feature: Weekly Changelog Digest \u2014 Automated aggregation of available plugin and theme updates with upgrade notice highlighting, scheduled weekly digest alerts, and manual inspection.<\/li>\n<\/ul>\n\n
1.0.2<\/h4>\n\n\n