Steel Security & Hardening – Site Audit Tools focuses on practical security hygiene for WordPress administrators. The free plugin provides: on-demand security scans a clear manual workflow: run a scan, review findings, take action, and run again risk summaries grouped by severity and category dashbo
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.4 and PHP 8.0.
SourceWordPress plugins · Oct 20, 2026
01 / Source details
About this tool.
Steel Security & Hardening – Site Audit Tools focuses on practical security hygiene for WordPress administrators.
The free plugin provides:
on-demand security scans
a clear manual workflow: run a scan, review findings, take action, and run again
risk summaries grouped by severity and category
dashboard summary panels for scan risk, hardening posture, last scan state, and Recommended Actions
dashboard Recommended Actions that point administrators to the highest-value next step
checks for common WordPress hardening gaps
checks for exposed root-level artifacts such as .env , SQL dumps, phpinfo files, and backup archives
a quarantine vault for operator-reviewed file isolation, restore, and permanent deletion
server protection checks for Fail2Ban and cPHulk relevance without requiring elevated server privileges
uploads PHP execution blocking on supported server environments
manual guidance when automatic server hardening is not safely supported
This plugin is positioned as an auditing and hardening tool. It helps surface risk and apply selected preventive controls, but it does not promise malware removal, incident response, or complete server protection.
Included checks
The scan currently looks for items such as:
PHP error display exposure
WP_DEBUG and debug.log exposure
default admin administrator username
open public registration with dangerous default role configuration
Uploads & Execution: block PHP execution in uploads with supported Apache/IIS handling and Nginx manual guidance
Login path hardening
Steel Security can hide the default public WordPress login entry by moving it to a custom path that you choose.
no default slug is suggested
the path must be unique and valid for WordPress
collisions with public content and important internal routes are blocked
direct wp-login.php access is hidden while signed-in administration continues to work normally
logout, lost-password, and related login flows continue to use the configured login path
rollback is available from the Hardening page
Server protection checks
The Server Protection page reports safe, non-privileged environment signals for:
Fail2Ban
cPanel / cPHulk
These checks are intended to help administrators understand whether host-level protection appears present, healthy, unavailable, or unsupported. Steel Security does not attempt to manage those systems from inside WordPress.
For Fail2Ban, Steel Security can also validate whether an expected read-only JSON reporter appears current, stale, unreadable, or malformed before treating it as trustworthy visibility.
For cPanel / cPHulk, Steel Security reports conservative visibility states such as detected, possible, not detected, or unable to determine based on safe non-privileged indicators only.
Server-aware behavior
This plugin only auto-applies server config changes where it can do so in a scoped and reversible way.
Apache and LiteSpeed: uploads PHP blocking is managed through a Steel Security-marked .htaccess block
IIS: uploads PHP blocking is managed through a Steel Security-marked web.config section
Nginx and unsupported environments: Steel Security provides manual guidance instead of claiming automatic protection
Pro companion
This plugin can work with a separate Pro companion plugin that adds features such as scheduled scans, scan history, reports, and managed server-level controls such as directory listing protection and baseline security headers. The free plugin remains usable on its own.
02 / Source details
Getting started.
01Upload the plugin files to the /wp-content/plugins/steel-security directory, or install the plugin through the WordPress plugins screen.
02Activate the plugin through the ‘Plugins’ screen in WordPress.
03Open Steel Security in wp-admin to review the dashboard, run a scan, and configure hardening controls.
03 / Source details
Frequently asked questions.
Does this plugin make remote calls?
The free plugin does not rely on a third-party service for core scanning or hardening, and it does not require remote API calls for its free feature set.
Does this plugin remove malware automatically?
No. This plugin is designed to audit, surface risk, and help with selective hardening and operator-reviewed quarantine workflows. It should not be described as an automatic malware removal tool.
Does Steel Security rename the `wp-admin` directory?
No. Steel Security uses a safer custom login-path approach. It hides the default public login entry by moving it to a unique path that you configure, rather than renaming WordPress core directories.
Can Steel Security rename the default `admin` username?
Yes. If an administrator account is still using the default admin login, Steel Security can offer an in-plugin rename workflow with validation and collision checks.
Will this plugin edit my server configuration?
Only for specific controls where the plugin can write a clearly delimited, reversible block on supported servers. Unsupported environments receive manual guidance instead.
What happens on uninstall?
The plugin removes its stored scan data, settings, and hardening rollback metadata. Quarantine payloads are intentionally preserved so operators can review and handle them manually.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
