More screenshots
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsWordPress Hardening & Security Audit
Secure Your WordPress Infrastructure WordPress powers over 40% of the web, making it the primary target for automated mass-exploitation.
$8.99
WordPress Hardening & Security Audit
Example session with this skill installed
Audit our WordPress 6.6 site on Ubuntu with nginx and PHP-FPM 8.2. xmlrpc.php is reachable, DISALLOW_FILE_EDIT isn't set, wp-config.php is in the webroot with 644 permissions, the main admin user is called "admin", and nobody uses 2FA.
- Read your context and instructions
- Compiled the wordpress hardening
Security audit of the five items you described: 4/10. Two high-severity gaps are fixable in under an hour.
| # | Area | Finding | Severity | Fix |
|---|---|---|---|---|
| 1 | Auth | No 2FA on admin accounts | High | Enforce 2FA for administrators |
| 2 | Auth | Username "admin" | High | New admin user, reassign content, delete "admin" |
| 3 | Attack surface | xmlrpc.php reachable | Medium | Block in nginx unless Jetpack or the app needs it |
| 4 | Config | Dashboard file editor enabled | Medium | DISALLOW_FILE_EDIT |
| 5 | Files | wp-config.php at 644 in webroot | Medium | 640, owner deploy user, group PHP-FPM |
wp-config.php
define( 'DISALLOW_FILE_EDIT', true );
define( 'FORCE_SSL_ADMIN', true );
nginx server block
location = /xmlrpc.php { deny all; return 403; }
location = /wp-config.php { deny all; }
location ~* /wp-content/uploads/.*\.php$ { deny all; }
Permissions
chown deploy:www-data wp-config.php
chmod 640 wp-config.php
Test nginx with nginx -t before reload. Moving wp-config.php one level above the webroot is optional once nginx denies direct access.
Next steps
- Check nothing depends on XML-RPC (mobile app, Jetpack) before blocking it.
- Rotate admin passwords and salts after the new admin user exists.
- Ask for an incident-response runbook if you suspect past misuse of "admin".
Connects securely to your tools. The creator never sees your data.
About this skill
Secure Your WordPress Infrastructure
WordPress powers over 40% of the web, making it the primary target for automated mass-exploitation. Most breaches don't happen because of poor PHP code, but because of misconfigured environments, unpatched plugins, and weak access controls. This skill turns your AI agent into a Senior WordPress Security Operations Engineer focused on infrastructure hardening and incident response.
What it does
- AUDIT: Performs a comprehensive assessment of your live site's security posture, including third-party plugin/theme CVE exposure, configuration gaps, and transport security.
- HARDEN: Delivers production-ready configuration snippets (wp-config.php, .htaccess, Nginx, Security Headers) and WP-CLI commands to lock down your install.
- INCIDENT: Provides a step-by-step containment-to-recovery runbook for compromised sites, focusing on forensics before deletion to ensure attackers don't return.
Why use this skill?
Unlike generic GPT prompting, this skill uses a structured 10-domain hardening framework and a dynamic scoring system (Impact / Effort) to prioritize fixes. It distinguishes between "security by obscurity" and "security by design," ensuring you implement high-value controls like 2FA and CSP over cosmetic changes. Every recommendation includes a Verify: step so you can objectively confirm the fix worked.
Supported Environments
Works across Managed WP hosts, VPS (Docker/CloudPanel/Coolify), and shared hosting. It prioritizes WP-CLI workflows for efficiency but provides manual alternatives for dashboard-only access.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for WordPress and WooCommerce.
- Cannot perform direct network scanning or pen-testing.
- No support for custom PHP code review or logic flaws.
- Limited to WordPress-specific infrastructure, not general OS hardening.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 3 days ago