WordPress Hardening & Security Audit
A professional security-ops audit and hardening suite for WordPress installs, including incident recovery runbooks.
- Audit a live WordPress site for known plugin CVEs and configuration gaps
- Generate a prioritized P0-P3 security findings table with remediation steps
- Harden the wp-config.php and server headers to block common attack vectors
$19
/moSubscription · cancel anytime
Secure checkout via Stripe
- Always the latest version
- Delivered live to your agent via MCP
- Cancel anytime, access ends at period end
Included in download
- Downloadable skill package
- Works with Cursor, Codex CLI
- 1 permission declared
Sample input
Audit my WordPress site at example.com. It's a high-traffic WooCommerce store on a VPS. I'm worried about recent plugin vulnerabilities and brute force attacks.
Sample output
MODE: AUDIT | Tier: E3 Exposed (Public + PII/Money)
| # | Finding | Domain | Reachable? | Impact | Effort | Priority | Fix | |---|---|---|---|---|---|---|---| | 1 | WooCommerce v7.2 (CVE-2023-XXXX) | 6 | Yes | Critical | Low | P0 | Update to v7.2.2 immediately | | 2 | XML-RPC open (Brute force risk) | 3 | Yes | Med | Low | P1 | Disable xmlrpc.php via .htaccess | | 3 | No 2FA for Admin/Shop Manager | 1 | Yes | High | Med | P1 | Enforce TOTP/Passkey via plugin |
Top-3 Today: Update WooCommerce, Disable XML-RPC, rotate wp-config salts.
WordPress Hardening & Security Audit
A professional security-ops audit and hardening suite for WordPress installs, including incident recovery runbooks.
$19
/moSubscription · cancel anytime
Secure checkout via Stripe
- Always the latest version
- Delivered live to your agent via MCP
- Cancel anytime, access ends at period end
Included in download
- Downloadable skill package
- Works with Cursor, Codex CLI
- 1 permission declared
- Instant install
Sample input
Audit my WordPress site at example.com. It's a high-traffic WooCommerce store on a VPS. I'm worried about recent plugin vulnerabilities and brute force attacks.
Sample output
MODE: AUDIT | Tier: E3 Exposed (Public + PII/Money)
| # | Finding | Domain | Reachable? | Impact | Effort | Priority | Fix | |---|---|---|---|---|---|---|---| | 1 | WooCommerce v7.2 (CVE-2023-XXXX) | 6 | Yes | Critical | Low | P0 | Update to v7.2.2 immediately | | 2 | XML-RPC open (Brute force risk) | 3 | Yes | Med | Low | P1 | Disable xmlrpc.php via .htaccess | | 3 | No 2FA for Admin/Shop Manager | 1 | Yes | High | Med | P1 | Enforce TOTP/Passkey via plugin |
Top-3 Today: Update WooCommerce, Disable XML-RPC, rotate wp-config salts.
Screenshots
About This Skill
Secure Your WordPress Infrastructure
WordPress powers over 40% of the web, making it the primary target for automated mass-exploitation. Most breaches don't happen because of poor PHP code, but because of misconfigured environments, unpatched plugins, and weak access controls. This skill turns your AI agent into a Senior WordPress Security Operations Engineer focused on infrastructure hardening and incident response.
What it does
- AUDIT: Performs a comprehensive assessment of your live site's security posture, including third-party plugin/theme CVE exposure, configuration gaps, and transport security.
- HARDEN: Delivers production-ready configuration snippets (wp-config.php, .htaccess, Nginx, Security Headers) and WP-CLI commands to lock down your install.
- INCIDENT: Provides a step-by-step containment-to-recovery runbook for compromised sites, focusing on forensics before deletion to ensure attackers don't return.
Why use this skill?
Unlike generic GPT prompting, this skill uses a structured 10-domain hardening framework and a dynamic scoring system (Impact / Effort) to prioritize fixes. It distinguishes between "security by obscurity" and "security by design," ensuring you implement high-value controls like 2FA and CSP over cosmetic changes. Every recommendation includes a Verify: step so you can objectively confirm the fix worked.
Supported Environments
Works across Managed WP hosts, VPS (Docker/CloudPanel/Coolify), and shared hosting. It prioritizes WP-CLI workflows for efficiency but provides manual alternatives for dashboard-only access.
Use Cases
- Audit a live WordPress site for known plugin CVEs and configuration gaps
- Generate a prioritized P0-P3 security findings table with remediation steps
- Harden the wp-config.php and server headers to block common attack vectors
- Execute an incident response runbook to clean and restore a compromised site
- Verify security controls using curl and WP-CLI check-sums
Known Limitations
- Cannot perform direct network scanning or pen-testing.
- No support for custom PHP code review or logic flaws.
- Limited to WordPress-specific infrastructure, not general OS hardening.
How to Install
mkdir -p ~/.claude/skills && curl -sL https://www.agensi.io/api/install/wordpress-hardening-security-audit -o /tmp/wordpress-hardening-security-audit.zip && unzip -o /tmp/wordpress-hardening-security-audit.zip -d ~/.claude/skills && rm /tmp/wordpress-hardening-security-audit.zipFree skills install directly. Paid skills require purchase - use the download button above after buying.
Reviews
No reviews yet - be the first to share your experience.
Only users who have downloaded or purchased this skill can leave a review.
No reviews yet - be the first to share your experience.
Only users who have downloaded or purchased this skill can leave a review.
Security Scanned
Passed automated security review
Permissions
File Scopes
Works with any SKILL.md-compatible agent (Claude Code, Cursor, Codex CLI, Gemini CLI, OpenCode). No dependencies. Best with read access to the plugin/theme inventory and SSH/WP-CLI to apply and verify fixes; wp-admin-only and SFTP-only workflows are supported.
Frequently Asked Questions
Learn More About AI Agent Skills
More Premium Skills
Multi-Agent Orchestration Master Library
Transform Claude Code into a coordinated multi-agent system. Battle-tested tmux orchestration patterns, YAML task queues, event-driven communication, and parallel worker management for 8+ agents.
Legacy Code Modernization Planner for AI Coding Agents
Creates safe modernization roadmaps for old, messy, undocumented, or fragile codebases, including risk audits, refactor phases, dependency reviews, testing plans, migration steps, and AI coding prompts.
designing-hybrid-context-layers
Architects the right retrieval strategy for every query — teaching your agent when to use RAG, a knowledge graph, or a temporal index instead of defaulting to vector search for everything.
ai-automation-qa-pack
Professional QA & UAT documentation generator for AI automation agencies and complex agent deployments.