wp-security-auditlisted

Run a structured security audit on any WordPress site — core integrity, plugin/theme CVE cross-check, wp-config and file-permission hardening, malware/compromise detection, and triaged code review of risky plugins. Use this skill whenever the user asks to "audit WordPress security", "check my WP site for vulnerabilities", "is my WordPress site secure", "scan my site", "security check", "harden WordPress", "check my plugins for vulnerabilities", "was my site hacked", or shares a WordPress site URL / SSH access / plugin list with any security concern. Trigger even on loose phrasing like "can you look at this WP site" when security is implied. Works in two modes — remote (URL only, external checks) and full (SSH/WP-CLI access, complete audit). Produces a prioritized findings report (Critical / Important / Polish) with exact fixes, optionally as a branded Word document. Free skill by Macronimous Web Solutions (macronimous.com).
mwstech/wp-security-audit-skill · ★ 2 · Data & Documents · score 73

Install: claude install-skill mwstech/wp-security-audit-skill

# WordPress Security Audit A free, shareable skill by **Macronimous Web Solutions** (macronimous.com) — a web development agency working with WordPress since 2002. Audits a WordPress site's real attack surface. WordPress core is rarely the problem; plugins, themes, configuration, and existing compromises are. This skill focuses effort where breaches actually happen. ## Step 0: Determine the audit mode Ask (or infer from context) which access is available: | Mode | Access needed | Coverage | |---|---|---| | **Remote** | Site URL only | External surface: headers, exposed files, user enumeration, xmlrpc, version disclosure, visible plugin/theme versions | | **Full** | SSH + WP-CLI (or hosting file manager + DB access) | Everything in Remote, plus: core checksums, complete plugin/theme inventory with CVE cross-check, wp-config audit, permissions, malware scan, rogue users, code review | If the user only provides a URL, run Remote mode and state clearly what a full audit would add. Never present a Remote audit as complete coverage. **Scope discipline:** one site per audit. If the user lists multiple sites, audit the first and offer to repeat for the rest. ## Step 1: Inventory (Full mode) Via SSH/WP-CLI: ```bash wp core version wp core verify-checksums # modified/injected core files wp plugin list --format=csv # name, status, version, update available wp theme list --format=csv wp user list --role=administrator --format=csv php -v ``` Record everything befo