Fortify the security of any WordPress installation.
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.
.gitignore add *.html in file .gitignore Apr 26, 2017

WPHardening Build Status Coverage Status


Fortify the security of any WordPress installation.

❮ NOTE ❯ This tool releases new versions on a regular basis. Make sure to update your dependencies frequently to get the latest version. Check out the changelog or to learn about the new features.


Installing WPHardening requires you to execute one console command:

$ pip install -r requirements.txt


$ python -h 

 __          _______  _    _               _            _
 \ \        / /  __ \| |  | |             | |          (_)
  \ \  /\  / /| |__) | |__| | __ _ _ __ __| | ___ _ __  _ _ __   __ _
   \ \/  \/ / |  ___/|  __  |/ _` | '__/ _` |/ _ \ '_ \| | '_ \ / _` |
    \  /\  /  | |    | |  | | (_| | | | (_| |  __/ | | | | | | | (_| |
     \/  \/   |_|    |_|  |_|\__,_|_|  \__,_|\___|_| |_|_|_| |_|\__, |
                                                                 __/ |
        Fortify the security of any WordPress installation.     |___/

     Caceria de Spammers -

Usage: python [options]

  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -v, --verbose         Active verbose mode output results
  --update              Check for WPHardening latest stable version

    This option must be specified to modify the package WordPress.

                        **REQUIRED** - Working Directory.
    --load-conf=FILE    Load file configuration.

    Different tools to hardening WordPress.

    -c, --chmod         Chmod 755 in directory and 644 in files.
    -r, --remove        Remove files and directory.
    -b, --robots        Create file robots.txt
    -f, --fingerprinting
                        Deleted fingerprinting WordPress.
    -t, --timthumb      Find the library TimThumb.
    --chown=user:group  Changing file and directory owner.
    --wp-config         Wizard generated wp-config.php
    --plugins           Download Plugins Security.
    --proxy=PROXY       Use a HTTP proxy to connect to the target url for
                        --plugins and --wp-config.
    --indexes           It deny you to display the contents of directories.
    --minify            Compressing static file .css and .js
    --malware-scan      Malware Scan in WordPress project.
    --6g-firewall       6G Firewall.
    --rest-api          Disable REST API.

    -o FILE, --output=FILE
                        Write log report to FILE.log


Check a WordPress Project

Before using the tool, we must ensure that our working directory is WordPress.

$ python -d /home/path/to/wordpress -v

Change permissions

This option is to add the correct permissions to files and directories.

$ python -d /home/path/to/wordpress --chmod -v

Remove files that are not used

Part of the fortification of any system is to remove those files, directories or components required.

$ python -d /home/path/to/wordpress --remove -v

Create your robots.txt file

WordPress default does not incorporate the robots.txt file with this option poemos customize our robots.txt

$ python -d /home/path/to/wordpress --robots -v

For more information robots.txt

Remove all fingerprinting and Version

$ python -d /home/path/to/wordpress --fingerprinting -v

Check a TimThumb library

$ python -d /home/path/to/wordpress --timthumb -v

Create Index file

This file is created as a way to avoid sailing in a directory.

$ python -d /home/path/to/wordpress --indexes -v

Download Plugins security

The following is a list of the most commonly used security plugins that you can download automatically:

$ python -d /home/path/to/wordpress --plugins

Wizard generated wp-config.php

This command automatically creates a file called wp-config-wphardening.php which can then rename it.

$ python -d /home/path/to/wordpress --wp-config

6G Firewalls

$ python -d /home/path/to/wordpress --6g-firewall

Disable REST API

$ python -d /home/path/to/wordpress --rest-api

WPHardening update

With this option you can always have the latest version of WPHardening.

$ python --update

Use all options

$ python -d /home/path/to/wordpress -c -r -f -t --wp-config --indexes --plugins --6g-firewall --rest-api -o /home/user/wphardening.log

Project Home

Git Repository