Always protected.
No compromises.
Shield your projects from common threats. Fix database and core vulnerabilities in seconds — keeping clients safe and sites online.
Protect every WordPress site from one place. WP Smart runs full scans on core files, malware, and the database — fix issues in one click without opening the site backend.
WordPress core integrity
Verify core files match the official release — restore corrupted files in one click.
Malware scan
Heuristic file analysis to find backdoors, PHP shells, and malicious code — quarantine or trust suspicious files.
Database audit
Inspect wp_options for SQL injections or unauthorized scripts — clean the database in one action.
Quarantine management
Suspicious files move to quarantine — not executable, but still reviewable before permanent deletion.
Disable XML-RPC
XML-RPC is a common brute-force and DDoS vector — WP Smart disables it in one click via WordPress settings.
Hide WordPress version
Remove the WordPress version from HTML source so attackers see less recon data.
wp-config.php permissions
Check and fix wp-config.php permissions (600 or 640) — protect the site’s most sensitive file.
Disable file editor
Turn off the theme/plugin file editor in wp-admin — a recommended WordPress hardening step.
14 best practices
Automatically verify 14 WordPress security settings: SSL, DB prefix, directory listing, HTTP headers, WAF signals, and more.
Automatic fixes
For fixable issues, a “Fix” button applies the secure configuration — no manual file edits.
Trusted file whitelist
Mark modified files as trusted so scans ignore them — reset the whitelist anytime.
Scan every site
Manage security for dozens of sites in one UI — each site keeps its own up-to-date report.
Full scan on one screen
Core integrity, malware, and database audit load in parallel in one report — spot threats and fix vulnerabilities in one click.
Restore corrupted core files
Source integrity monitoring: WP Smart detects anomalies and syncs core files with WordPress.org’s official package.
Harden sites in seconds.
Guard against frequent threats — instant fixes for directory listing and file permissions, handled automatically from the command center.
Malware goes to quarantine — not straight to delete
When WP Smart flags a suspicious file, it doesn’t delete immediately — it moves it to quarantine. Review it, trust it if it’s a false positive, or delete when you’re sure — no accidental loss of legitimate files.
wp-content/uploads/2024/cache/tmp.php
Heuristic match: obfuscated eval() chain, non-core path, recent mtime.