> ## Documentation Index
> Fetch the complete documentation index at: https://docs.digitalfyre.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing WordPress

The WordPress Toolkit includes a built-in security scanner that checks your installation against common vulnerabilities and misconfigurations.

## Running a Security Check

<Steps>
  <Step title="Go to WordPress">
    Log in to Plesk and click **WordPress** in the left sidebar.
  </Step>

  <Step title="Open Security">
    Click on your WordPress installation, then click the **Security** tab.
  </Step>

  <Step title="Run the Check">
    Click **Check Security**. The Toolkit will scan your installation and display a list of findings.
  </Step>

  <Step title="Apply Fixes">
    Review the results. Click **Fix** next to individual issues, or **Fix All** to apply all recommended changes at once.
  </Step>
</Steps>

## What the Security Check Covers

Common items the Toolkit checks and can fix automatically:

* WordPress version is up to date
* Debug mode is disabled
* File permissions are correct
* Directory browsing is disabled
* The default `admin` username is not in use
* WordPress admin area is protected

## Additional Recommendations

* Keep WordPress, plugins, and themes updated — see [Managing Updates](/web-hosting/wordpress/updates)
* Use a strong, unique password for your WordPress admin account
* Install only plugins and themes from reputable sources
* Remove inactive plugins and themes

<Info>
  Our servers run Imunify360, which provides server-level malware scanning and protection across all hosted sites. This complements but does not replace WordPress-level hardening.
</Info>