Run a Security Audit and Fix What It Finds with AI
Check your site for tampered files, stray admins, and open XML-RPC, then fix the safe stuff with your approval.
Prerequisites
A connected site and a full backup taken before you approve any fixes. Some items (salts, file permissions, the registration setting) come back as a manual checklist rather than automated fixes.
Run a security audit on my WordPress site and report before changing anything. Check: (1) whether my WordPress core and plugin files match the official checksums, and flag anything modified or missing; (2) every administrator account, so I can see if there are more than there should be; (3) whether XML-RPC is enabled and reachable; (4) my WordPress and PHP versions, and whether they are outdated; (5) my database table prefix; and (6) any application passwords on my accounts. Give me the findings as a prioritized list. Then fix only the safe, reversible ones with my approval: update outdated core or plugins, and reinstall any plugin that fails its checksum. For anything you cannot safely do yourself, rotating my security salts, tightening file permissions, and turning off open user registration if I do not need it, give me a short manual checklist with exactly where to do each one. Remind me to take a backup before I approve any updates.
Already connected to WPVibe?
Skip the copy-paste. Just ask your AI for the “Run a Security Audit and Fix What It Finds with AI” recipe, or describe the task, and WPVibe runs these steps on your own site.
WordPress security advice is a wall of jargon, and most of it never gets done. You are not sure whether your core files have been tampered with, how many admin accounts are still active, whether XML-RPC is quietly open to attackers, or if you are running versions with known holes. So the audit stays on the someday list and you hope nothing is wrong.
WPVibe runs the checks it can actually verify. It compares your core and plugin files against the official WordPress checksums to catch tampering, lists every administrator account, tests whether XML-RPC is exposed, and reports your WordPress and PHP versions, database table prefix, and any application passwords. It reads everything first and changes nothing on its own. Then it fixes the safe, reversible problems with your say-so, updating out-of-date software or reinstalling a plugin whose files do not match, and hands you a short manual checklist for the few things an assistant should not touch alone.
Run the prompt below and read the report before approving any fix. The manual items, rotating your security keys, tightening file permissions, and turning off open registration if you do not need it, come with where to do each one, because those are safer in your hands. Take a full backup before you approve any updates.
Outcome
A prioritized security report for your site, the safe fixes applied with your approval, and a short manual checklist for the rest.