Title: Tuning4Web – Security Check Author: Piotr Kunicki Published: 14 outubro, 2026 Last modified: 14 outubro, 2026 --- Pesquisar plugins ![](https://ps.w.org/tuning4web-security-check/assets/banner-772x250.png?rev=3747244) ![](https://ps.w.org/tuning4web-security-check/assets/icon-256x256.png?rev=3747244) # Tuning4Web – Security Check Por [Piotr Kunicki](https://profiles.wordpress.org/kuperman87/) [Baixar](https://downloads.wordpress.org/plugin/tuning4web-security-check.1.3.7.zip) * [Detalhes](https://br.wordpress.org/plugins/tuning4web-security-check/#description) * [Avaliações](https://br.wordpress.org/plugins/tuning4web-security-check/#reviews) * [Instalação](https://br.wordpress.org/plugins/tuning4web-security-check/#installation) * [Desenvolvimento](https://br.wordpress.org/plugins/tuning4web-security-check/#developers) [Suporte](https://wordpress.org/support/plugin/tuning4web-security-check/) ## Descrição Most security plugins switch settings on and assume they work. Tuning4Web – Security Check verifies the result. It requests key URLs of your site the way an anonymous visitor (or an attacker) would, reads your WordPress configuration, and reports what is really exposed, how serious it is, and how to fix it. It is not a firewall and not a malware scanner, and it works alongside the security plugin you already use. Typical findings it catches that a settings screen cannot show: * A rule that should block a file is not active, because the server, a cache or a CDN ignores it. * PHP code really runs inside the uploads directory. The plugin proves it with a harmless, temporary test file. * Your login names leak through the REST API, `?author=N` redirects, oEmbed data or the authors sitemap, even though you disabled one of these. * Security headers are set by a plugin but stripped by page caching. Results are judged by the content of each response, not only by the status code. A blank `wp-config.php` page, the empty “Silence is golden” index file and a 405 from `xmlrpc.php` are not reported as leaks. The plugin also warns when maintenance mode, “soft 404” pages or a firewall blocking its own requests make the answers unreliable. The checks are requests from your own server to your site, without logging in. A firewall or CDN that treats your server’s IP address differently from visitors can change a result; the plugin warns when it detects this. #### Hardening check Every failed check has a severity (critical, high, medium, low). The check runs step by step with a progress bar, so it works on slow hosting too. * Theme and plugin file editor (DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS) * wp-config.php: blocked by the server, or worse, source code visible * Security keys and salts: missing, default, short or duplicated * Public debug.log * PHP execution in the uploads directory (optional active test; a temporary file is created and deleted right away) * XML-RPC: which methods the endpoint really offers (pingback, multicall, logins) * Username enumeration: REST API users endpoint, ?author=N, oEmbed author data, authors sitemap * Security headers (X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, HSTS) and version disclosure (Server, X-Powered-By, WordPress version in the page) * Directory listing in wp-includes, uploads and plugins * readme.html, license.txt, .htaccess, install.php For problems that can only be fixed on the server, the plugin shows the exact Apache or Nginx rule to add. #### Protections (all off by default) Simple switches applied through WordPress hooks only. Nothing is written to wp-config. php or .htaccess, so deactivating the plugin turns them all off. * Disable XML-RPC * Block username enumeration (REST users endpoints, ?author=N, oEmbed author, users sitemap) * Disable the theme and plugin file editor * Disable application passwords * Hide version information (generator tag, WordPress version in script and style URLs, X-Powered-By) * Basic security headers (nosniff, SAMEORIGIN, Referrer-Policy) * HSTS (HTTPS sites only; enabled only after a certificate check, and cleared with max-age=0 when turned off) #### One-click security key rotation Writes eight new random keys into wp-config.php and logs everyone out, which is the right move after a suspected break-in. The keys are generated on your server. Only those eight values are replaced, the file is written atomically, and the original is restored if the site stops responding. If the keys are defined in any other way( for example from environment variables), nothing is changed. #### External scripts Lists scripts loaded from other domains on a sample of pages: home page, newest posts and pages, the main category, the newest product, and pages with custom templates. Scripts from domains you have not marked as trusted are highlighted for verification; you keep your own list of trusted domains (empty by default). It also shows whether each script uses Subresource Integrity (SRI). Only the HTML sent by the server is scanned; scripts added later by JavaScript are not visible. #### Privacy The plugin does not contact any external server and does not collect or send any data. All checks are requests from your server to your own site. New security keys are generated locally. ## Instalação 1. Upload the `tuning4web-security-check` folder to `/wp-content/plugins/`, or install the plugin from the Plugins screen. 2. Activate the plugin. 3. Go to Settings > Security Check and click “Run hardening check”. ## Perguntas frequentes ### Does it replace my security plugin? No. It does not block traffic or scan files for malware. It checks whether the hardening you have (from any plugin, the server or the host) is effective, and fills gaps with a few simple, reversible switches. ### Why is a check gray? The plugin could not decide automatically, for example because the site is in maintenance mode or answers every unknown URL with a normal page. Check that URL manually. ### I turned on a header switch, but the check still reports the header. Why? Page caches such as WP Super Cache serve stored pages before plugins load, so headers added or removed by the switch do not reach cached pages. The check detects this by comparing the cached home page with a freshly generated one, and shows a server rule (.htaccess, Nginx or PHP settings) that covers every response. ### Why does the theme editor check not depend on the HTTP status? An anonymous request to the editor is always redirected to the login page before WordPress reads DISALLOW_FILE_EDIT. The plugin therefore reads the constant directly. ### What does the PHP-in-uploads test do? It writes a small PHP file with a random name into the uploads directory. The file only prints a random marker. The plugin requests it once and deletes it immediately. If the marker comes back, PHP runs in uploads and you should block it with the server rule the plugin shows. You can turn the test off with the checkbox next to the button. ### Will rotating the security keys break my site? Only the eight key values are replaced. If they cannot be found exactly once each, nothing is changed. After writing, the plugin requests your home page and restores the original file if the site does not respond correctly. Everyone is logged out, which is intended. ### Who can run the checks and change settings? Only users with the manage_options capability (administrators). On multisite, only network administrators can rotate the keys, because wp-config.php is shared by the whole network. ## Avaliações Não há avaliações para este plugin. ## Colaboradores e desenvolvedores “Tuning4Web – Security Check” é um programa de código aberto. As seguintes pessoas contribuíram para este plugin. Colaboradores * [ Piotr Kunicki ](https://profiles.wordpress.org/kuperman87/) Tuning4Web – Security Check” foi traduzido para 1 localidade. Agradecemos aos [tradutores](https://translate.wordpress.org/projects/wp-plugins/tuning4web-security-check/contributors) por suas contribuições. [Traduzir o “Tuning4Web – Security Check” para seu idioma.](https://translate.wordpress.org/projects/wp-plugins/tuning4web-security-check) ### Interessado no desenvolvimento? [Navegue pelo código](https://plugins.trac.wordpress.org/browser/tuning4web-security-check/), consulte o [repositório SVN](https://plugins.svn.wordpress.org/tuning4web-security-check/) ou assine o [registro de desenvolvimento](https://plugins.trac.wordpress.org/log/tuning4web-security-check/) por [RSS](https://plugins.trac.wordpress.org/log/tuning4web-security-check/?limit=100&mode=stop_on_copy&format=rss). ## Registro de alterações #### 1.3.7 * Changed: the built-in list of “known CDN” domains was removed. External scripts are compared with your own list of trusted domains (empty by default), editable on the External scripts tab. * Changed: server rules use the real uploads and content directory paths. #### 1.3.6 * New: server rules are shown for the detected web server (Apache / LiteSpeed or Nginx); rules for other servers are folded below. * Changed: the security headers rule contains only the headers that are actually missing; HSTS comes with a warning. * Changed: a missing HSTS header alone is reported as low severity. #### 1.3.5 * New: when security headers are missing or X-Powered-By is shown, the check compares the cached home page with a freshly generated one and tells you when only the page cache is the cause. * New: server rules (Apache, Nginx, PHP settings) for security headers and for hiding X-Powered-By, shown with the results. * Changed: switch notes explain that pages served by a page cache before plugins load do not get headers from the switches. #### 1.3.4 * New: warning when the site refuses the plugin’s own request for the home page( firewall, password protection), because “blocked” results would then be unreliable. * Fixed: the “Hide version information” note now explains correctly where X-Powered- By can remain (page cache served before plugins load, PHP scripts outside WordPress) and how to remove it everywhere. #### 1.3.3 * Changed: HSTS is turned on only after the HTTPS version of the site loads with a valid certificate. * New: after HSTS is turned off, the plugin sends max-age=0 for a year so that returning visitors’ browsers forget it. * Changed: the HSTS warning is shown in red and explains that it is hard to undo. #### 1.3.2 * New: check for the WordPress version visible in the home page (generator tag,? ver= on scripts and styles). * Changed: “Hide version information” also replaces the WordPress version in script and style URLs with a short hash, so browser caches still refresh after updates. #### 1.3.1 * Changed: the active PHP-in-uploads test has a checkbox next to the button (on by default, the choice is remembered). * Changed: translations are loaded by WordPress from translate.wordpress.org. * Changed: nonce verification moved into each AJAX handler. #### 1.3.0 * New: the hardening check runs one step at a time with a progress bar, so it no longer risks a timeout on slow hosting. * New: severity levels (critical, high, medium, low); results are sorted by severity. * Changed: results are stored as codes and translated when displayed, so they follow the current admin language. * Changed: assets moved to separate CSS and JavaScript files. #### 1.2.0 * Renamed from “Check External Scripts” to “Tuning4Web – Security Check”. * New: Protections tab with opt-in, reversible switches. * New: one-click security key rotation. * New checks: security keys, XML-RPC methods, oEmbed author, ?author=N based on real responses, sitemaps discovered through robots.txt and WordPress itself, debug.log content, maintenance mode / soft 404 detection. * Changed: wp-config.php is reported when the server does not block it. * Changed: external scripts scan is deterministic, treats www and the bare domain as the same site, and reports SRI. * Fixed: log download was truncated when URLs contained “&”. * Security: all actions go through admin-post.php with capability and nonce checks. #### 1.1.0 * Added the WordPress hardening check. #### 1.0.0 * First release as “Check External Scripts”. ## Meta * Versão **1.3.7** * Última atualização **1 dia atrás** * Instalações ativas **Menos de 10** * Versão do WordPress ** 6.0 ou superior ** * Testado até **7.1.3** * Versão do PHP ** 7.4 ou superior ** * Idiomas * [English (US)](https://wordpress.org/plugins/tuning4web-security-check/) e [Polish](https://pl.wordpress.org/plugins/tuning4web-security-check/). * [Traduzir para seu idioma](https://translate.wordpress.org/projects/wp-plugins/tuning4web-security-check) * Tags * [external scripts](https://br.wordpress.org/plugins/tags/external-scripts/)[hardening](https://br.wordpress.org/plugins/tags/hardening/) [security](https://br.wordpress.org/plugins/tags/security/)[Security Headers](https://br.wordpress.org/plugins/tags/security-headers/) [user enumeration](https://br.wordpress.org/plugins/tags/user-enumeration/) * [Visualização avançada](https://br.wordpress.org/plugins/tuning4web-security-check/advanced/) ## Classificações Ainda não foi enviada nenhuma avaliação. [Sua avaliação](https://wordpress.org/support/plugin/tuning4web-security-check/reviews/#new-post) [Ver todas avaliações](https://wordpress.org/support/plugin/tuning4web-security-check/reviews/) ## Colaboradores * [ Piotr Kunicki ](https://profiles.wordpress.org/kuperman87/) ## Suporte Tem algo a dizer? Precisa de ajuda? [Ver fórum de suporte](https://wordpress.org/support/plugin/tuning4web-security-check/)