WPSecurity.ro

WPSecurity.ro is a platform dedicated to WordPress security: checking a site, explaining the problems found and cleaning infected installations.

1. About the project

The site offers a scanner that analyses an address and returns a report across several chapters: security headers, TLS configuration, exposure of versions and of files that should not be public, plus WordPress-specific checks.

2. The challenge

A site selling security services carries an obligation others do not: it has to pass its own checks. A security scanner hosted on a site with missing headers is hard to take seriously, and knowledgeable visitors check exactly that.

3. What we built

We took the site's own posture to a perfect score across every chapter checked: a content policy built on the cryptographic fingerprints of each script in the pages, DNSSEC signing of the domain, restricting which authorities may issue certificates, mandatory secure transport for email and a public channel for reporting vulnerabilities.

The content policy was the delicate part: every inline script in the site has its fingerprint in the policy, and any change of theme or module requires the list to be regenerated. For this we built a dedicated tool, which walks the site and recalculates the policy automatically.

4. The outcome

A public security scanner hosted on infrastructure that itself passes every check it applies to others. The site also exposes functions for AI agents, through a custom path that bypasses the usual restrictions of the WordPress interface.