Fix what the check finds
Every finding in a report links to one of these guides. Each says what the checker saw, why it matters, the code or server setting that fixes it, and a command to confirm the fix worked.
What it leaks
- Hide the WordPress version numberThe version shows in the page's generator tag and in the stock readme.html. Both can go in a few minutes.
- Stop the WordPress REST API listing user namesThe users endpoint answers anonymous requests with account slugs, which are usually the login names.
- Turn off XML-RPC in WordPressxmlrpc.php still answers. Unless Jetpack or a publishing app needs it, block it at the server.
Security headers
Caching and speed
- Is your WordPress page really cached?A cached page skips PHP and the database entirely. The response headers tell you whether that happened.
- Read and reduce time to first byte on WordPressUnder 300 ms looks like a cached page. Over 800 ms usually means PHP and the database are doing work on every visit.