Security / Speed
Watch daily for known vulnerabilities, security fixes, tampering and suspicious files, close entry points with two-factor authentication and more, and serve images as WebP for faster pages
The most common way in is a plugin that wasn't updated
"Sorabun > Measure / Analyze > Security / Speed" watches and closes the ways a WordPress site gets taken over (Pro). The settings that make images lighter and pages faster also live here.
Most WordPress takeovers exploit weaknesses the developer has already fixed. After a fixed version is released, sites that haven't updated get targeted. But WordPress shows "update available" the same way for a new feature and for a security fix, so the urgent updates get buried.
This screen checks the following automatically every day, and notifies you when something urgent turns up:
- Whether installed plugins, themes or core have a known vulnerability
- Whether an available plugin update contains a security fix
- Whether WordPress core and plugin files have been modified, or suspicious files have been placed
You don't need to sign up for any paid service or API key. It contacts WordPress.org and the Sorabun license server (for matching known vulnerabilities).
1. Known vulnerabilities
Installed plugins, themes and core are matched against a public vulnerability database (Wordfence Intelligence). The Sorabun license server imports the database every day.
| Shown | Meaning |
|---|---|
| Severity | Critical, High, Medium, Low (from the CVSS score) |
| Action "Update to x.x or later" | A fixed version is out. Updating to it fixes the problem |
| Action "No fix yet" | Not fixed yet. Updating can't fix it, so if you don't use it, consider deactivating or deleting it |
- Only plugin and theme names (slugs) are sent for matching. Installed versions and site contents are not sent. Versions are compared on your own site
- Critical and High issues, and issues with no fix yet, are notified on the day they're found
- License activation is required
Vulnerability information comes from Wordfence Intelligence. The source and the CVE (MITRE) copyright notice are shown at the bottom of the screen.
2. Updates that contain security fixes
For each plugin with an available update, it reads the changelog from your installed version up to the latest version from WordPress.org and checks whether a security fix is mentioned. Results are listed most urgent first.
| Verdict | Meaning |
|---|---|
| Update now | The changelog clearly mentions a security fix, such as "vulnerability", "XSS", "SQL injection" or "CVE-". Update as soon as you can |
| Looks like a safety fix | The changelog mentions fixes that likely relate to safety, such as sanitizing input or permission checks |
| Can't check the changes | There is no changelog, or it can't be read (themes, plugins distributed outside WordPress.org, etc.) |
| Feature update | No security fix was found in the changelog |
A small update within the same WordPress release line (e.g. 6.8.1 → 6.8.2) is almost always security and bug fixes, so it's shown as "Update now".
While there's an "Update now" item, a red notice appears on every admin screen. It disappears once you update.
Security fixes the developer doesn't write in the changelog can't be detected. "Update now" means at least do this one right away. Apply the other updates regularly too.
Apply only security fixes automatically
Turn on "Automatically apply only updates that contain security fixes" in "4. Close the entry points" to have WordPress's automatic updates (twice a day) apply only "Update now" items and plugins with a fixed version for a known vulnerability.
WordPress's automatic updates are all-or-nothing, but this applies only the urgent ones. It doesn't change the automatic update settings of other plugins. Applied updates are recorded on the screen.
3. Tampering and suspicious files
WordPress core
It compares WordPress core files (wp-admin and wp-includes) against the official list of correct files (checksums) published by WordPress.org. It finds three things:
- Modified files: malicious code has been added to a core file
- Missing files: a core file has been deleted
- Unknown PHP inside the core folders: a common form of the "back door" left behind after a takeover
wp-content (themes, plugins, images) isn't compared, because its contents change with legitimate updates.
If differences turn up and you don't know why, use "Re-install version x.x.x" in "Dashboard > Updates" to put the official files back (your posts and settings are not deleted). Unknown PHP files aren't removed by re-installing, so check their contents in your server's file manager and delete them.
Development versions of WordPress, such as betas, have no official list, so the screen says the check isn't possible. That doesn't mean tampering was found.
Plugins and suspicious files
"Scan files" checks two things (it also runs automatically every day).
- Matching (reliable): plugins distributed on WordPress.org have an official list of correct files for each version. Installed files are compared against it to find modified files and PHP files that aren't in the original package
- Pattern check (a guide): files that can't be matched, such as themes, the uploads folder, and paid or custom plugins, are checked for patterns common in files planted during a takeover (running hidden code, running values sent from outside, PHP in the uploads folder, PHP disguised as an image, and so on)
Files that match the official list are not pattern-checked, so legitimate plugins are rarely flagged.
For anything found, "Ask AI to explain" has AI describe in plain words what the code does, whether it looks malicious, and what to do. Only 25 lines around the finding are sent to AI.
| Level | Meaning |
|---|---|
| High | Almost certainly malicious (notified on the day it's found) |
| Guide | Common in malicious code, but legitimate code uses it too. Check the contents |
The pattern check doesn't have the coverage of the large signature sets professional security companies maintain. "Nothing found" doesn't guarantee safety, so if you suspect a takeover, consult a professional.
4. Close the entry points
Every setting is off by default. Some of them stop features certain sites need, so read the description before turning one on.
| Setting | What it prevents | Keep in mind |
|---|---|---|
| Automatic security fixes | Applies urgent updates without waiting for someone | An update can occasionally break the layout. Applied updates are recorded on the screen |
| Require two-factor authentication for administrators | Even if a password leaks, nobody can log in without the phone | When on, administrators who haven't set it up can't open other screens until they do. Set up your own first |
| Login brute force | After 5 failures in a row from the same connection, login is blocked for 15 minutes. Stops attacks that keep trying passwords by machine | If many people log in from the same network (an office, for example), one person's repeated typos can lock everyone out for a while |
| Username leaks | Hides the "?author=1" trick that reveals login IDs, and the user lists in the REST API and sitemap, from visitors who aren't logged in | Author pages (/author/name/) still display |
| XML-RPC | Turns off an old integration mechanism used for attacks that try many passwords at once | The WordPress mobile app, Jetpack and some external posting tools will stop working |
| PHP in the uploads folder | Stops PHP from running in the uploads folder, against attacks that upload PHP disguised as an image and open it | Works on servers where .htaccess applies (Apache, LiteSpeed). On nginx, ask for the one line shown on the screen to be added to the server configuration |
When a login is blocked, the date and time, the connection (partly masked) and the username that was tried stay on the screen. Blocking only uses connection information that can't be faked.
Setting up two-factor authentication (each user's profile)
Each user sets up two-factor authentication under "Two-factor authentication" in "Users > Profile".
- Press "Set up" to show a QR code
- Scan it with an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 1Password, etc.)
- Enter the 6 digits shown in the app and press "Verify". It turns on and shows 10 backup codes. Each can be used once if you lose your phone, so print them or save them in a password manager
From then on, you're asked for the 6 digits after your password. You can get the 6 digits wrong up to 5 times; after that you start over from the password. The same 6 digits can't be used twice.
- The QR code is created on the screen itself (the secret key isn't sent to any outside service). The secret key is stored encrypted, and backup codes are stored in a form that can't be reversed
- If someone loses both their phone and backup codes, another administrator can press "Remove this user's two-factor authentication" on that user's profile, and they can log in with just the password
- For XML-RPC, users with two-factor authentication can only log in with an application password
Add the line define( 'SORABUN_SECURITY_OFF', true ); to wp-config.php using your server's file manager. All settings in this section (two-factor authentication, login lockouts, etc.) stop. Monitoring and notifications continue. Remove the line once you can log in again.
5. Lighter images for faster pages
Images are most of what slows a page down. Converting JPEG and PNG to WebP makes them a fraction of the size with almost no visible difference.
Turn on "Serve as WebP" to display article images from their WebP copy when one exists.
- The original image isn't modified. A WebP copy is created next to it (photo.jpg.webp for photo.jpg) and swapped in only when displayed
- Turning it off goes back to serving the original images immediately
- Newly uploaded images get a copy right away
- For existing images, use "Make existing images lighter in bulk". It works 15 images at a time and shows progress and how much was saved
- Images that would get bigger as WebP (such as well-compressed PNGs) get no copy and are served as the original
- Only images in this site's uploads folder are swapped. Images from other sites are left as they are
- If you no longer need the copies, "Delete the WebP copies" removes them. The originals stay
Images Sorabun makes with AI, such as eyecatches and diagrams, are saved as WebP at a maximum width of 1600px. You can switch this with "Save AI-generated images lighter" in "Settings > Generation defaults". Slides for video stay PNG so video editing software can read them.
If the server's image processing (GD / Imagick) doesn't support WebP, copies can't be created. The screen tells you when that's the case; ask your hosting company about WebP support.