WordPress Security Posture Review for a Small Site (Defensive)
Check accounts, updates, backups and hardening basics.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Review the security of my WordPress site as a defensive review of my own site; give protective steps only. Versions of core, theme and plugins and whether updates are pending: [VERSIONS]. Users and roles: [USERS]. Sign-in protections (two-step, limit attempts): [SIGN_IN]. Backups (frequency, location, tested restore): [BACKUPS]. Hosting features: [HOSTING]. File and directory permissions known: [PERMISSIONS]. Do not ask me to paste passwords. Check for outdated software, default usernames, weak passwords, no two-step verification, no tested restore, backups only on the same server, unnecessary admin users, editors able to install plugins, and exposed backup files. For each finding explain in plain words what could go wrong, rate risk and effort, and give the fix. Order a 30-day plan by risk reduction per hour: week one updates, two-step sign-in and removing unused admins and plugins; week two backups with a restore test; week three monitoring and file integrity checks [VERIFY]; week four documentation and an incident plan. Incident checklist: isolate, preserve evidence, restore from a clean backup, change credentials, patch, monitor, and involve the host's support where appropriate. Mark hosting-specific items and menu names [VERIFY].
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.