Lockora Security Audit for WordPress

Lockora Security Audit helps site owners and agencies review a WordPress site’s security posture from the admin area.

Works well with Who Changed It? Lockora finds security weaknesses. Who Changed It? – Activity Log shows what changed, who changed it, and when, with severity classification, field-level diffs, and alerts. Use both together to connect a security finding to the activity that caused it.

Current prototype features include:

Manual security scans.

Weighted security score out of 100.

Bounded scan history with current-versus-previous finding comparisons.

WordPress core file integrity checks using official checksums, with CSV and TXT exports.

Bounded wp-content anomaly scanning for executable uploads, unexpected PHP files outside standard code directories, runtime executables, and exposed backup or secret-like files, with CSV/TXT exports and clipboard copying.

WordPress authentication key and salt checks, with explicit actions to generate missing salts or rotate the keys stored in wp-config.php.

Must-use plugin directory presence checks.

PHP version status using WordPress.org Serve Happy data.

HTTPS and HTTP security header checks.

WordPress core, plugin, and theme update posture checks.

Administrator account posture checks for default usernames, excess admins, inactive admins, user ID 1 exposure, and an admin username/email inventory.