WordPress Toolkit
Every WordPress site Reqad tracks has its own page in the WordPress Toolkit: an overview of the site, a PageSpeed report, one-click performance switches and a Security tab that applies 17 hardening measures - web server rules, wp-config.php constants, WordPress settings and file permissions - without editing a config file by hand.
Open the site page
Go to WordPress Toolkit and click Manage on the site's row. The page lives at /wp-toolkit/<user>/, so you can bookmark it. It opens straight away from the last state Reqad read from WordPress, then refreshes itself about a second later.
The Log in button signs you in to wp-admin as an administrator without knowing the password, and keeps working when the login page has been moved or restricted by the Security tab.
The overview
| Card | Shows |
|---|---|
| WordPress | The installed version, flagged Latest, Outdated or Insecure. |
| PHP | The PHP version the site runs on - change it on the Accounts page. |
| Theme | The active theme and its version. |
| Plugins | How many plugins are active out of those installed, and how many have updates waiting. |
| Disk usage | The whole hosting account. |
| SSL | Valid, self-signed, expired or missing, with the days left. See SSL / TLS. |
| Login URL | Only while Hide wp-admin is applied: the new login address, with a Copy button. |
Next to the cards is a screenshot of the home page, linked to the live site. Refresh takes a new one.
PageSpeed
The PageSpeed card runs Google PageSpeed Insights against the site for mobile and desktop at the same time and shows the four Lighthouse scores - performance, accessibility, best practices and SEO - plus First Contentful Paint, Largest Contentful Paint, Total Blocking Time, Cumulative Layout Shift and Speed Index. The result is cached; press Run test for a new one, or Full report to open it on pagespeed.web.dev.
It needs a free Google API key (25,000 tests a day):
- In Google Cloud, enable the PageSpeed Insights API and create an API key.
- In Reqad, open Settings and paste it into WordPress Toolkit › Google PageSpeed Insights API key.
With a key set, the site screenshot comes from the same test, so it works on servers without a browser installed. Without a key the PageSpeed card is hidden and the screenshot is taken with Chromium on the server, if it is installed. Both run in the background and never hold up the page.
Performance
The switches on the Performance tab apply to the live site as soon as you flip them.
| Switch | What it does |
|---|---|
| Nginx cache | Serves pages from an nginx FastCGI cache instead of running PHP on every request. Logged-in users, the cart, checkout and wp-admin are never cached. Installs the Reqad Cache Purger plugin so the cache is cleared whenever content changes. nginx only. |
| Disable WP cron | Sets DISABLE_WP_CRON and adds a real system cron job that runs due tasks every 2 minutes, logging to ~/logs/cron.log. Scheduled posts and plugin jobs run on time, and visitors no longer pay for them. |
| Search engine indexing | When off, WordPress asks search engines not to index the site (robots.txt disallow plus a noindex tag). Turn it off on staging and development copies. |
| Maintenance mode | Visitors get a "back soon" page with HTTP 503, which tells search engines to come back later rather than drop pages. You stay logged in and see the site normally. |
Security
On the Security tab, tick the measures you want and press Apply changes. Each row shows whether it is currently applied, and Select recommended ticks the ones marked Recommended. Unticking an applied measure and applying again reverts it - except the last two, which are one-way.
Web server rules
These need nginx. Blocked requests get a 404 page, not a 403, so a scanner cannot tell a protected file from a missing one.
| Measure | Blocks |
|---|---|
| Block access to xmlrpc.php (recommended) | Password brute-forcing and pingback floods through XML-RPC. Leave it off if you use Jetpack or the WordPress mobile app. |
| Forbid PHP execution in wp-includes (recommended) | Direct requests to core files that are only ever included - and backdoors planted among them. |
| Forbid PHP execution in wp-content/uploads (recommended) | The most common place for an uploaded web shell. |
| Forbid PHP execution in cache directories (recommended) | The same for wp-content/cache, which caching plugins keep writable. |
| Block access to wp-config.php (recommended) | The database credentials, even if PHP were ever misconfigured and served source. |
| Block access to sensitive files (recommended) | readme.html and license.txt (they give away the version), wp-config-sample.php, wp-admin/install.php and setup-config.php, dot-files (.env, .git, .htpasswd…) and backup, dump and log files. |
| Block author scans (recommended) | /?author=N, which bots use to harvest login names. |
| Block aggressive crawlers | SEO crawlers and scrapers such as AhrefsBot, SemrushBot, MJ12bot, DotBot and Bytespider. Leave it off if you rely on those tools. |
| Add security headers (recommended) | Adds Strict-Transport-Security (HTTPS only, for a year), X-Frame-Options: SAMEORIGIN and X-Content-Type-Options: nosniff. Copies sent by WordPress or a plugin are replaced, so each header appears once. |
| Allow login and core updates only from these IPs | Everyone except the listed IPs and ranges - see below. |
WordPress
| Measure | Effect |
|---|---|
| Hide the WordPress version (recommended) | Removes the generator tag from pages and feeds and replaces ?ver=<version> on core scripts and styles with a hash, so browser caching still works but scanners cannot match the site to known vulnerabilities by version. Plugin versions are left alone. |
| Disable file editing in the WordPress dashboard (recommended) | Sets DISALLOW_FILE_EDIT: a stolen admin login can no longer rewrite theme or plugin PHP from the browser. |
| Disable script concatenation in wp-admin (recommended) | Sets CONCATENATE_SCRIPTS to false, closing the load-scripts.php denial-of-service vector. |
| Turn off pingbacks (recommended) | Pingbacks are mostly spam and are abused for DDoS reflection. Applies to new posts. |
| Hide wp-admin - move the login to a new URL | Installs the WPS Hide Login plugin with the address you choose (a random one is suggested). wp-login.php and /wp-admin then return 404 to anyone not logged in. |
Files and keys
These two are one-way: unticking them later does not undo anything.
| Measure | Effect |
|---|---|
| Configure security keys (recommended) | Makes sure all eight keys and salts in wp-config.php are set and strong. Once applied, Regenerate keys now replaces them - which signs every user out. |
| Restrict access to files and directories (recommended) | wp-config.php becomes readable by the site owner only (600), and world-writable files and directories lose the write bit for others. |
Restricting login to your IPs
Allow login and core updates only from these IPs is the strongest defence against password guessing: only the addresses you list can open wp-login.php, wp-admin/upgrade.php and wp-admin/update-core.php. Everyone else gets a 404 page.
- Enter one IP or CIDR range per line, e.g.
203.0.113.7or198.51.100.0/24. Add my IP fills in the address you are using right now, and Reqad warns you before applying a list that does not contain it. - The server's own IPs are always allowed, so WordPress core and database updates keep working.
- Visitors can still unlock password-protected posts.
- If your IP changes, the panel's Log in button still gets you in.
Under the hood
The web server rules for a site are written to its own files, included by the site's nginx vhost:
/etc/nginx/reqad-wp-security/<domain>.conf /etc/nginx/reqad-wp-security/<domain>.server.conf /etc/nginx/reqad-wp-security/<domain>.http.conf
They are regenerated on every Apply and every time Reqad is updated, so edit them through the Security tab rather than by hand. nginx is tested before each reload, and a change it rejects is rolled back. The WordPress-side measures use wp-cli, a must-use plugin (hide version) or wp-config.php constants, so they also apply on Apache servers.
Error pages
Reqad also installs clean, server-wide error pages for 403, 404, 500, 502, 503 and 504, in light and dark, that do not name the web server or its version. WordPress keeps its own themed 404 page and its maintenance page - Reqad's pages only appear where WordPress does not answer, for example when a request is blocked by a security rule or PHP is down. A vhost that already defines its own error_page is left untouched.
Need a hand? Register for early access or contact us.