Core integrity
Every WordPress core file is compared with the official checksums for the installed version; modified or unexpected files are listed by path.
Lockora Security Audit plugin
Lockora Security Audit: a free, honest security score for your WordPress site.
Lockora Security Audit is a free WordPress plugin by G. Schad, the specialist behind WP Server Guard. It reviews the site’s security posture from the admin area — core file integrity, public exposure, security headers, updates, administrator accounts, salts, and hosting signals — and turns the result into a weighted 0–100 score with plain-language findings. It runs on demand, sends nothing anywhere, and ships with WP-CLI commands for agencies and CI pipelines.
- Version
- 0.4.2 · updated August 2026
- Adoption
- 200+ active installations · 5.0 / 5 from 4 reviews on WordPress.org
- Requirements
- WordPress 6.0 or newer · PHP 7.4 or newer
- Licence and cost
- Free · GPL v2 or later · no account, no telemetry
What it checks
The checks behind the score
Each check maps to a control area a manual audit reviews. The plugin verifies what can be verified from inside WordPress and says so when it cannot.
wp-content anomalies
Executable files in uploads, PHP where none belongs, runtime executables, and stray backup or secret files (.sql, .zip, .env, .bak) are flagged.
Public exposure
debug.log, readme.html, directory listing in uploads, PHP execution in uploads, and author enumeration through the REST API and ?author= redirects.
Transport and headers
HTTPS enforcement, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy, with the missing ones explained.
Software posture
Outstanding core, plugin, and theme updates; PHP version status against WordPress.org support data; SSL certificate expiry.
Accounts and secrets
Administrator count and naming, authentication keys and salts (with rotation), database table prefix, and must-use plugins that could hide code.
How the score works
Weighted by exploitability, not by the number of checks
Checks are weighted according to how directly a failure can be exploited. A modified core file or PHP execution in the uploads directory costs far more than a missing Referrer-Policy header, so a site can pass most checks and still score low when the failures that remain are the dangerous ones. Every finding states what was checked, what was found, and what to change.
The score is deliberately not a marketing number. It is a posture snapshot from inside WordPress, which is a real limitation: the plugin cannot see the server, the hosting account, cron, or a neighbouring site. That boundary is where a manual audit begins.
For agencies and CI
WP-CLI reports across a fleet
- 01
Scan from the command line
wp lockora scan runs the full check set and prints the score with each finding, so a fleet of sites can be reviewed from a single shell session.
- 02
Export structured output
wp lockora report --format=json produces machine-readable results for a dashboard, a ticketing system, or a client report.
- 03
Fail a pipeline on regressions
wp lockora scan --strict exits non-zero when critical checks fail, so a deployment can be blocked when someone re-enables PHP execution in uploads or ships a modified core file.
- 04
Site Health
Findings also surface in Tools → Site Health for owners who never open the plugin screen.
Limits
What a plugin cannot tell you
Lockora runs with the site’s own PHP user, inside WordPress. It cannot inspect the process table, user crontabs, SSH keys, hosting-panel access, the isolation between accounts on a shared server, or a binary hidden in the account’s home directory — the layer where the backdoor in our WHM incident report lived. It also cannot judge business logic, custom code, or whether a control merely exists or actually holds against an attacker.
Use the plugin to arrive prepared: fix what it finds, then have the parts it cannot see reviewed manually when the site is business-critical, has been compromised before, or must answer a client or insurer.
Also by the author
Two companion plugins on WordPress.org
WordPress.org · Activity log
Who Changed It? – Activity Log & Audit Trail
A tamper-evident activity log with field-level diffs for posts, options, users, plugins, and settings — the record you need when something changed and nobody remembers doing it.
View Who Changed It? on WordPress.orgWordPress.org · Alert routing
WPSecureOps Connector
Forwards completed Wordfence scan findings to a WPSecureOps dashboard so agencies can triage alerts across every client site from one place.
View WPSecureOps Connector on WordPress.orgCommon questions
Common questions about Lockora Security Audit
Is Lockora Security Audit free?
Yes. It is published on WordPress.org under the GPL, has no premium tier, and requires no account. The optional AI-assisted report feature is off by default and uses a key you supply.
Does the plugin send data anywhere?
No. Scans run locally inside WordPress. The only outbound requests are to WordPress.org for core checksums and PHP support data, and, only if you enable it, to the AI provider you configure for report wording.
How is this different from Wordfence or a security suite?
Lockora is a posture audit, not a firewall or malware scanner. It tells you how the site is configured and exposed; it does not block requests or detect known malware signatures. Run it alongside whatever protection you already use.
Can it clean a hacked site?
No. A modified core file or PHP in uploads is a finding, not a cleanup. If the plugin shows signs of compromise, treat the site as an incident and follow the malware-removal guidance on this site.
Why is the score low when most checks pass?
Because checks are weighted by exploitability. One failing high-weight check — a modified core file, executable uploads, an administrator named “admin” with no MFA — outweighs many passing low-weight ones. The findings list shows exactly which check is holding the score down.