All fixes

Block the WordPress install wizard

tech-wp-install

install.php is reachable, so whoever loads it first can finish setup, create an administrator and own the site. Block the path and finish setup.

Why this matters

The WordPress installation wizard is accessible. An attacker can complete the installer, create an admin account, and take full control of the site.

WordPress

  1. 1 If WordPress is not yet installed, complete the installation immediately to secure the admin account
  2. 2 If this is a stale or abandoned installation, remove WordPress from the server entirely
  3. 3 Ensure your wp-config.php exists and contains valid database credentials

Does your app still have this?

Scan your domain