Deskmode Pro Suite – Customize & Secure Your WordPress Admin
A WordPress admin plugin to Customize and secure your WordPress dashboard
Green is closed, red is open
WordPress security summary
Security settings live in a dozen different screens, so the honest answer to "is this site protected?" is usually "I think so". Deskmode puts every protection on one page, green when it is on and red when it is off, and adds three checks WordPress never runs: must-use plugins loading silently, the PHP .user.ini, executable files sitting in your uploads folder. Every line is a link to the page that fixes it.
How the WordPress security summary works
One page that answers "is this site protected?"
Security settings are scattered by design: rate limiting in one screen, two-factor in another, XML-RPC somewhere else again. Each one is easy to set and just as easy to forget, so the honest answer to whether a site is protected is usually a guess. The security summary replaces the guess with a list.
Every protection Deskmode offers appears on a single page with a green or red badge: green when it is on, red when it is off, and one line underneath saying what that means in practice. Not "REST rate limiting: disabled", but "/wp-json answers as fast as the server can". Each line is a link straight to the screen that turns it on.
Every protection, at a glance
- Login rate limiting, geographic restriction, allowed login hours and block notifications.
- Two-factor authentication and captcha, with the captcha counted as active only when both API keys are actually saved, so a half-configured service never shows green.
- Custom login URL, XML-RPC, user enumeration, REST API rate limiting and application passwords.
- A counter at the top: how many protections are off, and how many checks need attention.
Three checks WordPress never runs
The summary also looks at things outside the plugin, the ones that stay invisible until someone is already inside. All three are read-only: nothing is changed, moved or deleted.
- Must-use plugins. They load on every request and cannot be deactivated from the Plugins screen. Many hosts install one legitimately, which is exactly why a hostile one goes unnoticed there. The summary lists what is in the folder so you can recognise what belongs.
- The PHP .user.ini. Whether it exists, whether it is writable by the web server, and what open_basedir, allow_url_fopen, disable_functions and the rest are actually set to. Each directive shows the value in effect next to whether it comes from that file or from the server's php.ini, because a file can exist and still be ignored.
- Executable files in uploads. A recursive scan for .php, .phar, .phtml and a dozen other extensions the server could run. Nothing in a media folder should ever be code. It also tells you when no .htaccess is stopping PHP from running there.
The uploads scan is kept for one hour and stops after 20,000 files, so it never slows the dashboard on a site with a large media library. When it stops early, the page says so instead of pretending the result is complete.
On .user.ini: it only applies when PHP runs as CGI or FPM. On mod_php the summary says so and gives no verdict, rather than reporting a problem that does not exist on your server.
WordPress security summary: Frequently asked
WordPress Security summary: the questions we get most
Five answers on what the page checks, what it deliberately does not do, and how to read a red badge that isn’t your fault.
Is this a malware scanner?
No, and it is worth being blunt about it. The summary reads settings and looks in three specific places; it does not inspect the contents of your files and it has no database of known malicious code. A backdoor written into a theme file, or hidden inside a legitimate-looking plugin, is invisible to it.
What it does is different and complementary: it tells you which of your own defences are switched off, and it looks where code has no business being. If you need signature-based scanning, run a dedicated tool alongside it, and read the WordPress hardening guide for the measures that sit outside any plugin.
Does opening the page change anything on my site?
Nothing at all. Every check is read-only: files are listed and settings are read, never modified, moved or deleted. The page has no “fix this for me” button by design, because a plugin that silently rewrites .user.ini or deletes files out of your uploads folder can do more damage than the problem it was solving.
Each line links to the screen where you make the change yourself, having seen what it is.
The page says my .user.ini is read-only, but two directives are red. Which is it?
Both, and they are separate facts. The file is fine; the values are what is off. A directive that isn’t written in your .user.ini still has a value in effect, inherited from the server’s php.ini, and that is the value the summary reports because that is what PHP actually applies.
The In the file column tells you which is which. “No, from php.ini” means the setting isn’t yours to change from there: either add it to your file, if your host allows it, or ask them to change it.
It found a PHP file in my uploads folder. Have I been hacked?
Not necessarily, and don’t delete anything before you have looked. Some caching, backup and gallery plugins legitimately write PHP into uploads, and an index.php of zero bytes is a common and harmless way of stopping directory listing.
What matters is whether you can account for it. Open the file: if it is obfuscated, base64-encoded, or you have no idea what put it there, treat it as a finding and investigate properly. The summary points the torch, it doesn’t decide for you.
Why are my must-use plugins marked in red when my host installed them?
Because the page cannot tell a hosting helper from a backdoor, and pretending otherwise would be worse than the amber. Red here means “look at this”, not “this is malicious”: must-use plugins load on every single request and cannot be deactivated from the Plugins screen, which is exactly why that folder is a favourite hiding place.
Read the names once, recognise what your host put there, and from then on you will notice immediately if something new appears.