Webforta
Sign inStart free trial

One-click fixes

Fix scan findings with the WordPress plugin, Webforta Shield or copy-paste server configuration, then re-check.

Open findings with a known fix show a Fix panel on the scan page. It offers each way to fix the finding that really applies, and nothing is marked fixed until Webforta has re-checked the live site.

With the WordPress plugin

  • Needs Webforta WordPress Security 2.4.0 or later, connected to the website, with "Allow Webforta to apply security fixes" turned on in WordPress (Webforta > Webforta Cloud > Security fixes from Webforta). The website must be verified. Older plugin versions show "Update the plugin to 2.4.0"; a plugin with the setting off shows "Turn on remote fixes in the plugin".
  • Only administrators of your Webforta organization can send fixes. The fix is chosen by Webforta from the finding; it can only turn on one of the plugin's own protections (security headers, HSTS, sensitive-file rules, hiding the WordPress version, turning off XML-RPC, blocking username enumeration), and only one the plugin says it supports on that site. It never turns anything off, edits content or runs code. HSTS needs an extra confirmation, because browsers remember it for a year.
  • Webforta asks the site to fetch the fix straight away with a signed request. If the site cannot be reached, the plugin picks it up with its next scheduled report. A fix nobody fetched expires after 7 days.
  • The status is shown on the finding: Sent to the plugin, Applied by the plugin, Already on, Refused or Failed (with the plugin's reason). Every request and result is in the audit log, and the plugin logs it in its activity log.
  • Turn the setting off in the plugin at any time: the plugin then refuses all fixes, and the dashboard shows the reason.

With Webforta Shield

If the website is routed through Webforta Shield and a Shield setting covers the finding, the panel names that setting and links to it. Shield applies it at the edge; fixing it on the server as well is still recommended.

In the server configuration

Copy-paste configuration for Apache (and LiteSpeed), nginx, IIS and Caddy, with the server the scan saw shown first. Review it before applying, and keep a backup of the file you change. HSTS comes with a warning: browsers remember it for the whole max-age, so turn it on only when HTTPS works on every page.

Check again

Check again repeats only the request(s) behind that finding against the live site (for example the homepage headers, or the exact exposed file), with the same safety rules as a scan. If the issue is gone, the finding is marked "Fixed via the plugin" or "Fixed via a manual change", with the time it was verified; otherwise it shows "Not fixed yet" with the current evidence. A site that does not answer normally is never counted as fixed. Only verified websites can be re-checked. Re-checks are limited to 20 per website per hour and 3 per user per minute, and do not count against full-scan limits; Webforta also re-checks by itself after the plugin reports a fix applied. Client logins see neither the Fix panel nor Check again. A later scan that finds the issue again opens it again.