メニュー
WordPress security hardening: adds security constants to wp-config.php, writes .htaccess protection rules (xmlrpc block, file browser disable, wp-includes protection), blocks PHP in uploads, disables pingbacks.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Deploy a theme, plugin, or wp-content subset to a WordPress server from a CI/CD pipeline, with automatic pre-deploy backup, post-deploy health check, and automatic rollback on failure. Designed for GitHub Actions, GitLab CI, or any pipeline that can run Python.
Security and integrity audit for WooCommerce stores. Checks REST API key scope, payment gateway exposure, webhook HTTPS enforcement, suspicious $0 orders, exposed wc-logs (PII/payment data), and coupon abuse.
Scaffold and deploy a WordPress child theme via SSH. Generates style.css, functions.php (with correct parent style enqueueing), and index.php. Supports Kadence, Astra, GeneratePress, Hello Elementor, OceanWP, and any custom parent. Can activate the child theme immediately after creation.
Safely switch WordPress themes via SSH with automatic rollback if the site goes down. Records the previous theme for instant rollback. Verifies HTTP 200 before and after the switch.
Security audit of WordPress themes via SSH. Scans for PHP malware patterns, injected scripts, recently modified files, and unexpected file types. Also checks DB for customizer injections and Elementor postmeta payloads. Use after any attack or before going live with a new/inherited theme.
Comprehensive guide to building, maintaining, and recovering Elementor-based WordPress sites. Covers the CSS pipeline, global styles (Kit), common post-attack failures and fixes, Pro vs Free features, and integration with Kadence and Hello Elementor themes.
| name | wp-harden |
| description | WordPress security hardening: adds security constants to wp-config.php, writes .htaccess protection rules (xmlrpc block, file browser disable, wp-includes protection), blocks PHP in uploads, disables pingbacks. |
| metadata | {"type":"security","script":"scripts/hardening/wp-harden.py","requires":"paramiko"} |
Apply after every restore or on new sites. Run --dry-run first.
python scripts/hardening/wp-harden.py \
--host HOST --user USER --password PASS --wp-path PATH \
--db-host DBHOST --db-user DBUSER --db-pass DBPASS \
--db-name DBNAME --db-prefix wp_ [--dry-run]
| Hardening | How |
|---|---|
DISALLOW_FILE_EDIT | wp-config.php constant |
WP_DEBUG = false | wp-config.php constant |
FORCE_SSL_ADMIN | wp-config.php constant |
| WP includes protection | .htaccess RewriteRule block |
| xmlrpc.php block | .htaccess <Files> deny |
| File browsing disable | Options -Indexes |
| wp-config.php protection | .htaccess <Files> deny |
| wp-cron lock | .htaccess <Files> deny |
| PHP block in uploads | uploads/.htaccess |
| Pingbacks disabled | DB update to closed |
| File editor disabled | DB option |
Safe to run multiple times — checks before inserting, uses markers to avoid duplicate blocks.