Recommended Free Tools
Patch or remove the vulnerable component first. An unauthenticated remote-code-execution (RCE) flaw lets an attacker run code without a valid WordPress account, so stronger passwords, administrator MFA, and login throttling cannot repair that code path. Inventory the exact versions installed, apply the vendor’s fixed release through a trusted channel, or remove software you do not need. Then restrict writable code, add carefully scoped request filtering, preserve a tested backup, and monitor for compromise.
This guide applies to WordPress core, themes, plugins, the hosting stack, and exposed interfaces. Product versions and advisories change quickly; match your installation to a current notice rather than assuming that a product name alone proves exposure.
As an Amazon Associate I earn from qualifying purchases.
What “unauthenticated RCE” means in WordPress
“Unauthenticated” means the vulnerable request can be made without logging in. The attacker may not need an administrator password, a subscriber account, or a session cookie. If the vulnerable code accepts an unsafe parameter, processes an uploaded file, or exposes a dangerous action before authentication is checked, account controls are outside that path.
Free tools Windows power users keep installed
One-click scans. No signup required.
RCE is the high-impact outcome: code executes on the web server with the permissions available to the WordPress or PHP process. Depending on hosting isolation, that can allow changes to site files, database access, malicious redirects, new administrator accounts, spam pages, credential theft, or a foothold for attacks against other applications. The exact impact depends on the component, its version, server permissions, and the request that triggers the defect.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Plugins and themes are part of the attack surface
WordPress core is not the only place an RCE defect can exist. Every installed plugin and theme adds PHP, JavaScript, endpoints, scheduled tasks, and file-handling logic. Inactive extensions can still matter if their files remain accessible or a separate component loads them; removing software you do not use is safer than leaving it installed.
Historical CISA records illustrate the issue without proving that a current site is vulnerable:
| Record | What was described | How to interpret it |
|---|---|---|
| CVE-2025-3776, CISA weekly summary for the week of April 21, 2025 | Unauthenticated limited RCE in the Verification SMS with TargetSMS WordPress plugin | A historical, component- and version-specific example. Check the installed version against a current advisory. |
| CVE-2023-6972, CISA weekly summary for the week of December 18, 2023 | Unauthenticated arbitrary file deletion in Backup Migration versions up to and including 1.3.9, with possible site takeover/RCE | A historical, version-bounded record, not evidence that later releases or every installation are affected. |
Do not copy a version recommendation from an old notice into a present-day remediation plan. Confirm the exact software, installed version, fixed version, and advisory date before deciding whether to update, remove, or isolate it.
First response: establish the exact scope
Before changing files, record enough detail to make the remediation reproducible and to preserve evidence if the site is already compromised.
- Record the WordPress core version. Use the Dashboard’s update screen or a trusted deployment inventory. Note whether automatic security updates are enabled.
- Export a complete extension inventory. List every active and inactive plugin and theme, its exact version, source, and whether the site actually needs it. Include must-use plugins and custom code that may not appear in the normal plugin screen.
- Document the runtime. Record the PHP version, web server, hosting isolation model, database engine, operating-system image, and any reverse proxy or server firewall in front of the site.
- Capture the triggering advisory. For a named CVE or incident, write down the affected product and version range, vulnerable endpoint or feature if stated, fixed release, and publication date. Do not infer exposure from a generic product name.
- Preserve logs before rotating them. Keep web-server, PHP, firewall, authentication, and WordPress logs that cover the suspected period. Export them to a location an attacker cannot rewrite through the web account.
- Take a known-state backup. Save the database and the complete installation, including core files,
wp-content, uploads, configuration, and custom code. Mark the time and verify that the copy can be read.
If you see unknown administrator accounts, changed templates, unexpected PHP files, outbound spam, or unexplained scheduled tasks, treat the work as incident response. Do not overwrite the only evidence by immediately reinstalling over the live tree.
Patch or remove the vulnerable software
Update through a trusted release path
Install the vendor’s fixed release from the official WordPress distribution channel or the component publisher’s trusted release path. Update WordPress core, every installed plugin, and every installed theme—not only the item named in an alert. WordPress’s security guidance puts this first because details needed to exploit a fixed vulnerability often become public when the fix is released.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
After updating, verify the running version from the administration interface and your deployment inventory. Clear relevant caches only after the new files are present, and test the vulnerable feature, login, editor, forms, and integrations that the site depends on. A failed update that leaves old files in place is not remediation.
Delete software that has no job
Deactivate and delete plugins and themes that are not required. Deactivation alone may leave vulnerable PHP, upload handlers, or old assets on disk. Keep one intentionally selected fallback theme if your operational policy requires it, but remove abandoned alternatives and unused extensions. Keep a record of deletions so a future administrator does not restore the same risk from an old package.
When an immediate patch is impossible
If a fixed release is unavailable, incompatible, or cannot be deployed during an outage window, reduce exposure temporarily:
- Restrict the affected public route at the edge or server firewall if you know exactly which request and method must be blocked.
- Place the site behind a reverse proxy or server-level WAF and enable a narrowly scoped rule while arranging the update.
- Restrict public access to the site or the affected administrative workflow when the business can tolerate it.
- Increase logging and alerting for requests to the vulnerable route.
These are containment measures, not a fix. A filter can miss an alternate encoding, a new exploit variant, or a request that reaches the code through another route. Remove the temporary rule after the software is patched only when testing confirms the intended behavior.
Reduce writable code and dashboard editing
Use ownership and permissions that fit the host
WordPress needs to write to some locations for uploads, updates, and generated caches, but broad write access to core and plugin code increases the damage an exploit can cause. The appropriate owner, group, and mode depend on whether updates run as the web user, a deployment account, a control panel, or a container image.
| Area | Hardening objective | Operational check |
|---|---|---|
| WordPress core and plugin/theme PHP | Readable by the web process but not broadly writable | Confirm the deployment or update account can still install legitimate releases. |
wp-content/uploads |
Writable only where uploads are required | Use file-type and execution controls appropriate to the web server; do not assume an upload directory is safe merely because it is outside the admin area. |
| Configuration and secrets | Readable only by the service accounts that need them | Check database credentials, salts, API keys, and backup archives for accidental web exposure. |
| Temporary and cache directories | Prevent permanent code from being treated as cache data | Review cleanup, ownership, and whether PHP execution is possible in those directories. |
Never apply a blanket permission command copied from another host. WordPress’s permissions guidance warns against 777 and says administrators should understand their ownership and update workflow before changing modes. A setting that works on shared hosting can break atomic deployments or leave a container unable to update.
Rank #3
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Disable the built-in file editor
Add the following line to wp-config.php, above the line that says WordPress editing is stopped:
define( 'DISALLOW_FILE_EDIT', true );This removes the dashboard’s theme and plugin editor, closing one route for code changes after an administrator account is stolen. It does not prevent malicious uploads, vulnerable plugin behavior, database changes, or direct file writes obtained through another flaw. Keep normal deployment and recovery procedures available outside the dashboard.
Use request filtering as a layer, not a patch
Filtering can reduce exploit traffic before it reaches vulnerable PHP, but it cannot make vulnerable software safe. Choose the layer that matches your hosting model and maintenance capacity.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Layer | Where filtering occurs | Useful controls | Trade-offs |
|---|---|---|---|
| WordPress-level security plugin | Inside WordPress, after the request reaches PHP | Application-aware rules, login throttling, alerts, and file-change checks | Consumes origin resources and may be bypassed if PHP executes before the plugin loads; rules require maintenance. |
| Server-level WAF | Web server or hosting network, before WordPress bootstrap | Request signatures, method and path restrictions, rate limits, and centralized logs | Requires host access and careful tuning; a rule can block legitimate integrations. |
| Reverse proxy or edge service | At the network edge, before traffic reaches the origin | Bot controls, volumetric filtering, rate limits, logging, and origin shielding | May require DNS or certificate changes and must be tested with webhooks, APIs, and cache behavior. |
For a named vulnerability, use a rule only when the affected path, method, parameters, and safe exceptions are understood. Do not claim generic WAF coverage for a CVE without a verified rule. Keep the vulnerable component patched even when an edge service is blocking observed probes.
Review the REST API and other exposed routes carefully
The REST API is not automatically an authentication bypass. WordPress documentation describes public content as generally available anonymously, while private content and internal data normally require authentication unless a site or extension changes those rules. A plugin can also register a route with its own permission logic.
WordPress warns that indiscriminately disabling the REST API breaks administration functions that depend on it, including the block editor. Do not turn off the API as a generic RCE remedy. Instead:
Rank #4
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
- List the routes required by the editor, mobile clients, commerce functions, forms, and external integrations.
- Review each custom or third-party route’s permission callback and authentication behavior.
- Where the site’s use case permits, apply the documented authentication filter or route-specific permissions so requests require a valid identity.
- Test publishing, autosaves, media uploads, previews, webhooks, and integrations after every restriction.
Apply the same reasoning to XML-RPC, login endpoints, cron triggers, upload handlers, and custom AJAX actions. Rate limiting or disabling an unused interface can reduce abuse, but no single interface setting universally prevents RCE.
Harden accounts for account-based attacks
Unauthenticated RCE and credential attacks are different problems. Strong account controls remain necessary because an attacker who obtains an administrator session can edit files, install extensions, or undo other hardening.
- Require strong, unique passwords for every administrator and service account; never reuse a password from another site.
- Enable multifactor authentication for administrators and privileged editors, using a maintained implementation compatible with the current WordPress version and hosting environment.
- Apply rate limiting at the edge or server for login, XML-RPC, password-reset, and other authentication-heavy routes. Tune thresholds so legitimate editors and integrations are not locked out.
- Remove dormant administrators, review application passwords, and rotate credentials after a suspected compromise.
- Separate routine publishing accounts from accounts that can install plugins, edit themes, or change hosting settings.
These controls lower the probability of account takeover and bot-driven password attacks. They do not repair a no-login vulnerability in a plugin, theme, core component, or server library.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build backups that can actually restore the site
Keep regular, integrity-protected copies of both the database and the installation. A useful WordPress backup includes core files, plugins, themes, uploads, custom code, wp-config.php (handled as a secret), and any server configuration required to run the site.
Choose more than one recovery location
An external physical drive can be one destination for backup snapshots, but a drive connected to the production machine is not an isolated backup. Keep a trusted copy that an attacker who compromises the web account cannot rewrite or encrypt. Protect access to the backup location separately from WordPress credentials, and retain versions so a clean point from before an intrusion is available.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test restoration
- Restore the database and files into an isolated staging environment.
- Verify that the site loads, administrators can sign in, uploads work, scheduled tasks run, and integrations reconnect.
- Check that the restored files match the expected release and that no unknown PHP or executable files are present.
- Record how long the restore took and which steps required manual intervention.
A backup that has never been restored is an assumption, not a recovery plan. After a suspected compromise, do not restore blindly over the live site; preserve evidence and use a clean, verified source.
Best Value
- USB-C and USB 3.1 compatible.Specific uses: Business, personal
- Innovative style with refined metal cover
- Password protection with 256-bit AES hardware encryption
- Formatted for Mac
Monitor for exploitation and respond as an incident
Enable file-integrity or change monitoring where your host supports it, and review web-server and PHP logs for unusual POST requests, encoded parameters, new users, unexpected cron jobs, outbound connections, and requests for newly created files. Alert on changes to core, plugin, and theme code outside a scheduled deployment.
If compromise is suspected, isolate the site or restrict it to a maintenance response, preserve logs and a forensic copy, and identify the initial vulnerable component. Rotate WordPress, hosting, database, SSH, API, and third-party integration credentials from a clean device. Remove persistence, patch or replace the affected software, inspect neighboring applications, and notify relevant providers or users when required. Cleanup and credential rotation are incident-response tasks, not substitutes for routine hardening.
Maintain a vulnerability-aware operating routine
Track advisories and release changes
Subscribe to WordPress and component-publisher security notices, review update reports, and keep an inventory that records when each package changed. Recheck current advisories immediately before publishing or approving a remediation because affected ranges and fixed releases can change.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesUnderstand directory review limits
WordPress.org describes automated security review and a release cooldown for directory plugins. That process is useful screening, not a guarantee that a release contains no vulnerabilities. Continue to evaluate maintenance activity, permissions, changelogs, and advisories for every extension.
Report suspected defects responsibly
Do not post working exploit details publicly while a vulnerable component remains widely deployed. Use the WordPress or component publisher’s private security-reporting route, include the exact version and reproducible evidence, and coordinate disclosure and a fixed release where possible.
Quick Recap
A practical hardening sequence
- Inventory: core, active and inactive extensions, themes, PHP, web server, hosting, routes, accounts, and backups.
- Match: compare exact versions with the current advisory or CVE record that prompted the work.
- Remediate: update through a trusted source, or deactivate and delete software that is unnecessary.
- Contain: if an update must wait, restrict the affected route or public access with a narrowly tested WAF or edge rule.
- Reduce write paths: apply host-appropriate ownership and permissions, avoid
777, and disable dashboard file editing. - Review routes: preserve required REST API and integration functions while enforcing authentication or rate limits where compatible.
- Protect accounts: unique passwords, administrator MFA, least privilege, and login-path throttling.
- Verify recovery: keep protected database and file backups, then perform a test restore.
- Monitor: retain logs, watch file changes, and escalate suspicious activity as incident response.
- Repeat: track advisories, update records, and remove extensions that no longer have a maintained purpose.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
