In April, I wrote here about the fresh look for the WordPress Security Checklist. Since then, the project has gained two updates that matter much more to me than a new design: its own GitHub organization and a skill for AI agents.
A home of its own on GitHub
Since 2015, the WordPress Security Checklist lived on my personal GitHub account. Now it has its own home: the WP-Security-Checklist organization. The website’s code is at WP-Security-Checklist/website.
I made this change because I felt that the project is becoming bigger than me. It’s available in four languages, it has been cited in a cybersecurity manual, and it receives contributions from people in the community. It no longer made sense for everything to depend on a personal account.
An organization makes it easier to:
- Invite other people to maintain the project, so it doesn’t depend on me alone.
- Keep related projects together, like the skill I’ll introduce in a moment.
- Make it clear that the checklist belongs to the community, not to a single person.
If you had a link to the old repository, don’t worry: GitHub automatically redirects it to the new address.
A skill for AI agents
The second update was born at the WordPress São Paulo community’s security meetup, which took place just a few hours ago. During a quick chat, Gabriel Cano, who has been talking a lot about using AI agents in WordPress development, suggested turning the checklist into a skill. I liked the idea so much that I opened an issue right away, and it’s now available at WP-Security-Checklist/skill.
An Agent Skill is a package of instructions that teaches an AI agent, such as Claude Code, Codex, or Gemini, to do a specific task. Here, the task is applying the WordPress Security Checklist to your site.
Two modes: audit and guide
In audit mode, the agent inspects a WordPress install through its files, WP-CLI, and optionally a public URL you are authorized to test. Each checklist item gets a status (pass, fail, review, unknown, or manual), with the evidence it found and a suggested fix. The report starts with the most urgent problems.
In guide mode, the agent explains the items and walks you through hardening your site in English, Portuguese, Spanish, or Japanese, with links to the checklist in your language.
Safe to use in production
Since this is about security, the skill was designed not to cause problems on your site:
- Read-only by default. The agent offers fixes after the report and applies them only when you ask.
- Non-intrusive. It only sends ordinary
GETandHEADrequests, and never attempts logins, brute force, exploits, or port scans. - No secrets in the report. Passwords, keys, and salts are described (for example, “set, 64 characters”), never printed. Email addresses are masked.
- Resistant to prompt injection. Everything the agent inspects is treated as data. Text in a file that tries to give the agent orders is ignored and reported as a sign of tampering.
- Flags compromises. Signs that the site was hacked go at the top of the report. Suspicious files are never opened, run, or deleted.
How to install
In any compatible agent (Claude Code, Codex, Cursor, and others), with Node.js installed:
npx skills add WP-Security-Checklist/skill
In Claude Code, you can also install it as a plugin:
/plugin install wpsc --marketplace WP-Security-Checklist/skill
The repository’s README has other options, including one that needs neither Node.js nor git.
How to use it
Once it’s installed, just ask your agent in plain language. For example:
- “Audit this WordPress site against the security checklist.”
- “Check https://example.com for the checklist items you can verify remotely. I own the site.”
- “What does the XML-RPC item mean, and should I disable it?”
Or use /wordpress-security-checklist followed by your action or prompt.
Always in sync with the website
The checklist still has a single source: the website repository. The list of items the skill uses is generated automatically from it, and a sync script fails if a new item lacks instructions for checking and fixing it. That way, the website and the skill don’t drift apart.
How to contribute
The project is still free and open source, and now there’s more room for anyone who wants to take part:
- Wording suggestions, new items, and translations go to the website repository.
- Improvements to the skill’s audit logic or safety rules go to the skill repository.
Thanks to Gabriel for the suggestion, and to everyone in the WordPress Brazil community who has used and shared this project over the years.
If you try the skill on your site, let me know how it went, or open an issue and I’ll take a look.
