169 automatic configuration checks for WordPress, Joomla, Drupal and PrestaShop
A site with clean core files and updated plugins can still have the file editor on, a downloadable .sql backup or a Super User nobody remembers. The agent reads it from inside, on every sync.
No outside scanner finds configuration problems.
From outside you see the page. Who has admin rights, which settings are on in the CMS and what sits in the site folder can only be seen from inside.
Hardening checklists exist, but going through them by hand on dozens of sites every month isn't realistic. And a checklist done once doesn't tell you what changed afterwards.
How the checks work.
The agent collects
CMS settings, users and roles, database privileges, files in the site folder. Passwords and keys never leave the site.
The platform evaluates
Each check has rules written for that CMS, with guidance on what to do and on which screen.
Priority
Serious problems open an alert with email. The others stay in the dashboard or in the site's checks list.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Will I get pointless alerts on staging?
For each site choose production or staging. On staging, checks that only matter for a public site are skipped. You can also say whether registration is wanted and the API is used, and turn off a single check.
Do you fix the problems?
No. The checks say what is wrong and how to fix it. Configuration changes stay with you, because there is often a reason only the agency knows.
From which agent version?
Joomla from agent 0.17.0, WordPress from 0.18.0, the common checks from 0.19.0, PrestaShop and Drupal from 0.23.0. The agent updates from the dashboard.
Goes well with
- WordPress hardening, checked on every site, every dayFile editor, security keys, debugging, XML-RPC and forgotten tools.
- Hidden Joomla Super Users, and the other accounts to checkAccounts written into the database, known attack signatures, Super Users without MFA.
- Database user privileges: one hacked site shouldn't open the othersMySQL users with global rights, or that can see other databases.
- Security headers on your client sites: HSTS, CSP and the restHSTS, nosniff, framing, CSP, referrer and permissions policy, read from outside.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.