# WordPress Security Review — Respira Skills > Run the Respira security audit, read its indicators, coverage and known vulnerabilities honestly, and fix what it finds one approved update at a time. Never calls a site clean when a check did not run Source: https://www.respira.press/skills/wordpress-security-review --- Audit & diagnose # WordPress Security Review Most security checks grade a site on whether a security plugin is installed. This one checks core files, administrators, credentials and known vulnerabilities, and says what it could not see. RP **Respira Core** · maintained skill ·v1.0.1 · MIT [Install this skill ](#install) [ View on GitHub ](https://github.com/respira-press/agent-skills-wordpress/tree/main/skills/wordpress-security-review) 44 sites use it — no ratings yet — avg run time today last run ## About this skill Run the Respira security audit, read its indicators, coverage and known vulnerabilities honestly, and fix what it finds one approved update at a time. Never calls a site clean when a check did not run. **Read-only by default.** Any write operation creates a duplicate first, so the original page stays intact and you have an undo handle. All execution runs through Respira's MCP server with your existing credentials. ## What it does 4 capabilities run in one pass — each one focused on a single failure mode. #### Evidence, not plugin names Core checksums against WordPress.org, every administrator and application password, executable files where they should not be, and compromise indicators, each with a note. #### Known vulnerabilities Installed core, plugin and theme versions matched against the Wordfence vulnerability database, each with the version that fixes it (plugin 9.0 and later). #### Honest coverage A partial scan is reported as partial and an unreachable vulnerability database as not checked. The report never rounds either up to clean. #### Fixes behind approval Plugin, theme and core security updates one at a time, each approval-gated, with a home-page check between steps. Nothing is deleted or revoked without an explicit yes. ## What you'll likely find Real issues this skill has surfaced on real WordPress sites. - A plugin with a known vulnerability whose fix is one update away. - An administrator account created recently that the owner should confirm. - An application password on an administrator account nobody recognises. - An uploads scan that reached its limit, reported as partial rather than clean. ## Trigger phrases Say any of these in your AI agent. The skill recognizes intent — exact wording isn't required. "is my site secure" "check my plugins for known vulnerabilities" "fix the vulnerable plugins" ## What you'll need **Respira for WordPress plugin** installed on the target site, with a valid API key. **An AI agent** that supports Skills + MCP — Claude Code, Codex, Antigravity, or Cursor. **SKILL.md saved** where your agent looks for skills (see install panel above). Community feedback ## What people say Rate this skill and share what worked (or what needs to improve). Community rating — / 5 0 ratings [See reviews](#ratings-wordpress-security-review) 5★0 4★0 3★0 2★0 1★0 ### Community Ratings Sort Showing: Most helpful No ratings yet. Be the first to leave one. ## Related skills Other skills in audit & diagnose. [ Audit & diagnose WordPress Site DNA Archaeological analysis of WordPress sites. Detects all page builders, audits plugins (active vs dead weight), maps content structure, finds orphaned shortcodes, measures performance, and assesses sec ](https://www.respira.press/skills/wordpress-site-dna)[ Audit & diagnose Technical Debt Audit Identifies technical debt in WordPress sites — orphaned shortcodes from deleted plugins, unused plugins, database bloat, unused media, builder data from inactive builders. ](https://www.respira.press/skills/technical-debt-audit)[ Audit & diagnose WooCommerce Health Check WooCommerce configuration diagnostics — identifies checkout problems, cart errors, AJAX mismatches, caching issues, payment gateway setup, SSL enforcement. Revenue-impacting diagnostics. ](https://www.respira.press/skills/woocommerce-health-check) ## One agent. Many skills. Browse the full catalog or build your own — the bar is low and the standards are real. [Browse all skills ](https://www.respira.press/skills#skills-grid) [Contribute on GitHub ](https://github.com/respira-press/agent-skills-wordpress)