6 min read
After you install Defender Pro, it will provide recommendations for your website. We discuss the recommendations, and what to do with each.
We discuss the issue types of Defender Pro, and our recommended actions.
By default, a plugin/theme vulnerability could allow a PHP file to get uploaded into your site’s directories and in turn execute harmful scripts that can wreak havoc on your website. Prevent this altogether by disabling direct PHP execution in directories that don’t require it.
Defender Pro can lock down directories that WordPress doesn’t need to protect you from PHP execution attacks. You can also add exceptions for specific files you need to run. Alternatively, you can ignore this tweak if you don’t require it. Either way, you can easily revert these actions at any time.
Defender Pro Action:
Disabling the WordPress file editor prevents anyone with admin access from directly editing theme or plugin files through the dashboard, reducing the risk of malicious code injections or accidental damage. Defender Pro recommends this because, if an attacker gains access to your admin area, they cannot alter PHP files to compromise your site. This setting adds a layer of protection by requiring file changes to be made through secure methods such as FTP or cPanel, helping maintain the integrity and security of your WordPress installation.
Defender Pro Action:
Click on the “DISABLE FILE EDITOR” button.
Preventing information disclosure in WordPress helps protect sensitive details such as version numbers, server types, and plugin data from being publicly visible. Attackers often use this information to identify known vulnerabilities in specific versions of WordPress or plugins, making your site an easier target. By hiding these details, you make it harder for bots and hackers to exploit weaknesses, strengthening your website’s overall security and reducing the risk of targeted attacks.
Defender Pro Action:
Click on the “UPDATE .HTACCESS FILE” button.
The recommended malware scanning settings in Defender Pro include enabling file change detection, plugin file scanning, and known vulnerability scanning, as well as turning on suspicious code detection for deeper checks. You should also schedule weekly scans during low-traffic periods (for example, Sunday at 4 a.m.) to reduce server load. The maximum file size and quarantine options can remain at their default values. These settings ensure Defender Pro performs thorough, regular scans of your core, plugin, and theme files to detect and alert you to any potential threats.
This will come up if you recently added your website to Bing Webmaster Tools, and one of the authentication methods was to upload the BingSiteAuth.xml file to the public_html folder.
Defender Pro Action:
Click on the “IGNORE” button.
Below are the recommended Defender Pro settings.
Complaint:
This directory does not belong to WordPress core
Issue Details
We found this folder in your WordPress file list.
Defender Pro Action:
Try to delete the column if it exists, and the website is not hosted on a cPanel.
Complaint:
No updates have been released by the author in the past 2 years
Issue Details
This plugin hasn’t received an update from its author in the past 2 years and was last tested with WordPress 5.6.16. Its last release was on January 25, 2021. It may no longer be compatible with the current version of WordPress or include the latest security fixes.
Example:
| Plugin Name | WP Maximum Execution Time Exceeded |
| Plugin URL | http://johnniejodelljr.com/wp-aximum-execution-time-exceeded/ |
| Last updated | January 25, 2021 |
| Current Plugin Version | 1.0.3 |
This plugin is active, which could indicate it’s still providing functionality on your site. To safely remove it, deactivate the plugin first—then delete it once you’ve confirmed it’s no longer in use.
Defender Pro Action:
Delete the plugin. It is old.
Each issue type must be analyzed and actioned.
What some of our customers had to say:
We research the Internet, ask LLMs and am part of a skool community called WP Odyssey where we can discuss issues on a case by case basis with industry professionals.
WordFence and Really Simple Security are good alternatives, bit they are paid plugins.
Answer 3
This last updated on 7 Octiber 2025 by u/WebsiteCatalyst.
If you have any questions, try our FAQ.
