CMS Security
Access to wp-cron.php Check
The wp-cron.php file is a target for denial‑of‑service (DoS) attacks. Learn how to disable it and replace it with a system cron for enhanced security.
What this test checks
This test checks whether wp-cron.php is publicly accessible. This file executes WordPress scheduled tasks (updates, backups, scheduled posts). If accessible, an attacker can repeatedly request it to saturate your server resources (DoS attack). This vulnerability can significantly slow down or make your site unavailable.
Our recommendation
Disable wp-cron.php by adding 'define('DISABLE_WP_CRON', true);' in your wp-config.php file. Then configure a system cron on your server to execute the WordPress task: '* * * * * wp_cron' or use a service like EasyCron. This reduces server load and eliminates the risk of DoS attacks via wp-cron.php.
Security tests
Read more
CMS Security