CMS Security
WordPress Heartbeat API Check
The Heartbeat API can be exploited for DoS attacks if misconfigured. Learn how to reduce its frequency or disable it to optimise performance and strengthen security.
What this test checks
This test checks whether the Heartbeat API is active on your site. It allows WordPress to execute periodic AJAX requests to sync data (e.g., notifications, post locking). A high frequency can overload the server and be exploited for DoS attacks.
Our recommendation
Reduce Heartbeat frequency by adding a filter in your theme or via a plugin. For example, 'add_filter('heartbeat_settings', ...)' allows custom intervals. If you don't use it, disable it with a plugin like 'Heartbeat Control' or 'WP Disable Heartbeat'. Check performance impact after changes.
Security tests
Read more
CMS Security