GOMAX ULTIMATE 5.45.0 adds a built-in security scorecard that checks your live security response headers and your WordPress hardening posture, returns a 0-100 score with a fix for every finding, and can add the recommended security headers to your whole site in one reversible step — all from inside your own install, with no external scanner. It's the security pillar of GOMAX's site-health suite, alongside the accessibility, performance, link and database tools.
Security advice for WordPress is scattered across dozens of blog posts, and most "scanners" send your URL to a third-party service. GOMAX instead reads your own site's headers and environment locally, tells you exactly what's weak, and — for the header issues — fixes it with a toggle you can turn off just as easily.
Key takeaways
Header checks. It verifies HTTPS, HSTS, X-Frame-Options (clickjacking), X-Content-Type-Options (MIME-sniffing), Referrer-Policy, Permissions-Policy, Content-Security-Policy and version disclosure.
Hardening checks. It flags an enabled file editor, WP_DEBUG left on in production, exposed XML-RPC, a public REST users endpoint, author/username enumeration, an account literally named "admin", and the default wp_ table prefix.
A score you can track. Every scan returns a 0-100 score and grade with issues ranked by severity, and history so you can watch it improve.
One-step, reversible fix. Turn on GOMAX security headers and the recommended headers are sent site-wide; turn it off and they're gone. No file editing.
Self-hosted. No external security service — the scan and the headers all run on your own server.
What it checks, and why it matters
Security headers are small HTTP response headers that tell browsers how to protect your visitors. Missing them is one of the most common — and most fixable — weaknesses:
X-Frame-Options stops your pages being framed by attackers (clickjacking).
X-Content-Type-Options: nosniff stops browsers guessing file types.
Referrer-Policy and Permissions-Policy limit what leaks to third parties and which browser features run.
HSTS and HTTPS keep the connection encrypted.
Hardening posture covers the WordPress-specific settings attackers probe first: whether the built-in code editor is disabled, whether debug output is exposed in production, whether XML-RPC and the REST users list are open to abuse, whether usernames can be enumerated, and whether obvious defaults (an "admin" user, the wp_ prefix) are still in place.
Fixing the headers in one step
The header findings are the easiest to close, and GOMAX closes them for you. Enable the security-headers setting and GOMAX sends X-Frame-Options, nosniff, a Referrer-Policy and an optional Permissions-Policy on every front-end response — no .htaccess edits, no theme changes. Because it's a setting, it's completely reversible: switch it off and the headers stop. Re-run the scan and you'll see the score jump.
HTTPS and HSTS are deeper changes tied to your certificate and server, so those stay with GOMAX's dedicated HTTPS tools, and the scorecard points you there.
Part of a bigger health picture
Security joins accessibility, performance, broken-link and database tools in GOMAX as a consistent set of scored audits. An AI assistant can run them together and hand you one prioritized to-do list covering speed, accessibility, findability, maintenance and now security — each checked locally, on your own site, with nothing sent to a vendor cloud.
Frequently asked questions
Does the scan send my site to an external service? No. It reads your own site's response headers and WordPress environment locally and scores them on your server. No external security scanner is used and nothing about your site leaves it.
Is turning on security headers risky? The defaults (X-Frame-Options: SAMEORIGIN, nosniff, a standard Referrer-Policy) are safe for the vast majority of sites, and the whole thing is a reversible toggle — if anything looks off, switch it back off and the headers are gone. Permissions-Policy is left empty by default so it can't break embeds until you configure it.
Why doesn't it set HTTPS or HSTS for me? Those depend on your SSL certificate and server configuration, which are riskier to change automatically. The scorecard checks them and points you to GOMAX's dedicated HTTPS tools to enable them safely.
Will it change my usernames or table prefix automatically? No. Findings like an "admin" account or the default wp_ prefix are reported with guidance, but GOMAX doesn't change them automatically because they need care — it tells you what to do and why.
Can it help against brute-force and clickjacking attacks? It reduces common exposure: adding X-Frame-Options blocks clickjacking, and flagging open XML-RPC and username enumeration helps you close two frequent brute-force entry points. Security is layered — this closes several easy gaps, and you should still use strong passwords and keep everything updated.
Top comments (0)