WordPress Sites Get Built-In Antivirus and Hardening Protections

TL;DR

HighLevel added an on-demand Antivirus scanning and hardening tool for WordPress sites with one-click fixes.

Review your hosted WordPress sites to run scans and apply protections.

Who this affects

HighLevel has not confirmed which specific plans or sub-account configurations have access to this update. Agencies managing WordPress sites directly inside HighLevel are affected. If you do not host or manage WordPress sites within HighLevel, you can ignore this update.

What changed

HighLevel introduced several antivirus and site hardening capabilities for WordPress:

• Added an Antivirus feature for WordPress sites with on-demand scanning and an Action Required list.

• Added options to apply single fixes, apply all fixes at once, or snooze items until the next scan, for 7 days, or for 30 days.

• Implemented 10 automated security checks covering core and plugin files, unused plugins, HTTPS, WordPress version, server software, error messages, and search visibility.

• Added a confirmation prompt displaying the last backup timestamp and a "Back up first" option prior to applying fixes.

• Introduced 10 hardening protections, including blocking application passwords, hiding the WordPress version, disabling the file editor, disabling XML-RPC, adding security headers, rate-limiting login attempts, and hardening .htaccess.

• Added a Threats column on the WordPress sites list and an option to scan all sites in one click.

HighLevel has not confirmed rollout status, plan gating, limits, or whether this replaces or breaks any existing features.

Where to find it

Navigate to Sites → WordPress in your HighLevel account.

You will find the new Threats column in the WordPress sites list, the option to trigger a one-click scan across all sites, and the Antivirus tool inside individual site management screens.

How agencies will use this

An operator managing client sites inside a sub-account navigates to Sites → WordPress to conduct routine maintenance.

From the WordPress sites list, the operator triggers a one-click scan across all hosted sites and reviews the Threats column to spot flagged installations.

Opening an affected site, the operator reviews the Action Required list to see which of the 10 security checks failed, such as unused plugins, missing HTTPS, or modified core files.

Before applying fixes, the operator views the prompt showing the last backup timestamp and selects "Back up first" to safeguard the installation.

Finally, the operator applies the fixes and turns on the 10 hardening protections to rate-limit login attempts, disable XML-RPC, and harden the .htaccess file.

Our take

This is a major update for agencies hosting WordPress on HighLevel. Built-in security checks for core files, security headers, and brute-force mitigation reduce the need for external security plugins. HighLevel has not confirmed rollout status or pricing limits, but anyone running WordPress sites inside the platform should run a baseline scan this week.