Question WP Toolkit: How does it apply the Security Suggestions?

[hotdog]

Server operating system version

Debian 12

Plesk version and microupdate number

18.0.6.2 #1

1) I imported a WordPress site from another server.
2) I ran the WP Toolkit sync, which added the site to WP Toolkit.
3) I went through WP Toolkit's Security Suggestions, and applied many of them (all of which were "can be reverted later" type).
4) Later, I had to test something unrelated, and I deattached this WordPress site from WP Toolkit.
5) After, I removed the .wp-toolkit-ignore file, and did the WP Toolkit sync again.
6) The WordPress site now appeared in WP Toolkit again, as expected. But all those Security Suggestions that I had applied in 3) were no longer applied, according to the WP Toolkit. So I had to re-apply them.

So this made me think, when you deattach a WordPress site from WP Toolkit, does it then automatically revert those Security Suggestions you had applied before, while the WordPress site was under the care of WP Toolkit? It appears so according to my testing. This is good to know for future, because I thought those Security Suggestions you had applied would stick even if you did deattach a site from WP Toolkit.

 

[Kaspar@Plesk]

Hi, we had a similar question via support recently.

Some security measures require the WP Tookit to be used, such as the bot protection. Which only works when the site attached. Other security measures are applied to files (permission changes) or the Wordpress configuration. For example the "Block access to wp-config.php" and "Disable scripts concatenation for WordPress admin panel" measures.
These aren't reverted on when detaching a Wordpress site.

The status of these measures isn't kept when de site gets detached. So when re-attracting a site and re-scanning the security measures, these masseurs show up as available as a precaution to be applied again (even when these measures al ready applied). Confusion is understandable, I hope that clarifies it a bit.