I am trying to use WordPress from Azure marketplace to deploy a web app. I ran a Fortify scan on entire code base (wwwroot) which includes wp-admin, wp-includes, wp-content and other boilerplate php files.

There are various issues found like below: enter image description here

What else can I do for static code analysis to detect code vulnerabilities in WordPress boilerplate code?

  • if you are asking about static analysis, then you can refine the rest of the post to that. No need to talk about all the other things you aren't interested in
    – schroeder
    Commented Jul 9, 2020 at 19:40
  • There are several Fortify Application Security products from Micro Focus. Based on the screenshot you are using Micro Focus Fortify Audit Workbench which you could have mentioned. Commented Jul 10, 2020 at 6:34

2 Answers 2


You should notice that WordPress is a content management system (CMS). Systems like that are designed for modifying web pages. That includes adding and modifying HTML, JavaScript, HTTP redirects etc. – and even working with databases.

Therefore, your whole security scanning approach is flawed: the findings described as security problems are within the normal operation of WordPress. It would be catastrophic if such functions were publicly available, but they are restricted with a password-based login. That's the area of security you should focus on: whether it's adequate for you or not:

  • Do you use strong passwords? Are there password requirements for all users?
  • Would you need multi-factor authentication?
  • Should the administrative areas be restricted to certain IP addresses?
  • Could the content be served as static pages e.g. from a proxy or CDN? That would ultimately limit the access to all dynamic content including the administrative tools.

Furthermore, are you responsible for security auditing open source code made by others, or just the source code of your web application project? Because this is about the WordPress core, according to Wordpress Security:

The WordPress Security Team is made up of approximately 50 experts including lead developers and security researchers — about half are employees of Automattic (makers of WordPress.com, the earliest and largest WordPress hosting platform on the web), and a number work in the web security field. The team consults with well-known and trusted security researchers and hosting companies.

If you have better resources than that, you could find and fix security problems in the WordPress core. Please contribute the findings to the WordPress project and you'd help in securing 63.6% of the web sites in the world. If Micro Focus Fortify Audit Workbench was the ultimate solution for that, it would have already been used.


You want to scan your Wordpress site for problems? There are so many Wordpress plugins, I think every problem in life can be solved with a Wordpress plugin. So this problem should have a plugin to solve it, not?

Try the Wordfence plugin. It can monitor your website. There is a free and paid version, depending on what you need and on how important your data is.

  • Yes. This is a plugin im looking into. Thanks
    – deachyut
    Commented Jul 9, 2020 at 16:18
  • I edited the question to be more specific. Thanks
    – deachyut
    Commented Jul 9, 2020 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .