Last updated: 9th July 2026 for CC Security Essentials version 1.0

Introduction

Many security plugins assume that enabling a setting means it is working correctly.

CC Security Essentials takes a different approach.

Where possible, the plugin attempts to verify that your website is actually behaving as expected after a protection has been enabled.

This provides greater confidence that your chosen security settings are active and operating correctly.

Verification is one of the core principles of CC Security Essentials and helps distinguish it from many traditional security plugins.

Why Verification Matters

Changing a setting doesn’t always guarantee the intended result.

Server configuration, hosting environments, caching, third-party plugins or custom code can all affect how a website behaves.

For example, a setting that disables access to a particular feature may appear to be enabled within WordPress, but another component could prevent that change from taking effect.

Verification helps identify situations like these by testing the behaviour of your website rather than simply reporting saved settings.

What Verification Does

Verification performs practical checks against your website where appropriate.

Instead of asking:

“Is this option enabled?”

it asks:

“Is the website actually responding in the expected way?”

This distinction helps ensure that your security configuration reflects the behaviour of your website rather than just the contents of the WordPress database.

Available Verification Tests

The verification tests available depend on the features you have enabled.

Examples include checking that:

XML-RPC requests are being blocked when XML-RPC protection is enabled.
REST API visitor restrictions are operating correctly.
Protected features are responding as expected.

Additional verification tests may be introduced in future versions as new functionality is added.

Understanding Verification Results

Verification results are intended to be clear and easy to understand.

Depending on the outcome of a test, you may see that a protection has been:

Verified – the expected behaviour was confirmed.
Requires Attention – the result wasn’t what was expected and further investigation may be needed.
Not Available – automatic verification isn’t currently possible for that feature.

Where a result requires attention, the plugin provides guidance to help you investigate further.

When Should You Run Verification?

Verification is particularly useful:

after enabling a security feature
after changing security settings
after updating WordPress
after changing your hosting environment
after installing plugins that affect authentication or security
when troubleshooting unexpected behaviour

Running verification regularly provides additional confidence that your website continues to behave as expected.

Verification and Security Health

Verification works alongside Security Health.

Security Health reviews your website’s configuration and highlights recommendations.

Verification confirms that the protections you’ve chosen are actually operating correctly.

Together, they help you move beyond simply enabling settings towards understanding and confirming your website’s security.

When Verification Isn’t Available

Not every security feature can be verified automatically.

Some protections affect internal WordPress behaviour that can’t be safely tested without user interaction, while others depend on circumstances that are difficult to reproduce automatically.

Where automatic verification isn’t possible, the documentation explains alternative methods for confirming that a feature has been configured correctly.

As CC Security Essentials continues to evolve, additional verification tests may be introduced where practical and reliable testing is possible.

Troubleshooting Failed Verification

If a verification test doesn’t produce the expected result, it doesn’t necessarily mean that your website is insecure.

Possible causes include:

server configuration differences
caching
security software provided by your hosting company
another plugin controlling the same functionality
reverse proxies or web application firewalls
custom code within your theme or plugins

If a test repeatedly fails:

Confirm that the relevant protection is enabled.
Clear any website or server caches.
Run the verification again.
Review the Diagnostics page for additional information.
Check whether another plugin provides similar functionality.

Frequently Asked Questions

Does Verification make changes to my website?

No.

Verification is designed to observe and test your website’s behaviour without making permanent changes to its configuration.

Why can’t every feature be verified automatically?

Some security measures don’t lend themselves to automated testing.

Where reliable verification isn’t possible, CC Security Essentials avoids making assumptions and instead explains how you can confirm the behaviour manually.

Should I run Verification regularly?

Yes.

Verification is particularly useful after making changes to your website or updating WordPress, plugins or themes.

Running verification periodically helps ensure that your chosen protections continue to behave as expected.

Does a successful verification mean my website is completely secure?

No.

Verification confirms the behaviour of the protections managed by CC Security Essentials.

Website security also depends on keeping WordPress updated, maintaining plugins and themes, using strong passwords, making regular backups and following good administrative practices.

Verification should be viewed as one part of a broader security strategy.

Best Practice

We recommend incorporating Verification into your regular website maintenance routine.

Whenever you make changes that could affect security:

Apply the configuration change.
Run the relevant verification tests.
Review the results.
Investigate any unexpected behaviour.
Repeat the process after significant WordPress updates.

This simple workflow helps ensure that your security settings continue to provide the protection you expect.

Continue with: