---
title: Secure or remove readme.html
canonical: https://wpsecurityninja.com/docs/security-tests/secure-readme-html/
---
The default `readme.html` file in the WordPress root is often publicly reachable and can show which WordPress version you run. Attackers use that signal when mapping known exploits. There are other ways to fingerprint WordPress, but removing or blocking this file is still a worthwhile hardening step.

Security Ninja’s [security tests](https://wpsecurityninja.com/docs/security-tests/security-tests/) include a check for whether `readme.html` is accessible over HTTP on the default location.

## Check if it is public

Open `https://yoursite.com/readme.html`. If you see the WordPress readme page, the file is publicly reachable. That is what the security test flags.

## Fix manually

1. Connect via FTP or your host’s file manager.
2. In the WordPress root (same folder as `wp-config.php`), delete `readme.html`.
3. Optionally delete `license.txt` the same way if you do not need it publicly.

You can also deny HTTP access with server rules (for example `.htaccess`), but deleting the file is simpler.

Note: The Pro **Remove unwanted files** daily cleanup targets backup and leftover files such as `wp-config.php` backup names and `*.sql`. It does not replace deleting `readme.html` yourself. See [Remove unwanted files](https://wpsecurityninja.com/docs/security-fixes/remove-unwanted-files/).

## Related

- [Security Tests overview](https://wpsecurityninja.com/docs/security-tests/security-tests/)
- [Hide WordPress version](https://wpsecurityninja.com/docs/security-fixes/hide-wp-version/)
- [Remove unwanted files](https://wpsecurityninja.com/docs/security-fixes/remove-unwanted-files/)