Security advisorywp2shell: WordPress core vulnerability. Updated August 4, 2026.

Read the advisory

Security tests

Secure or remove readme.html

Why WordPress readme.html leaks version info and how to remove or block it with Security Ninja or manually.

The readme.html file in the WordPress root often reveals which WordPress version you run. That is useful to attackers mapping known exploits. There are other ways to fingerprint WordPress, but removing this file is still worth doing.

Check if it is public

Open https://yoursite.com/readme.html. If you see the WordPress readme page, the file is publicly reachable.

Fix with Security Ninja Pro

Enable the Remove Unwanted Files fix. It removes readme.html and similar leftover files in one step.

Fix manually (Free)

  1. Connect via FTP or your host’s file manager.
  2. In the WordPress root (same folder as wp-config.php), delete readme.html.
  3. Optionally delete license.txt the same way if you do not need it publicly.

You can also deny HTTP access with server rules (for example .htaccess), but deleting the file is simpler.

Still stuck? Get help or contact us.