The default readme.html file in the WordPress root is often publicly reachable and can show which WordPress version you run. Attackers use that signal when mapping known exploits. There are other ways to fingerprint WordPress, but removing or blocking this file is still a worthwhile hardening step.
Security Ninja’s security tests include a check for whether readme.html is accessible over HTTP on the default location.
Check if it is public
Open https://yoursite.com/readme.html. If you see the WordPress readme page, the file is publicly reachable. That is what the security test flags.
Fix manually
- Connect via FTP or your host’s file manager.
- In the WordPress root (same folder as
wp-config.php), deletereadme.html. - Optionally delete
license.txtthe same way if you do not need it publicly.
You can also deny HTTP access with server rules (for example .htaccess), but deleting the file is simpler.
Note: The Pro Remove unwanted files daily cleanup targets backup and leftover files such as wp-config.php backup names and *.sql. It does not replace deleting readme.html yourself. See Remove unwanted files.
