WordPress readme.html version disclosure means the default readme.html file in your site root is publicly reachable and often shows which WordPress version you run. Attackers use that signal when mapping known exploits. There are other ways to fingerprint WordPress, but removing or blocking this file is still a worthwhile hardening step.
Security Ninja’s free security tests include a check for whether readme.html is accessible over HTTP on the default location.
Check if it is public
Open https://yoursite.com/readme.html. If you see the WordPress readme page, the file is publicly reachable. That is the version disclosure the security test flags.
Fix with Security Ninja Pro
Enable the Remove Unwanted Files fix. It removes readme.html and similar leftover files in one step.
Fix manually (Free)
- Connect via FTP or your host’s file manager.
- In the WordPress root (same folder as
wp-config.php), deletereadme.html. - Optionally delete
license.txtthe same way if you do not need it publicly.
You can also deny HTTP access with server rules (for example .htaccess), but deleting the file is simpler.
