WP & Woo Shield: WordPress and WooCommerce, fixed outside wp-admin

Who it is for

WordPress or WooCommerce sites where order emails, password resets or contact-form mail land in spam or bounce, and where you want hardening that doesn’t add another heavy plugin. Everything works as files you upload or records you paste: no wp-admin activation needed.

What is in the pack

• Email: SPF, staged DMARC (none, then quarantine, then reject) and MTA-STS templates, plus an mu-plugin that sends WordPress mail through authenticated SMTP with an aligned From address.
• Hardening mu-plugin: limits REST API user listing and ?author= scans, and blocks xmlrpc.php multicall abuse.
• Server and edge rules: .htaccess / Nginx snippets (including no PHP execution in uploads) and Cloudflare free-plan WAF expressions.
• Checkout: a WooCommerce checkout script inventory and CSP starting point for PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1 (an aid for your own assessment, not a certification).
• Verify scripts for Bash and PowerShell to re-check the site after changes.

What we measured on UK WordPress hosts

Of 471 .uk domains on managed WordPress hosts we could detect from DNS: 43.1% publish DMARC at p=none and 28.9% publish no DMARC. WooCommerce itself can’t be detected from DNS, so it isn’t counted separately.

Source: FaultyPacket overnight UK scan of public DNS, 29 Oct 2026 22:48 – 30 Oct 2026 00:50 GMT (Tranco list ZJ8PG created 28 Oct 2026, .uk names; managed WordPress hosting detected from DNS). Measured: DMARC and SPF. Percentages are of domains that gave a gradable DNS answer; failed lookups are excluded, never counted as missing. Aggregates only: no domain is named.

Before you change anything

Take a backup, test on a staging copy before going live, and start DMARC at p=none with reports. The pack is a set of diagnostic aids and templates you apply yourself; see the licence file inside.

Related FaultyPacket guides & tools

• WordPress & WooCommerce security flaw finder
• WordPress contact form emails not delivered
• Gmail 550 5.7.26 fix

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.