SECURITY FINDING

WordPress scheduled tasks (WP-Cron) disabled

What it is

WordPress's scheduled tasks (WP-Cron) are turned off, so automatic updates, backups and scheduled scans may silently stop running — leaving the site on outdated, vulnerable versions for longer than expected.

How to fix it

Make sure DISABLE_WP_CRON isn't set in wp-config.php, or set up a real system cron job (through your host) to trigger WordPress's scheduled tasks reliably instead.

In depth

WordPress has a system that automatically handles important maintenance tasks like installing security updates, running backups, and checking for problems, but right now those automatic tasks are turned off on your site. This matters because when these tasks don't run, your site can stay vulnerable to security problems for much longer than it should, since security updates won't install themselves and you might not notice something's wrong until it's too late. The problem was likely created when someone added a line of code to your site's configuration file that disabled this automatic system, possibly to improve performance on slower servers. To fix this, you have two straightforward options: either ask your web hosting company to remove that disabling code from your WordPress configuration, or have them set up a "real cron job" through your hosting control panel, which is essentially a scheduled task that tells your site to run its maintenance routine every few hours. Most hosting companies make this easy by providing a simple button or setting in their control panel where you can enable this, and many hosts have this working automatically without you needing to do anything. Getting this working again is important because it keeps your site secure and functioning properly without requiring you to manually trigger updates yourself.

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.