Block or remove readme.html first, then use Wordfence or Patchstack to keep the rest of WordPress patched. That tiny file can expose your WordPress version, which gives bots a handy clue. WordPress powers about 43% of all websites, so attackers love easy clues like this [source: W3Techs].
TLDR: readme.html version disclosure is not the end of the world, but it is needless noise. If a bot sees WordPress 6.2 in that file, it can match your site with known bugs faster. In a small agency scan of 50 client sites, you might find 30 with exposed readme.html, and 8 of those could also have outdated plugins. Wordfence is better for broad firewall and malware checks, while Patchstack is sharper for vulnerability alerts and virtual patching.
What is readme.html version disclosure?
WordPress often ships with a file called readme.html.
It sits in the root folder of the site. That means it may be visible at:
https://example.com/readme.html
Open it in a browser, and you may see the WordPress version. That sounds harmless. It is just a version number, right?
Not quite.
Attack bots are lazy little gremlins. They scan huge lists of sites. If they see an exact WordPress version, they can decide what to try next. Old core bug? Try it. Old plugin? Try that too. Public version clues make their work easier.
Is hiding readme.html real security?
Yes, but only a little.
Think of it like closing your curtains. It helps. It does not replace locking the door.
Removing or blocking readme.html is basic hardening. It cuts one simple signal. But attackers can still find clues in other places. They may check:
- HTML source code for generator tags.
- CSS and JavaScript URLs with version strings.
- RSS feeds for WordPress markers.
- REST API output for site details.
- Plugin files that expose their own readme files.
So do not treat this as magic. It is a small win. But small wins stack up.
Wordfence vs Patchstack: the simple version
Wordfence is the big guard at the front gate.
It gives you a firewall, malware scanner, login protection, and security warnings. It is very hands-on. If something strange happens, Wordfence often shouts about it. Sometimes it shouts a lot.
Patchstack is more like a sharp vulnerability radar.
It watches known WordPress core, plugin, and theme issues. It tells you what is risky. It can also add virtual patches for some threats, depending on your plan and setup.
For readme.html specifically, neither tool should be your only fix. You can solve this with a quick file removal or a simple server rule. Then use the tool for the bigger job.
Where Wordfence helps
Wordfence is useful when you want a full security plugin inside WordPress.
It can help you spot exposed files, scan modified core files, and watch for malware. It also blocks many common attack patterns. That matters because version hiding does not stop real attacks by itself.
Wordfence is a good fit if you want:
- A web application firewall inside WordPress.
- Malware scanning for themes, plugins, and core files.
- Login attack protection and rate limiting.
- Clear alerts in the dashboard.
- A free option that is strong enough for many small sites.
The annoying bit? Wordfence can feel heavy on cheap hosting. Honestly, it feels like adding a bouncer who also wants to inspect every chair in the room. On some shared servers, scans can take extra minutes and may hit resource limits.
Still, for many site owners, it is simple. Install it. Configure it. Read the alerts. Fix the obvious stuff.
Where Patchstack helps
Patchstack shines when you care most about known vulnerabilities.
WordPress sites often get hacked through plugins, not the core. A contact form plugin. A slider. A forgotten add-on from 2019. That dusty little plugin can become the front door.
Patchstack tracks vulnerable plugins and themes. It tells you what needs action. Its virtual patching can help reduce risk while you wait for an update or test a fix.
Patchstack is a good fit if you want:
- Fast vulnerability alerts for plugins and themes.
- Virtual patching for known issues.
- Cleaner security workflow for many sites.
- Less focus on malware cleanup and more focus on risk control.
- A strong agency tool for client maintenance.
The irritating part? Patchstack may tell you about risks that still require manual work. You still need to update, test, or replace weak plugins. No tool gets you out of the boring bits. Rude, but true.
So which one is better for readme.html hardening?
For the single issue of readme.html, neither wins by much.
The fix is too simple.
You can remove the file. You can block it. You can automate that in your deployment process. You do not need a giant security suite just to hide one file.
But if we compare the tools around this issue:
- Choose Wordfence if you want scans, firewall rules, login protection, and malware checks.
- Choose Patchstack if you want vulnerability alerts, virtual patches, and cleaner risk tracking.
- Use both carefully only if you know what each one is doing. Too many security layers can slow a site or create confusing alerts.
For most small business sites, Wordfence is easier to understand. For agencies and maintenance teams, Patchstack can be cleaner for tracking risk across many installs.
How to fix readme.html right now
Here are simple options.
Option 1: Delete the file
Use FTP, your hosting file manager, or SSH. Find:
/public_html/readme.html
Delete it.
Done.
Expect it to come back after some core updates. That is the annoying part. Add a reminder to check it after updates.
Option 2: Block it with Apache
If your site uses Apache, add this to .htaccess:
<Files "readme.html">
Require all denied
</Files>This blocks public access to the file.
Option 3: Block it with Nginx
If your server uses Nginx, add:
location = /readme.html {
deny all;
return 403;
}Then reload Nginx.
Option 4: Add it to your maintenance checklist
If you manage many sites, make this boring and repeatable.
- Check
/readme.html. - Check plugin readme files.
- Hide generator tags.
- Update core.
- Update plugins.
- Remove dead themes.
- Test backups.
Boring security is good security. Exciting security usually means someone is crying in Slack.
The best setup for real hardening
Do not stop at version hiding.
A safer WordPress setup includes:
- Automatic core updates for minor releases.
- Fast plugin updates after testing.
- Strong admin passwords and two factor login.
- Limited admin accounts.
- Backups stored offsite.
- A firewall, either at plugin, host, or CDN level.
- Vulnerability monitoring for plugins and themes.
This is where Wordfence and Patchstack make sense.
Wordfence helps block and detect. Patchstack helps warn and patch known risks. They solve different pain points.
Final verdict
Remove or block readme.html no matter which tool you use. It is quick. It is clean. It gives bots one less hint.
Pick Wordfence if you want an all-in-one guard with a firewall and scanner. Pick Patchstack if your biggest worry is vulnerable plugins and fast risk alerts.
The smartest move is simple. Hide the version, patch the software, reduce plugin clutter, and keep backups ready. Security does not need drama. It needs habits.