WordPress Exposure Scanner
Detects exposed WordPress version, accessible readme.html and user enumeration via the wp-json API.
What it checks
This scanner checks whether your WordPress exposes its version number, whether the readme.html file is accessible, and whether users can be enumerated through the wp-json API. It detects these information leaks typical of WordPress installs.
Why it matters
Knowing the exact WordPress version lets an attacker look up known vulnerabilities for that specific version. A list of usernames also does half the work for them when trying to guess passwords and break into your admin panel.
How to fix it
Keep WordPress and its plugins fully updated, remove or block access to readme.html, and hide the version number. You can use a security plugin or server rules to disable user enumeration via wp-json and to limit login attempts.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free