Question 1

What does the WordPress security audit check?

Accepted Answer

It checks the public, unauthenticated things attackers look at first: whether your admin usernames are exposed via the REST API or author archives, whether XML-RPC is open to brute-force abuse, whether directory listing or the default readme are exposed, how current your WordPress core is, which plugins and themes you're running, and whether your security headers are in place.

Question 2

Why do I have to enter an email to see the full report?

Accepted Answer

The detailed findings would help an attacker, so we don't show them publicly. To prove you're part of the organisation, we ask for an email on the same domain as the site and send the full report there. The quick headline (is it WordPress, roughly how many issues) is shown without an email.

Question 3

Is this safe to run, and is it legal?

Accepted Answer

Yes. The audit only requests pages your site already serves to every visitor — it never logs in, submits forms, or attempts to exploit anything. It's the same passive reconnaissance a security professional starts with, and because the report only goes to a verified address on your domain, it can't be used to snoop on sites you're not part of.

Question 4

My email isn’t on the same domain as my website — what then?

Accepted Answer

Some businesses use a different domain for email (or a generic mailbox). If your address isn't on the site's domain we can't auto-verify you, so just get in touch and we'll run the audit and walk you through it directly.

Question 5

Why is WordPress such a common target?

Accepted Answer

WordPress powers a huge share of the web, so it's worth attackers' time to automate attacks against it at scale. The platform itself is reasonably secure — most break-ins come through out-of-date plugins, weak or reused passwords, and exposed login details. Keeping it patched and hardened is where the real protection is.

WordPress security audit.

Enter your site to scan it for common WordPress risks.

The WordPress mistakes attackers count on.

Exposed usernames

Open XML-RPC

Out-of-date core & plugins

Your WordPress audit, explained.

Let's talk.
We'll be straight.