12 checks. Every hole.

Checks whether the site serves a valid TLS certificate and redirects HTTP to HTTPS.

→ Install a valid TLS cert and force HTTPS site-wide.

Looks for the Strict-Transport-Security header and a sensible max-age.

→ Send HSTS with a long max-age and preload.

Checks for clickjacking protection via X-Frame-Options or CSP frame-ancestors.

→ Add clickjacking protection headers.

Checks whether xmlrpc.php is enabled and responding.

→ Disable XML-RPC or restrict it to trusted IPs.

Checks whether directory listing is enabled on /wp-content/uploads.

→ Disable autoindex on /wp-content/uploads.

Checks whether wp-login.php is exposed without brute-force protection.

→ Add rate limiting / 2FA on wp-login.php.

Looks for leaked wp-config.php backup files (.bak, .old, .txt).

→ Remove .bak/.old copies of wp-config from the web root.

Detects WordPress core version disclosure through generator meta tags.

→ Remove generator meta tags and block /readme.html.

Probes whether /readme.html is publicly reachable.

→ Delete readme.html from the web root.

Detects user enumeration via the WP REST API (/wp-json/wp/v2/users).

→ Restrict or disable user enumeration via REST.

Detects PHP version disclosure via the X-Powered-By response header.

→ Hide X-Powered-By and keep PHP patched.

Fingerprints plugin versions from enqueued assets to spot outdated or vulnerable plugins.

→ Audit and update all plugins; remove unused ones.