WordPress Security Assessment

Map WordPress core, REST, XML-RPC, plugins, themes, authentication boundaries, and adjacent installations before selecting a vulnerability-specific test. WordPress presence, a public route, or a version match is not a finding by itself.

When to Use

• HTML, headers, assets, cookies, or routes identify WordPress.
• /wp-json/, /wp-login.php, /xmlrpc.php, or /wp-content/ is reachable.
• JavaScript or source code references a WordPress backend.
• A staging or subdirectory installation may differ from the main site.

Prerequisites