IS WORDPRESS SAFE?

Vulnerable plugins are the most common WordPress attack vector. Attackers actively scan for sites running plugins with published CVEs and exploit them within hours of disclosure. A single outdated plugin can compromise your entire site.

The wp-config.php file contains database credentials, authentication keys, and table prefixes. Server misconfigurations can make this file publicly readable, giving attackers everything they need to take over your database.

The XML-RPC interface allows attackers to attempt thousands of login combinations in a single request using the system.multicall method. This bypasses most login rate limiting and lockout plugins entirely.

The WordPress REST API exposes usernames at /wp-json/wp/v2/users by default. Attackers harvest these usernames to build targeted brute force and credential stuffing attacks against your login page.

The /wp-admin panel is accessible to anyone by default with only a password standing between an attacker and full site control. Without two-factor authentication, a single compromised or weak password means total takeover.

Many WordPress plugins build database queries using unsanitized user input. Attackers exploit these injection points to dump your database, steal user data, or inject malicious content into your pages.

What is the biggest security risk for WordPress sites?

Outdated plugins with known vulnerabilities. Over 90% of WordPress hacks exploit vulnerable plugins, not WordPress core. UNPWNED checks known published CVE signals for detected components and public plugin indicators. Paid reports add version-specific remediation guidance for completed findings; UNPWNED does not inspect plugin source code.

Should I disable XML-RPC on WordPress?

Yes, unless you specifically need it for Jetpack or the WordPress mobile app. XML-RPC allows attackers to brute force thousands of passwords in a single request. UNPWNED checks the bounded public XML-RPC path on the submitted WordPress site and reports observed accessibility; it does not perform login attacks.

How do I prevent user enumeration on WordPress?

Block the /wp-json/wp/v2/users endpoint for unauthenticated requests using a security plugin or custom code. Also block ?author=N URL patterns. UNPWNED checks bounded publicly accessible user-enumeration paths and reports observed exposure; it does not perform credential attacks.

Is hiding wp-admin enough to secure WordPress?

No. Security through obscurity is not real protection. Attackers can still find your login page through XML-RPC, REST API, or common redirect patterns. Add 2FA, rate limiting, and a WAF instead. UNPWNED checks bounded externally observable login-path and rate-limit signals; it does not perform credential attacks or prove brute-force protection.

How often should I scan my WordPress site for vulnerabilities?

At minimum after every plugin update and weekly for ongoing monitoring. New plugin CVEs are published daily, and attackers exploit them within hours. UNPWNED paid plans include scheduled outside-in monitoring that alerts when completed findings or supported detected-component CVE signals change.