WordPress security problems, explained

Finding

Admin email found in a data breach

The email address tied to the WordPress admin account appears in known public data breaches. This does NOT mean the site itself has been ha…

Finding

Broken link on the home page

A link on the home page points to a page that no longer works. Broken links hurt visitor trust and SEO, and — if the URL was reused by some…

Finding

Comments open with no anti-spam protection

Comments are open across the entire site with no anti-spam protection in place — an easy target for spam bots and malicious links, and occa…

Finding

Confirmed executable PHP backdoor in uploads

A PHP file in the uploads folder wasn't just found — it was confirmed to actually run when requested. Since uploads should only ever serve …

Finding

Cookie missing Secure, HttpOnly or SameSite flags

A cookie is missing one or more security flags (Secure, HttpOnly, SameSite). Without them, that cookie can be sent over plain HTTP, read by…

Finding

Cryptomining script injected on the home page

The home page loads a cryptomining script. Visitors' browsers get used to mine cryptocurrency for whoever injected it, without their consen…

Finding

Default 'admin' username (easy to brute-force)

One of the administrator accounts uses a predictable username, such as "admin" or the site's domain name — handing an attacker half of the …

Finding

Directory listing enabled on wp-content/uploads

Directory listing is enabled on wp-content/uploads — anyone can browse the full contents of that folder in a web browser, including files t…

Finding

Disguised malware file (double extension)

A file was found with two extensions, like image.jpg.php — a classic way to disguise malicious code as a harmless picture or document, sinc…

Finding

Executable PHP file hidden in your uploads folder

A PHP file was found inside the uploads folder — a location meant only for images and attachments, never executable code. This is one of th…

Finding

Expired SSL/TLS certificate

The site's SSL/TLS certificate has expired. Every visitor's browser shows a full-page security warning before they can even reach the site …

Finding

Exposed .env file with secrets

A .env file is publicly downloadable. These files commonly hold API keys, database credentials or other secrets for the site or its plugins.

Finding

Exposed WordPress debug.log file

WordPress's debug.log file is publicly downloadable. It can contain file paths, plugin/theme errors and, occasionally, sensitive data from …

Finding

Exposed wp-config.php.bak backup file

A backup copy of wp-config.php (wp-config.php.bak) is publicly downloadable. This file normally contains your database name, username and p…

Finding

Exposed wp-config.php~ editor backup file

An editor backup copy of wp-config.php (wp-config.php~, left behind by some text editors) is publicly downloadable, exposing the same datab…

Finding

Hidden iframe injected on the home page

The home page loads an invisible (zero-size or hidden) iframe from a domain we don't recognize as a common embed/ad/analytics provider. Thi…

Finding

Hidden SEO spam links injected on the page

The home page contains a hidden block of links (positioned off-screen or display:none) — a classic SEO-spam injection technique that shows …

Finding

Injected script or iframe in a WordPress post

A published post or page contains a <script src> or iframe loading code from an external domain. Unless it's an embed, ad or analytics snip…

Finding

Malicious document.write() injection

The home page writes encoded content into itself via document.write — often used to smuggle a malicious script or redirect past a casual lo…

Finding

Malware hidden in WordPress database settings

A suspicious value was found in WordPress's internal settings (the "options" table, loaded on every single page view) — a favorite hiding s…

Finding

Malware or backdoor signature found in a file

The scan found code that matches known malware or webshell signatures — code built to give an attacker remote control of the site, hidden i…

Finding

Missing Content-Security-Policy header

There's no Content-Security-Policy header. This header is an extra layer of defense that limits which scripts, styles and resources a page …

Finding

Missing HSTS header (no forced HTTPS)

Your site doesn't tell browsers to always use a secure (HTTPS) connection. Without this header, a visitor who types the plain http:// addre…

Finding

Missing Permissions-Policy header

Without a Permissions-Policy header, browser features like the camera, microphone or geolocation aren't explicitly restricted at the page l…

Finding

Missing Referrer-Policy header

Without a Referrer-Policy header, the full URL of the page a visitor was on (which can include private details like search terms or an inte…

Finding

Missing X-Content-Type-Options header

Without X-Content-Type-Options: nosniff, some browsers may try to guess a file's type instead of trusting what the server declares — that g…

Finding

Missing X-Frame-Options header (clickjacking risk)

Your site can be loaded inside an invisible frame on someone else's page ("clickjacking") — a common trick to make visitors click a real bu…

Finding

Multiple broken links on the home page

Several more links on the home page also return an error, beyond the ones already listed above.

Finding

No brute-force or login protection on WordPress

No limit on login attempts and no two-factor authentication was detected, so automated bots can try unlimited passwords against the login p…

Finding

Nulled/pirated plugin with a hidden backdoor

This plugin or theme is an unofficial ("nulled") copy of a paid product, altered to include a backdoor that gives an attacker remote access…

Finding

Obfuscated JavaScript injected on the home page

The home page contains obfuscated JavaScript (encoded/decoded at runtime) — a technique legitimate code rarely needs, and a common way malw…

Finding

Public backup file (.zip/.sql) exposed on the server

A backup-looking file (for example a .zip or .sql database export) was found sitting inside the web root, downloadable by anyone who finds …

Finding

Publicly exposed file or information

Our scan found information or a file on this site that's publicly accessible and shouldn't be — this can range from revealing internal deta…

Finding

Self-signed SSL certificate

The certificate isn't signed by a certificate authority browsers trust (self-signed, or issued by an unknown authority), so visitors see a …

Finding

Server or PHP version disclosed in response headers

The server's response headers reveal the exact web server and/or PHP version in use. That's free reconnaissance for an attacker looking for…

Finding

Sign of a compromised WordPress site on the home page

Our scan found a pattern on the home page that's a common sign of a compromised site (injected/obfuscated code, a hidden redirect, spam con…

Finding

Site blocked for visitors in some regions (geo-blocking)

Our scan reached this site normally from some of our network exits but not from others (different regions/continents). This usually means a…

Finding

Spam content injected on the page (SEO spam)

The home page has an unusually high density of spam-associated terms (casino/pharma/betting and similar). On a site that isn't actually abo…

Finding

SSL certificate hostname mismatch

The certificate installed doesn't cover this exact domain. Browsers show a 'your connection is not private' warning before visitors can rea…

Finding

TLS/HTTPS handshake failed

We couldn't establish a secure (HTTPS) connection at all. This is usually an outdated TLS configuration (very old protocol/cipher support o…

Finding

Too many WordPress administrator accounts

This site has more administrator accounts than is typical for its size. Every admin account is a possible way in for an attacker, so the mo…

Finding

Unauthorized redirect via a meta refresh tag

The home page automatically redirects visitors to another URL via a meta refresh tag. If you didn't set this up, it's a common symptom of a…

Finding

Unrecognized external links on the home page

The home page links to external sites we don't recognize. Links to unknown external sites can be perfectly legitimate, but injected spam or…

Finding

Unrecognized new WordPress administrator account

A new administrator account was found that doesn't look like it was part of the site's original setup — a common sign that an attacker who …

Finding

Untrusted or incomplete SSL certificate chain

The certificate chain couldn't be fully validated — an incomplete chain or an unknown intermediate authority. Depending on their browser, s…

Finding

Unverifiable links on the home page

Some links on the home page couldn't be checked (a timeout or connection issue on our end) — this does NOT mean they're broken, only that t…

Finding

Wildcard CORS header (Access-Control-Allow-Origin: *)

Access-Control-Allow-Origin is set to * (any site). This lets ANY other website's JavaScript read responses from this domain in the visitor…

Finding

WordPress login page at the default address

The login page sits at the default address (/wp-login.php or /wp-admin) — the very first URL every automated attack bot tries against every…

Finding

WordPress readme.html exposes your exact version

readme.html is publicly accessible and reveals the exact WordPress version installed. Combined with a known vulnerability for that exact ve…

Finding

WordPress scheduled tasks (WP-Cron) disabled

WordPress's scheduled tasks (WP-Cron) are turned off, so automatic updates, backups and scheduled scans may silently stop running — leaving…

Finding

WordPress scheduled tasks (WP-Cron) stalled

WordPress's scheduled tasks (WP-Cron) are stuck and haven't fired recently, so automatic updates, backups and scheduled scans may not be ru…

Finding

WordPress username enumeration via the REST API

The WordPress REST API publicly lists real usernames. An attacker uses this to build a precise list of accounts to target with password-gue…

Finding

WP_DEBUG left enabled in production

WP_DEBUG is turned on in production. While it's on, WordPress can print full file paths and detailed error messages directly to visitors — …

Finding

xmlrpc.php enabled and publicly reachable

xmlrpc.php is enabled. It's an old WordPress API that's routinely abused for amplified brute-force login attempts (many password guesses hi…