REST API Diagnosis

すべての著者のユーザー名を返します — ブルートフォース攻撃のほぼすべてがここから始まります。

Exposes site-level configuration that should only be readable by administrators.

Confirms file upload is locked to authenticated users — otherwise attackers can drop in malware.

Verifies that information about logged-in users is not leaked to anonymous visitors.

Without throttling, a single attacker can hammer your API for password guesses or DoS.

Anonymous comment posting is a common vector for spam and malicious links.

Exposing your active themes and plugins gives attackers an instant CVE shopping list.

Confirms that unpublished drafts cannot be read by anonymous users.

Many plugins ship endpoints with weak permission_callback — we flag the risky ones.

Without a valid nonce, your API can be tricked into accepting CSRF or replay attacks.

Should be off in production — credentials travel base64-encoded with every request.

Some endpoints should require login. We highlight ones still readable by anyone.

A wildcard Access-Control-Allow-Origin lets any external site read your API.

Photos uploaded to your library can leak GPS coordinates and camera serial numbers.

Returned in API discovery responses — making vulnerability scanning trivial.

Can be abused to enumerate post IDs and find content you forgot to set private.

Old drafts of an article can resurface text you thought you had removed.

Plugin-supplied filters sometimes pass user input straight into SQL — we look for the patterns.

他サイトへの投稿埋め込みに使われます。埋め込みを使用しない場合は無効化を推奨します。

Legacy API that is now mainly used by attackers for amplified brute-force.

Whether the REST API is on at all and which prefix it answers on.

Detects whether your homepage advertises the API URL in its HTML head.

Reports whether the per-app token feature (WP 5.6+) is enabled.

Identifies common JWT auth plugins and their version.

Lists every custom post type, taxonomy and plugin namespace that the API exposes.