How the WordPress check works

This check is part of the extended check, which you unlock by confirming an e-mail address on your site's domain. It runs only when the standard check has already seen that your site is built with WordPress. Like every Scanylo check it only reads what WordPress shows any visitor: it does not log in, does not send anything that changes your site and does not guess file names.

What it reads

• Plugins: for each of the 300 most popular plugins on wordpress.org (a fixed list, updated by hand every few months), one request for the plugin's readme.txt file. That file ships with every plugin, and it says the plugin's version on its Stable tag line. A first, light request (HEAD) asks only whether the file is there; the file itself is read only when it is.
• The user list: one request to /wp-json/wp/v2/users, the part of the WordPress REST API that lists accounts.
• XML-RPC: one request to /xmlrpc.php, an older interface that apps and some plugins use to talk to WordPress.
• The uploads folder: one request to /wp-content/uploads/, to see whether the server shows a list of the files in it.

What it reports

• The plugins it found, with the version each readme names. The versions also go to the vulnerability waves and the published advisories, like any other software version we see.
• A user list anyone can read: the report says how many accounts the list showed. User names and login names are never stored.
• XML-RPC switched on: confirmed when xmlrpc.php answers with WordPress's own message. A refusal without that message can also come from a firewall, so it is marked Potential.
• A file list on the uploads folder: file names are never stored.

What it cannot see

• Plugins outside the list of 300, plugins whose readme.txt was removed or blocked, and premium plugins that are not on wordpress.org.
• Whether a readme's version is the code that actually runs. Most authors keep them the same, but some do not, and a host can patch a plugin without changing its readme.
• Whether XML-RPC is needed. Some plugins, such as Jetpack, and older mobile apps still rely on it.
• What is in your uploads folder, and whether any of it is private. Only you can judge that.

If the request budget runs out before every plugin is checked, the report says how many were left out.

What to do with the result

Keep every plugin listed up to date and remove the ones you no longer use. Ask whoever looks after your site to make the user list visible only to logged-in users, to block xmlrpc.php unless something you use needs it, and to turn off directory listing on the uploads folder.