Your production WordPress.
Not just the version number.
A fully patched WordPress can still expose REST routes, ACF options, abandoned plugins, sensitive media, and fragile automation flows. This audit looks at the real surface of the CMS, the plugins, and the integrations living around it.
What we verify
REST API and plugin namespaces
Native and custom routes, users, media, ACF endpoints, and plugin paths that open up unexpected surfaces.
Plugins, roles, and back-office surface
Abandoned plugins, exposed admin pages, over-broad role logic, and reliance on historical plugin behavior.
Media, files, and exports
Media library items, PDFs, exports, private documents, and uploaded files reachable by direct URL or enumeration.
Webhooks, forms, and integrations
Automations, CRM flows, forms, payment callbacks, or business workflows attached to the CMS without strong verification.
What we often find
A REST API that says more than expected
Users, options, private content, or business routes exposed without the access level the team assumes exists.
Forgotten plugins and endpoints
Support functions, CSV exports, ACF configuration, AI hooks, or analytics routes accessible publicly.
Media and documents that are still retrievable
Files meant to stay private but reachable by predictable URL or easy enumeration.
Security focused on passwords, not on the surface
The CMS itself is up to date, but the real exposure sits in plugins, roles, routes, and the automation layer around it.
Ideal for
- WordPress sites managing client accounts, premium content, private media, or member areas
- Marketing sites enriched with business plugins, ACF Pro, forms, or CRM integrations
- WooCommerce stores or B2B portals with customer data and internal workflows
- Teams that want to validate the real CMS surface instead of just checking that WordPress is updated
Related reads and pages
WordPress 6.8 and bcrypt
Why a stronger core password primitive still does not secure the whole site surface.
Dangerous WordPress REST API endpoints
The routes to verify immediately on a plugin-heavy WordPress deployment.
API & webhook audit
Very relevant when WordPress also acts as a hub for business APIs or automations.
External Review
The right starting point if you want a quick read on your real external exposure.