Target wordpress.org
27 out of 100
- Blast radius
- /100
- Grade
- C
WordPress.org loads slowly and advertises its own version number like a target. Grade C overall.
Damage assessment
- 01
LCP 6.2 seconds. Visitors have time to brew coffee before the main content arrives.
How to fix this - 02
HSTS max-age set to 3600 seconds. The security window closes every hour, like a bank vault on a timer.
How to fix this - 03
/xmlrpc.php is enabled. The back door is open, painted red, and labelled with a sign.
How to fix this - 04
WordPress 7.2 advertised in page source. Attackers now know exactly which lock to pick.
How to fix this - 05
REST API /wp/v2/users route exposes usernames. The staff directory is public and searchable.
How to fix this - 06
Content Security Policy header missing. No rules govern what scripts can run or where they load from.
How to fix this - 07
Lighthouse performance score 76/100 on mobile. Room for improvement before the site feels fast.
How to fix this
Disable /xmlrpc.php and hide the WordPress version number first. Then raise HSTS max-age to at least 31536000 and add a Content Security Policy header. Performance and user enumeration are secondary.
By category
- Performance
- 68
- SEO
- 100
- Accessibility
- 100
- Security
- 64
- WordPress health
- 11
- Copy & clarity
- 100
Full report
Every finding, ranked, with fixes. $10.
All 13 findings with severity, evidence, why it matters and how to fix it, with WordPress-specific steps where they apply. Plus a checklist in the order to work through it.
$10, one-time, via Stripe. The private link is emailed to you.
Recovery
We can fix it for you
Tell us what you need. A person replies with a quote within one business day.
Share
Scanned Tue, 22 Sep 2026 15:41:23 GMT. Roast written by AI from the scan data. Passive scan: we only read public pages. Is this your site? Remove this roast.