Question 1

Is WordPress secure?

Accepted Answer

WordPress core is reasonably secure when kept updated, but the ecosystem of plugins and themes introduces significant risk. WordPress powers over 40% of the web, making it the most targeted CMS by attackers. The majority of WordPress vulnerabilities come from third-party plugins, which may have SQL injection, cross-site scripting, or remote code execution flaws. Outdated WordPress installations, plugins, and themes are the primary attack vector. Default configurations like the wp-admin login page and XML-RPC endpoint are frequently targeted. UNPWNED scans WordPress sites for known vulnerabilities, exposed admin panels, outdated components, and security misconfigurations.

Question 2

What are common WordPress vulnerabilities?

Accepted Answer

The most common WordPress vulnerabilities include SQL injection and XSS in plugins, exposed wp-config.php files containing database credentials, directory listing enabled on uploads and plugins folders, XML-RPC brute force attacks, user enumeration through the REST API and author archives, outdated plugins with known CVEs, weak admin passwords, file upload vulnerabilities in media handlers, and cross-site request forgery in plugin settings pages. The WordPress REST API can also expose sensitive site information if not properly restricted. UNPWNED checks for all of these vulnerability categories in a single comprehensive scan.

Question 3

How to secure a WordPress site?

Accepted Answer

Keep WordPress core, all plugins, and themes updated to the latest versions. Use strong, unique passwords and enable two-factor authentication for all admin accounts. Install a security plugin that provides firewall, malware scanning, and login protection. Disable XML-RPC if not needed. Restrict the REST API to authenticated users. Change the default wp-admin URL. Set proper file permissions (644 for files, 755 for directories). Add security headers through your hosting configuration or a plugin. Remove unused themes and plugins. Configure regular backups. UNPWNED identifies the specific vulnerabilities in your WordPress site and provides prioritized fix instructions.

Question 4

Does WordPress add security headers?

Accepted Answer

WordPress does not add security headers by default. The default installation sends minimal HTTP headers, missing critical protections like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy. Some security plugins like Wordfence or iThemes Security can add basic headers, but comprehensive CSP configuration usually requires manual setup through your .htaccess file, nginx configuration, or a dedicated headers plugin. Managed WordPress hosts like WP Engine or Kinsta may add some headers at the server level. UNPWNED checks your WordPress site for all recommended security headers.

Question 5

Can WordPress plugins be hacked?

Accepted Answer

WordPress plugins are the leading source of WordPress security breaches. Thousands of plugin vulnerabilities are discovered annually, ranging from minor information disclosure to critical remote code execution. Plugins run with full WordPress privileges, so a single vulnerable plugin can compromise your entire site. Supply chain attacks have occurred where popular plugins were acquired by malicious actors who pushed backdoored updates. Abandoned plugins that no longer receive security patches remain installed on millions of sites. Only use plugins from reputable developers with active maintenance, and remove any plugins you are not actively using. UNPWNED detects known vulnerable plugin versions and exposed plugin files.

Question 6

Does WordPress expose user information?

Accepted Answer

Yes, WordPress exposes user information through several default features. The REST API endpoint /wp-json/wp/v2/users lists all registered users with their usernames, display names, and profile URLs. Author archive pages at /?author=1 reveal usernames through URL redirects. Login error messages differentiate between invalid usernames and wrong passwords, confirming valid accounts. RSS feeds may include author information. This user enumeration helps attackers identify valid admin accounts for brute-force attacks. Disable user enumeration by restricting the REST API, removing author archives, and using generic login error messages. UNPWNED tests for user information exposure.

Question 7

Is WordPress XML-RPC a security risk?

Accepted Answer

Yes, XML-RPC is a significant security risk for WordPress sites. The xmlrpc.php endpoint allows multiple login attempts in a single request through the system.multicall method, enabling efficient brute-force attacks that bypass traditional rate limiting. It can also be exploited for DDoS amplification attacks using the pingback feature. While XML-RPC is needed for certain plugins and the WordPress mobile app, most modern sites can safely disable it in favor of the REST API. Block XML-RPC access through your web server configuration, .htaccess, or a security plugin. UNPWNED checks whether XML-RPC is exposed and accessible on your WordPress site.

Question 8

Does WordPress support rate limiting?

Accepted Answer

WordPress does not include built-in rate limiting. The login page, REST API, XML-RPC, and all other endpoints accept unlimited requests by default. This makes WordPress sites vulnerable to brute-force password attacks, API abuse, and resource exhaustion. You can add rate limiting through security plugins like Wordfence or Limit Login Attempts, web server configuration in nginx or Apache, a CDN like Cloudflare, or custom code using WordPress hooks. Server-level rate limiting is more effective than plugin-based solutions because it blocks requests before they reach PHP. UNPWNED checks whether your WordPress login and API endpoints have rate limiting protection.

Question 9

How to check if my WordPress site is vulnerable?

Accepted Answer

Check that WordPress core, all plugins, and themes are running the latest versions. Look for exposed sensitive files like wp-config.php, debug.log, and database backups. Verify that directory listing is disabled on /wp-content/uploads/ and /wp-content/plugins/. Test whether XML-RPC is accessible and user enumeration is possible through the REST API. Check for security headers in your HTTP responses. Verify that your login page has brute-force protection. UNPWNED automates all of these checks and more, scanning your WordPress site for known CVEs, exposed files, missing security configurations, and common vulnerabilities in a single comprehensive scan.

Question 10

Is WordPress more secure than a headless CMS?

Accepted Answer

Traditional WordPress has a larger attack surface than headless CMS solutions like Sanity, Contentful, or Strapi because it exposes PHP execution, plugin code, theme code, and admin interfaces directly to the internet. Headless CMS platforms separate the content management backend from the frontend, reducing the number of attack vectors. However, headless setups introduce their own risks including API key exposure, missing authentication on API endpoints, and CORS misconfigurations. WordPress with proper hardening can be very secure, but it requires more active security management than managed headless solutions. UNPWNED scans both WordPress and headless CMS deployments for their specific vulnerability profiles.

WordPress Security Questions