CMS tools
These tools detect and audit popular CMS platforms, starting with WordPress: exact version, exposed files, XML-RPC endpoints, and user enumeration. Useful for checking your own site's exposure or as part of a security audit.
WordPress Exposed Endpoints Scanner
Scan a WordPress site for commonly-exposed REST API endpoints: media library and the ?rest_route= bypass. Free, instant.
WordPressUser Enumeration Scanner
Check whether your WordPress site leaks usernames through /?author=N or the /wp-json/wp/v2/users REST endpoint.
WordPressWordPress Version Detector
Detect whether a site runs WordPress and pinpoint its exact version through the generator tag, readme.html, and common WordPress file paths.
WordPressxmlrpc.php & wp-config Checker
Check whether xmlrpc.php is enabled (a brute-force vector) and whether wp-config.php or a backup leaks its contents, without ever displaying it.
WordPress