What this tool checks
Three specific pieces of WordPress's REST API surface, each independent of the others: whether /wp-json/ itself responds with a discoverable route/namespace listing, whether /wp-json/wp/v2/media returns the media library without requiring authentication, and whether the ?rest_route=/wp/v2/users query-string form is reachable even when a security plugin might be blocking the equivalent pretty-URL path.
Why the ?rest_route= check exists
Many WordPress security plugins block REST API access by pattern-matching the /wp-json/ URL prefix — a reasonable approach, except that WordPress core also accepts the exact same requests through /?rest_route=/... as a query string, a legacy fallback for servers without pretty permalinks enabled. A plugin that only blocks the pretty-URL form leaves this second door wide open, and this check specifically verifies whether that's the case.
What this tool doesn't check
This is not a replacement for our dedicated user enumeration tool, which targets the specific case of username leakage through /wp-json/wp/v2/users and author archives — this tool intentionally covers different endpoints to avoid duplicating that check.