What this tool does
This checker tests two well-known but distinct WordPress exposure surfaces: xmlrpc.php, a legacy endpoint sometimes abused for attacks, and wp-config.php (along with its common backup variants), the file that normally holds your database login credentials.
xmlrpc.php: useful for some, risky for others
xmlrpc.php lets external applications (WordPress mobile apps, certain plugins) interact with a site without going through the regular web login. The problem: this endpoint's system.multicall method lets an attacker test hundreds of passwords in a single HTTP request, sidestepping the rate limits many sites normally apply to the standard login page. Its pingback method can also be hijacked to send requests toward third-party targets, turning your site into an unwitting accomplice in an amplification attack.
wp-config.php: why it almost never leaks as-is
wp-config.php holds your database login credentials in plain text — the ultimate target for an attacker. On a properly configured server, this file gets executed by PHP before anything is sent to the browser, so a direct request just returns an empty page: the source code never leaves the server. That's why this checker doesn't simply test whether the file "responds" (it almost always does, with empty content) — it specifically checks whether the response contains raw PHP source, a sign the server is serving the file as text instead of executing it.
Backup files: the real risk
The real risk rarely comes from the original file, but from forgotten copies of it: a text editor leaving behind a wp-config.php~ backup, a temporary rename to wp-config.php.old during maintenance that never got cleaned up, or a migration tool's wp-config.php.bak archive left at the site root. These extensions are never recognized as executable PHP by the server — if they exist, their contents are served as-is, credentials included, to anyone who guesses or finds the URL.
A strict policy on detected content
Even when this checker detects a genuine exposure, it never displays, stores, or logs the file's actual contents — only an "exposed" or "not exposed" status for each path it tests. This is a deliberate design choice: a public diagnostic tool should never itself become a way to extract credentials, even with the intent of helping a site owner understand the problem. If this checker flags an exposure, the only appropriate action is to remove or block access to the file immediately.