CMS Security

Joomla REST API Access Check

The Joomla REST API exposes public data. Verify that only necessary information is accessible and learn how to protect sensitive endpoints from unauthorised access.

What this test checks

This test checks whether the Joomla REST API is publicly accessible. By default, it exposes information about articles, categories, users, and site settings. If sensitive data is exposed (e.g., email addresses, custom fields, tokens), it can facilitate user enumeration or preparation of targeted attacks, compromising your site's confidentiality.

Our recommendation

Protect the REST API by using strict permissions in components and modules. Limit access to sensitive endpoints by restricting permissions via Joomla settings. Use security extensions to block unauthenticated requests and disable unnecessary endpoints. Regularly review the data exposed by your API to avoid leaks.

Security tests

View all tests

CMS Security

Joomla REST API Access Check

What this test checks

Our recommendation

Read more

Magento Admin Access Check

CAPTCHA Presence on Admin Page Check

Shopify HTTPS Redirect Check

Shopify Version Check

Shopify Environment Information Exposure Check

Joomla Admin Access Check

Shopify Admin CAPTCHA Protection Check

X-Content-Type-Options: nosniff Header Check

Shopify Admin Access Restriction Check

Drupal Backup File Exposure Check

Shopify CSRF Protection Check

Database Administration Tools Access Check

WordPress Backup File Exposure Check

Cookie Consent Banner Presence Check

Cross-Origin-Resource-Policy Header Check

CNIL Mention in Privacy Policy Check

Database Backup File Exposure Check

Shopify Storefront API Exposure Check

CAPTCHA Presence on Client Login Page Check

Drupal Log File Exposure Check

admin-ajax.php Accessibility Check

Configuration File Exposure Check

Shopify File Upload Security Check

Malicious File Presence Check in Upload Folders

Magento Git File Exposure Check

Shopify Sensitive File Exposure Check

Shopify Permissions-Policy Header Check

Known CVE Vulnerability Check on Used Technologies

PHP Error Display on Drupal Check

PHP Error Display on Joomla Check

HSTS Header Check (HTTP Strict Transport Security)

Server Status Pages Access Check

PrestaShop Log File Exposure Check

CORS Configuration Check (Access-Control-Allow-Origin)

Upload Folder Protection Check (.htaccess, index.html files)

Shopify SSL/TLS Configuration Check

WordPress Theme Editor Access Check

WordPress Admin Access Check

wp-config.php File Access Check

Joomla Log File Exposure Check

Development File Exposure Check

Content-Security-Policy Header Check

Plaintext Password Exposure Check

Magento env.php File Access Check

Authentication File Exposure Check (.htpasswd, .user.ini)

Shopify Upload Folder Security Check

Shopify API Key Exposure Check

Drupal Version Check

Joomla Backup File Exposure Check

Magento Version Check

Upload Folder Indexing Check

Shopify X-Frame-Options Header Check

Email Address Exposure Check

CAPTCHA Presence on Password Reset Form Check

Drupal Admin Access Check

PHP Error Display in Production Check

robots.txt File Check

Shopify Terms and Conditions (T&C) Presence Check

WordPress Debug Log Exposure Check

xmlrpc.php Access Check

Cross-Origin-Opener-Policy Header Check

Directory Indexing Check

WordPress Login Page Access Check (wp-login.php)

PrestaShop Admin Access Restriction Check

Drupal Upload Folder Indexing Check (sites/default/files/)

Index File Presence in Upload Folders Check

X-Frame-Options Header Check

Drupal Admin Access Restriction Check

CAPTCHA Presence on Contact Form Check

PHP Error Display on PrestaShop Check

Shopify REST API Exposure Check

Joomla Version Check

Information Leak via HTTP Headers Check

Joomla Temporary Folder (/tmp/) Access Check

PHP Error Display on WordPress Check

Shopify Registration CAPTCHA Protection Check