CMS Security
admin-ajax.php Accessibility Check
The admin-ajax.php file is used by WordPress for AJAX requests. Check that it is not accessible without authentication to avoid abuse and data leaks.
What this test checks
This test checks whether admin-ajax.php is accessible and returns a response without authentication. This file is used by WordPress to process AJAX requests (e.g., content loading, form submissions, admin actions). If an attacker can access this file without being authenticated, they can exploit certain unprotected actions, cause data leaks, or execute unauthorised actions on your site.
Our recommendation
Protect admin-ajax.php by systematically checking nonces (security tokens) and user permissions in AJAX actions. Disable unnecessary actions using security plugins (e.g., Disable XML-RPC Ajax). Limit unauthenticated requests by adding conditions in your code (is_user_logged_in()). Use a WAF (Web Application Firewall) to monitor and block suspicious requests to admin-ajax.php.
Security tests
Read more
Header Security