CMS Security
WordPress REST API Access Check
The WordPress REST API exposes public data. Verify that only necessary information is accessible and learn how to protect sensitive endpoints.
What this test checks
This test checks whether the WordPress REST API is publicly accessible. By default, it exposes information like posts, authors, comments, and sometimes users. If sensitive data is exposed (e.g., email addresses, custom fields), it can facilitate user enumeration or preparation of targeted attacks.
Our recommendation
Protect the REST API using nonces and permissions. Block unauthenticated requests by adding a filter in your theme: 'add_filter('rest_authentication_errors', ...)'. Use a security plugin to restrict access to sensitive endpoints and disable unnecessary ones (e.g., /users). Regularly review the data exposed by your API to avoid leaks.
Security tests
Read more
Form Security