wordpress

Overview ¶

Package wordpress fingerprints WordPress sites and runs WordPress-specific checks that the generic analyzers do not name. It works in two passes: a passive pass over the crawled HTML (detection, version disclosure, front-end bloat, the default tagline, ugly permalinks, multilingual/WPML configuration, and leaked Advanced Custom Fields markup) and an opt-in active pass that probes well-known endpoints for security and hygiene problems (xmlrpc.php, REST/author user enumeration, directory listing, readme.html).

The multilingual checks deliberately stop at WordPress-specific signals (which plugin is active, whether it emits hreflang at all, and the language-negotiation style); hreflang correctness itself — invalid codes, missing return links, missing x-default — is the dedicated hreflang analyzer's job and is not duplicated here.

Most WordPress fingerprints live in the shared header/footer template, so they repeat on every page. To avoid flooding the report, the passive checks are aggregated across the crawl and emitted once per site (keyed by the site base URL); only ugly permalinks, which are genuinely per-page, fire per page.

The active probes fetch a handful of extra URLs beyond the crawl, like the geo and sitemap analyzers. They are off by default and enabled via WithSecurityProbes (wired to the `specialized` config flag) so the default analyzer stays passive.