---
title: "WordPress security posture check — PASSIVE hygiene assessment from public signals"
method: GET
path: "/api/wp/assess"
tags: ["Security"]
---

# WordPress security posture check — PASSIVE hygiene assessment from public signals

`GET /api/wp/assess`

## Request

- Base URL: `https://api.webbersites.com`
- URL: `https://api.webbersites.com/api/wp/assess`
- Auth: API key in header `X-PAYMENT`

WordPress security posture check — PASSIVE hygiene assessment from public signals: detects WordPress, flags version disclosure (generator tag, readme.html), xmlrpc.php exposure, user enumeration, uploads directory listing, login exposure, missing security headers, and HTTPS. Returns a 0-100 posture score with prioritized remediation. Flags security practice, not exploitable vulnerabilities — no CVE matching, no intrusion. For site owners and authorized auditors. ?url=

Price: $0.005 per call, paid in USDC via the x402 protocol (see the x402 security scheme).

## Query parameters

- `url` string, required

## Response `200`

Success

- object
  - `is_wordpress` boolean
  - `posture_score` number
  - `grade` string
  - `findings` unknown[]
    - unknown

## Other responses

- `402`: Payment required — the response body lists accepted payment methods (amount, asset, network, pay-to address). Retry the request with a signed X-PAYMENT header.

---

[API](https://skmtc.dev/webbersites/apis/webbersites-x402-data-api.md) · [All operations](https://skmtc.dev/webbersites/apis/webbersites-x402-data-api/llms.txt) · [OpenAPI document](https://skmtc.dev/webbersites/apis/webbersites-x402-data-api/revisions/c14a76c67a94?raw)