About TLDWP & WordPress Domain Intelligence

TLDWP is an independent WordPress security and domain research project. We continuously scan the public web to map which domains run WordPress and to surface common, fixable security exposures — missing security headers, leftover diagnostic logs, username leaks, and server misconfigurations. Our goal is simple: help domain owners and agencies find and fix vulnerabilities before they become critical issues.

If you found this page because you noticed our scanner in your server logs, the sections below explain exactly how our scanner operates and how to opt out your domain in under a minute.

Who's Behind TLDWP

CWES-certified

Stefan Ristić

WordPress Security Specialist & Founder of TLDWP

I've spent 15+ years building, hardening, and maintaining WordPress domains. I built TLDWP to make the same high-level security checks I run for agency clients available as an open intelligence database.

LinkedIn Hack The Box Reddit

Prefer to hire through a protected contract? I've worked with clients on Upwork for 15 years — you can inspect my full client history and verified reviews there.

How Our WordPress Domain Scanner Works

We've deliberately designed our scanning infrastructure to be as lightweight and non-intrusive as possible:

• One IP address. All scanning requests originate from a single, dedicated IP: 164.92.212.216. If traffic isn't from that address, it isn't us.
• Public information only. We send standard HTTP requests for pages and files that are publicly reachable — exactly like search engine crawlers or standard web browsers. We never log in, attempt brute-force attacks, or touch non-public endpoints.
• About a dozen requests. A complete audit of a domain requires roughly 10–15 requests: your homepage plus a handful of well-known public file paths.
• Once every ~45 days. We never hammer your server. Each domain in our database is re-audited only about once every 45 days.
• Minimal server impact. The total load is equivalent to a single user clicking around your domain for two minutes every month and a half.

Don't Want Your Domain Scanned?

That's completely fine, and we make opt-outs seamless. Any of the following methods will exclude your domain from future scans:

1. Block our IP. Deny our single scanner address at the server firewall level:

Apache (.htaccess):   Require not ip 164.92.212.216
nginx (server block):  deny 164.92.212.216;
Linux firewall (ufw):  sudo ufw deny from 164.92.212.216

2. Deploy a Web Application Firewall (WAF). Domains protected behind firewalls like Cloudflare, Wordfence, or managed host security suites block our scanner automatically. This is our top recommendation as it protects your domain against malicious automated traffic globally.

3. Request Domain Removal. Submit your domain via our contact form and we will add your domain to our permanent exclusion list.

How We Handle WordPress Domain Data

• We only index and report on publicly observable server data — never private files or admin portal data.
• On all public directory listings, domain names are obfuscated for privacy.
• We strictly honor removal requests and permanently exclude domains that opt out.
• We do not sell domain security datasets. Our research is conducted purely for defensive intelligence and maintenance work.

Why We Map Global WordPress Infrastructure

The vast majority of vulnerabilities we uncover take only a few minutes to fix and were never intentional — an unconfigured HTTP security header, a default setting left enabled, or a debug log forgotten after troubleshooting. We publish aggregate domain infrastructure insights to elevate baseline security standards across the web, while offering white-label hardening and maintenance for agencies and domain owners who prefer automated protection.