About & Transparency

TLDWP is an independent WordPress security project. We continuously scan the public web to map which sites run WordPress and to surface common, fixable security exposures — missing security headers, leftover diagnostic files, username leaks, and the like. Our goal is simple: help site owners find and fix problems before someone with worse intentions does.

If you found this page because you noticed our scanner in your server logs, the next two sections are for you — what we actually do, and how to opt out in about a minute.

How our scanner works

We've deliberately designed our scanning to be as light and unintrusive as possible:

• One IP address. All of our scanning comes from a single, dedicated IP: 164.92.212.216. If it isn't from that address, it isn't us.
• Public information only. We send ordinary HTTP requests for pages and files that are already publicly reachable — exactly what any browser or search engine does. We never log in, never guess passwords, never exploit a vulnerability, and never touch anything that isn't already public.
• About a dozen requests. A complete scan of your site is roughly 10–15 requests: your homepage plus a handful of well-known public paths.
• Once every ~45 days. We don't hammer your server. A given site is re-checked only about once every 45 days.
• Barely a blip. Put together, that's the equivalent of a single visitor browsing your site for a couple of minutes — once every month and a half.

Don't want to be scanned?

That's completely fine, and we make it easy. Any one of these will keep us off your site:

1. Block our IP. The simplest option — deny our single address and we simply can't reach you.

Apache (.htaccess):   Require not ip 164.92.212.216
nginx (server block):  deny 164.92.212.216;
Linux firewall (ufw):  sudo ufw deny from 164.92.212.216

2. Put a firewall in front of your site. Sites behind a web application firewall — Cloudflare, Wordfence, or a managed host like Cloudways — block our scanner automatically. Honestly, this is the option we'd recommend, because it protects you from everyone else too, not just us.

3. Ask us to remove you. Send us your domain via the contact form and we'll exclude it. (A self-service removal tool is on the way.)

How we handle your data

• We only ever report on publicly observable information — nothing private, nothing behind a login.
• On our public listings, domain names are obfuscated, never shown in full.
• We honor removal requests and don't re-add domains that have opted out.
• We don't sell this data, and we never use it to attack anyone. The entire purpose is defensive.

Why we do this

Almost everything we find takes minutes to fix and was never a deliberate choice — a security header nobody added, a default left on, a diagnostic file forgotten after a debugging session. We publish the aggregate picture to raise the baseline for everyone, and we offer hands-on hardening and ongoing maintenance for owners and agencies who'd rather someone just take care of it.