Exposed Files
phpinfo.php / info.php
113,650
debug.log
6,718
error_log
1,868
install.php
1,845
Directory Listing
10,055
XML-RPC Enabled
13,140
User Enumeration
2,875,650
Security Headers
7,472,588 sites scanned for security headers
Grade A (All headers)
127,441
Grade B (1 missing)
186,668
Grade C (2 missing)
274,024
Grade D (3-4 missing)
714,729
Grade F (5-6 missing)
6,169,620
Missing Headers Breakdown
Strict-Transport-Security (HSTS)
5,891,590
Content-Security-Policy (CSP)
6,990,051
X-Content-Type-Options
6,158,550
X-Frame-Options
6,510,432
Referrer-Policy
6,538,584
Permissions-Policy
6,594,025
Leakiest popular components
Among the most-used themes, plugins, and TLDs, ranked by how often they leak usernames.
Theme: cocoon-master
77.5% leak
Plugin: bluehost-wordpress-plugin
57.2% leak
TLD: .jp
51.9% leak
Security of the most popular components
How the most-used themes, plugins, and TLDs score on our checks. Percentages are coloured against the all-WordPress average — green beats it, red is worse. Click any column header to sort.
Themes
| # | Theme | Sites | Fail headers | Leak usernames | Exposed files | HTTPS |
|---|---|---|---|---|---|---|
| 1 | hello-elementor | 608,556 | 83.6% | 40% | 1.4% | 96.3% |
| 2 | Divi | 482,696 | 82.9% | 38.4% | 2% | 96% |
| 3 | astra | 401,661 | 83.8% | 42% | 1.5% | 95.4% |
| 4 | flatsome | 145,550 | 72.5% | 36.8% | 1.1% | 97.4% |
| 5 | Avada | 118,310 | 84.7% | 35% | 2.6% | 95.8% |
| 6 | generatepress | 112,129 | 80% | 40.8% | 1.6% | 97.1% |
| 7 | pub | 95,473 | 97.3% | 0.1% | 0% | 95.9% |
| 8 | oceanwp | 77,943 | 88.5% | 46% | 1.5% | 95.3% |
| 9 | kadence | 77,606 | 77.3% | 40.2% | 1.2% | 96.8% |
| 10 | enfold | 66,888 | 85.4% | 36.1% | 2.3% | 95.9% |
| 11 | salient | 63,283 | 82.2% | 37.5% | 1.9% | 96.5% |
| 12 | twentyseventeen | 52,927 | 92.4% | 56.9% | 2.1% | 95.3% |
| 13 | bb-theme | 51,751 | 76.4% | 33.3% | 1% | 94.5% |
| 14 | twentytwentyfour | 51,652 | 75.3% | 48.3% | 1.1% | 97.4% |
| 15 | betheme | 51,422 | 86.9% | 41.4% | 2.5% | 96.1% |
| 16 | cocoon-master | 49,893 | 97.4% | 77.5% | 0.2% | 98% |
| 17 | blocksy | 49,659 | 75.1% | 42.3% | 1.3% | 96.7% |
| 18 | h4 | 48,019 | 95.3% | 0% | 0% | 96.1% |
| 19 | twentytwentyfive | 45,724 | 85.4% | 52.7% | 1.4% | 96.8% |
| 20 | woodmart | 44,952 | 87.7% | 29.2% | 3.6% | 92.9% |
| 21 | dt-the7 | 44,411 | 85.3% | 35.7% | 2.6% | 95.9% |
| 22 | neve | 37,014 | 86.2% | 46.3% | 1.6% | 95.7% |
| 23 | Avada-Child-Theme | 36,411 | 82.2% | 31.2% | 1.9% | 96.1% |
| 24 | gox | 35,879 | 99.9% | 0% | 0% | 98.3% |
| 25 | lightning | 30,794 | 97.1% | 63.2% | 0.3% | 96.3% |
| 26 | bridge | 30,302 | 88% | 36.4% | 2.5% | 95.6% |
| 27 | twentytwentyone | 29,361 | 86.7% | 49% | 1.8% | 96.5% |
| 28 | swell | 29,192 | 90.3% | 63.4% | 0.3% | 98% |
| 29 | twentytwenty | 27,978 | 87.9% | 48.1% | 2.1% | 96.1% |
| 30 | bricks | 26,806 | 68.8% | 38% | 0.9% | 97.5% |
Plugins
| # | Plugin | Sites | Fail headers | Leak usernames | Exposed files | HTTPS |
|---|---|---|---|---|---|---|
| 1 | elementor | 1,726,781 | 84.2% | 40.4% | 1.7% | 95.7% |
| 2 | contact-form-7 | 1,719,174 | 87.7% | 43.6% | 2.2% | 95.9% |
| 3 | elementor-pro | 1,028,637 | 82.4% | 36.9% | 1.7% | 95.9% |
| 4 | woocommerce | 797,639 | 84.1% | 35.9% | 2.6% | 94.7% |
| 5 | revslider | 591,086 | 86.7% | 38.4% | 2.6% | 95.4% |
| 6 | jetpack | 429,281 | 86.6% | 56.3% | 1.4% | 95.7% |
| 7 | js_composer | 407,766 | 86.5% | 37.7% | 2.9% | 95.7% |
| 8 | wp-rocket | 325,427 | 76.6% | 24.9% | 2.1% | 97.1% |
| 9 | essential-addons-for-elementor-lite | 256,999 | 83.1% | 36.1% | 1.7% | 95.1% |
| 10 | gravityforms | 252,170 | 71.2% | 22.2% | 1.4% | 96.9% |
| 11 | google-site-kit | 252,413 | 80.3% | 38.1% | 1.9% | 96.2% |
| 12 | complianz-gdpr | 251,796 | 83.9% | 32.9% | 1.9% | 95.9% |
| 13 | cookie-law-info | 223,029 | 82.5% | 35.8% | 2.1% | 96.2% |
| 14 | instagram-feed | 219,540 | 85.8% | 42.2% | 1.9% | 95.6% |
| 15 | sitepress-multilingual-cms | 206,324 | 75.8% | 27.3% | 2.5% | 96.1% |
| 16 | header-footer-elementor | 200,031 | 86.9% | 43.6% | 1.6% | 94.8% |
| 17 | google-analytics-for-wordpress | 198,801 | 82.2% | 37.9% | 2.1% | 95.7% |
| 18 | bluehost-wordpress-plugin | 189,382 | 96.7% | 57.2% | 0.1% | 92.6% |
| 19 | elementskit-lite | 173,800 | 85% | 40% | 1.6% | 95.1% |
| 20 | gutenberg | 157,067 | 86.4% | 56.9% | 0.3% | 98.1% |
| 21 | litespeed-cache | 145,373 | 71.9% | 32.8% | 1.8% | 96.9% |
| 22 | cookie-notice | 144,359 | 86.1% | 39.7% | 2.2% | 96% |
| 23 | gutenberg-core | 138,066 | 99.6% | 0% | 0% | 95.9% |
| 24 | gtranslate | 120,727 | 83.2% | 37.7% | 2.1% | 95.9% |
| 25 | the-events-calendar | 120,201 | 80.9% | 34.9% | 2% | 94.7% |
| 26 | wpforms-lite | 118,203 | 82.2% | 44% | 1.7% | 95.1% |
| 27 | astra-sites | 108,509 | 87.8% | 49.3% | 1% | 94% |
| 28 | popup-maker | 106,697 | 79% | 30.2% | 2.2% | 96% |
| 29 | woocommerce-payments | 105,058 | 83.7% | 42.9% | 2% | 94.8% |
| 30 | tablepress | 101,204 | 82.1% | 35.7% | 2.4% | 95.6% |
TLDs
| # | TLD | Sites | Fail headers | Leak usernames | Exposed files | HTTPS |
|---|---|---|---|---|---|---|
| 1 | .com | 5,309,086 | 83.1% | 38.8% | 1.7% | 96.3% |
| 2 | .org | 259,447 | 80.6% | 36% | 2.2% | 95.7% |
| 3 | .de | 239,682 | 87.5% | 45.5% | 2% | 93.2% |
| 4 | .fr | 149,897 | 79.2% | 38.5% | 1.8% | 95.8% |
| 5 | .net | 109,945 | 81.4% | 38.3% | 2.5% | 95.3% |
| 6 | .nl | 98,372 | 73.7% | 32% | 1.3% | 96.8% |
| 7 | .co.uk | 80,195 | 76.3% | 29.4% | 1.8% | 96% |
| 8 | .pl | 68,852 | 89.6% | 40.6% | 2.7% | 96.9% |
| 9 | .ru | 57,779 | 92.4% | 48.2% | 2.3% | 93.8% |
| 10 | .ca | 48,735 | 78.5% | 31.1% | 2.1% | 96.2% |
| 11 | .jp | 48,155 | 90.1% | 51.9% | 1.6% | 94.1% |
| 12 | .es | 47,985 | 84.8% | 36.6% | 2.2% | 94.5% |
| 13 | .it | 45,095 | 79.3% | 27.1% | 2.5% | 97% |
| 14 | .com.br | 39,593 | 81.3% | 39.2% | 2.5% | 95.3% |
| 15 | .com.au | 37,749 | 74% | 30% | 2% | 95.8% |
| 16 | .ch | 34,573 | 81.8% | 42.7% | 1.4% | 97.9% |
| 17 | .eu | 33,289 | 82% | 38.2% | 2.2% | 95.7% |
| 18 | .cz | 31,761 | 84.4% | 37.6% | 3.6% | 97.1% |
| 19 | .info | 22,307 | 77.4% | 36.9% | 1.7% | 93.4% |
| 20 | .at | 22,256 | 82.9% | 35.5% | 1.9% | 96.9% |
| 21 | .se | 20,179 | 74.6% | 39.7% | 1.7% | 97.6% |
| 22 | .ir | 19,871 | 91.6% | 22.9% | 4.3% | 90.1% |
| 23 | .co.jp | 19,698 | 89.6% | 48.1% | 2.2% | 94.3% |
| 24 | .be | 19,408 | 79.3% | 35.8% | 1.6% | 96.2% |
| 25 | .fi | 19,055 | 64% | 36.1% | 0.9% | 98.2% |
| 26 | .co | 19,038 | 73.7% | 38.6% | 1.6% | 96.8% |
| 27 | .dk | 18,825 | 81.2% | 35.5% | 1.1% | 97.8% |
| 28 | .hu | 17,879 | 84.9% | 34.4% | 2.6% | 95.8% |
| 29 | .io | 16,840 | 59.6% | 33.1% | 0.9% | 98.3% |
| 30 | .sk | 16,054 | 89% | 40.8% | 2.4% | 98.1% |