WordPress sites that publicly leak usernames via the REST API or author archives, making brute-force attacks easier.
/wp-json/wp/v2/users) or the author archive redirect (/?author=1). Knowing a valid username is the first half of a brute-force attack. It can be mitigated with a security plugin or by blocking these endpoints.
| Domain | WP Version | Theme | Headers | Other Issues | Last Scanned |
|---|---|---|---|---|---|
| h*i*i*g*r*w*b*e*i*n.com 🔒 | Unknown | Divi | F | — | Jul 15, 2026 |
| h*i*h*n*.com 🔒 | 6.6.5 | blocksy | F | — | Jul 15, 2026 |
| h*i*h*n*o*-*a*i*.com 🔒 | Unknown | cocoon-master | F | — | Jul 15, 2026 |
| h*i*h*5*.com 🔒 | Unknown | tiny-framework | F | — | Jul 15, 2026 |
| h*i*e*h*m*s.com 🔒 | 6.8.5 | hasta | F | — | Jul 15, 2026 |
| h*i*e*s*a*n.com 🔒 | 7.0.1 | hello-elementor | F | — | Jul 15, 2026 |
| h*i*e*-*a*t*e*.com 🔒 | 7.0.1 | salient | F | — | Jul 15, 2026 |
| h*i*e*-*i*c*e*.com 🔒 | Unknown | Divi | F | — | Jul 15, 2026 |
| h*i*e*g*m*s.com 🔒 | 7.0.1 | astra | F | — | Jul 15, 2026 |
| h*i*e*f*y.com 🔒 | 5.4.19 | vikata | F | — | Jul 15, 2026 |
| h*i*e*b*r*l*e.com 🔒 | 7.0.1 | nisarg | F | — | Jul 15, 2026 |
| h*i*e*b*r*-*r*.com 🔒 | 7.0.1 | colormag | F | — | Jul 15, 2026 |
| h*i*e*u*y*.com 🔒 | Unknown | law_tcd031 | F | — | Jul 15, 2026 |
| h*i*e*u*a*e*l*g.com 🔒 | Unknown | cocoon-master | F | — | Jul 15, 2026 |
| e*f*r*g*y.com 🔒 | Unknown | ecfb | C | — | Jul 15, 2026 |
| c*n*a*t*p*s*r*d*s*e*u*a*i*n*.c*m.mx 🔒 | 7.0.1 | flatsome | F | — | Jul 15, 2026 |
| b*b*.jp 🔒 | 6.2.9 | lightning | F | — | Jul 15, 2026 |
| j*a*c*r*.id 🔒 | Unknown | landingpress-wp | D | — | Jul 15, 2026 |
| m*r*e*t*e*s.com 🔒 | 7.0.1 | markettiers | D | — | Jul 15, 2026 |
| i*e*e*n*t*a*i*e.com 🔒 | 7.0.1 | Unknown | F | — | Jul 15, 2026 |
| r*s*a*c*n*w*c*s*.us 🔒 | Unknown | balaton | F | — | Jul 15, 2026 |
| t*a*s*y.io 🔒 | 6.8.1 | transcyv2 | D | — | Jul 15, 2026 |
| c*r*s*c*v*n*n*r*c.org 🔒 | 7.0.1 | elsie | F | — | Jul 15, 2026 |
| l*d*p*e*.ca 🔒 | Unknown | salient | F | — | Jul 15, 2026 |
| c*a*t*t*u*.eu 🔒 | 7.0.1 | astra | F | — | Jul 15, 2026 |
| p*v*n*s*l*d.com 🔒 | Unknown | Unknown | F | — | Jul 15, 2026 |
| r*d*u*b*r*n*.com 🔒 | Unknown | rno_twentytwentythree | C | — | Jul 15, 2026 |
| r*d*u*v*r*.com 🔒 | 7.0.1 | flatsome | F | — | Jul 15, 2026 |
| r*d*o*a*a*u*a*l*.com 🔒 | Unknown | Unknown | F | — | Jul 15, 2026 |
| r*d*o*a*a*u*.com 🔒 | Unknown | Divi | F | — | Jul 15, 2026 |
| m*t*y*p*r*d*g*.com 🔒 | Unknown | twentyseventeen | F | — | Jul 15, 2026 |
| m*t*y*m*s*e*p*e*e.com 🔒 | 7.0.1 | elegant-pink | F | — | Jul 15, 2026 |
| m*t*y*o*e*t*o*.com 🔒 | Unknown | argent | D | — | Jul 15, 2026 |
| m*t*y*s.com 🔒 | Unknown | pro | F | — | Jul 15, 2026 |
| t*e*c.co 🔒 | 6.5.2 | bongdalu | F | — | Jul 15, 2026 |
| p*i*t*s*r*a*s.com 🔒 | Unknown | astra | F | — | Jul 15, 2026 |
| t*a*o*y*i*t*s.com 🔒 | 6.9.4 | twentyseventeen | F | — | Jul 15, 2026 |
| t*a*o*y*s*i*o.com 🔒 | 7.0.1 | basel | F | — | Jul 15, 2026 |
| t*a*o*t*t.com 🔒 | 5.8 | whitespace | F | — | Jul 15, 2026 |
| t*a*o*p*r*.com 🔒 | 7.0.1 | monolit | F | — | Jul 15, 2026 |
| k*i*o*i*-*o*o*u.com 🔒 | Unknown | Kaigojin | F | — | Jul 15, 2026 |
| k*i*o*r*o*n*n*r*e.com 🔒 | Unknown | MNhybrid_wp | F | — | Jul 15, 2026 |
| k*i*o*o*k*-*.com 🔒 | Unknown | biz-vektor | F | — | Jul 15, 2026 |
| k*i*o*o*o*m*.com 🔒 | Unknown | luxeritas | F | — | Jul 15, 2026 |
| b*o*k*a*d*e*a*.com 🔒 | Unknown | minimog | F | — | Jul 15, 2026 |
| e*r*r*j*x*b*e*a.com 🔒 | 5.5.18 | oceanwp | F | — | Jul 15, 2026 |
| e*r*r*j*x*.com 🔒 | 5.4.19 | oceanwp | F | — | Jul 15, 2026 |
| e*r*r*e*t*l.com 🔒 | 6.5.8 | euroriental | F | — | Jul 15, 2026 |
| e*r*r*.com 🔒 | 5.3.21 | Unknown | D | — | Jul 15, 2026 |
| d*m*s*i*d*i*e*.com 🔒 | 6.9.4 | ashe | F | — | Jul 15, 2026 |