WordPress sites that publicly leak usernames via the REST API or author archives, making brute-force attacks easier.
/wp-json/wp/v2/users) or the author archive redirect (/?author=1). Knowing a valid username is the first half of a brute-force attack. It can be mitigated with a security plugin or by blocking these endpoints.
| Domain | WP Version | Theme | Headers | Other Issues | Last Scanned |
|---|---|---|---|---|---|
| t*r*m*o*e*d*t*.cl 🔒 | 5.7.15 | salient-child | F | — | Jul 28, 2026 |
| b*e*u*e.today 🔒 | 7.0.2 | astra | F | — | Jul 28, 2026 |
| t*t*a*e*e*.com 🔒 | 6.9.5 | hello-elementor | F | — | Jul 28, 2026 |
| t*t*a*h*u*.com 🔒 | Unknown | Divi | F | — | Jul 28, 2026 |
| t*t*a*n*n*4*3.com 🔒 | Unknown | blockbase | F | — | Jul 28, 2026 |
| t*t*a*l*r.com 🔒 | Unknown | Unknown | F | — | Jul 28, 2026 |
| t*t*a*e*a*k.com 🔒 | Unknown | Divi | F | — | Jul 28, 2026 |
| t*t*a*t*r*o*k*.com 🔒 | Unknown | Divi | F | — | Jul 28, 2026 |
| t*t*u*a*.com 🔒 | 7.0.2 | yith-wonder | F | — | Jul 28, 2026 |
| t*t*w*n*s*r*i*e.com 🔒 | 6.1.1 | Avada | F | — | Jul 28, 2026 |
| t*t*o*l.com 🔒 | 4.6.29 | onepress | F | — | Jul 28, 2026 |
| t*t*e*.com 🔒 | Unknown | bb-theme | F | — | Jul 28, 2026 |
| t*t*a*e*.com 🔒 | 7.0.2 | saitama | F | — | Jul 28, 2026 |
| t*t*t*n*r*b*t*c*.com 🔒 | Unknown | startfitter | F | — | Jul 28, 2026 |
| t*t*n*o*a.com 🔒 | 6.6.2 | flatsome | F | — | Jul 28, 2026 |
| t*t*m*d*a.com 🔒 | 7.0.2 | astra | F | — | Jul 28, 2026 |
| t*t*u*d*r*o*l*y*a*l.com 🔒 | 7.0.2 | hello-elementor | F | — | Jul 28, 2026 |
| k*t*c*e*a*i*u*l*a.pl 🔒 | 6.9.5 | loose | F | — | Jul 28, 2026 |
| t*e*a*a*a*k*.com 🔒 | Unknown | Divi | B | — | Jul 28, 2026 |
| t*e*a*a*r*u*.com 🔒 | 7.0.2 | hello-elementor | F | — | Jul 28, 2026 |
| t*e*a*a*o*e*n*n*e.com 🔒 | 7.0.2 | neo-blog | F | — | Jul 28, 2026 |
| t*e*a*a*o*d*s*.com 🔒 | Unknown | astra | F | — | Jul 28, 2026 |
| t*e*a*a*r*m*.com 🔒 | 7.0.2 | Total | F | — | Jul 28, 2026 |
| s*b*i*o*.com 🔒 | 6.9.1 | sway | F | — | Jul 28, 2026 |
| s*b*i*i*y.com 🔒 | 6.9.5 | jupiter | F | — | Jul 28, 2026 |
| s*b*i*f*r*e*a*e.com 🔒 | 7.0.2 | aamira | F | — | Jul 28, 2026 |
| s*b*i*e*a*d*d.com 🔒 | 5.6.17 | twentytwenty | F | — | Jul 28, 2026 |
| s*b*i*e*a*r*l.com 🔒 | 6.7.5 | astra | D | — | Jul 28, 2026 |
| s*b*i*e*w*l*.com 🔒 | 7.0.2 | astra | F | — | Jul 28, 2026 |
| s*b*i*e*f*c*.com 🔒 | Unknown | Avada | F | — | Jul 28, 2026 |
| s*b*i*a*a*p*a.com 🔒 | 7.0.2 | borano | F | — | Jul 28, 2026 |
| k*s*o*a*e*a.pl 🔒 | 6.8.3 | twentyten | F | — | Jul 28, 2026 |
| n*s*t*l*h*b.it 🔒 | 6.9.4 | flatsome | F | — | Jul 28, 2026 |
| f*o*t*o*r.ca 🔒 | Unknown | astra | F | — | Jul 28, 2026 |
| d*s*o*s*a*a*e*i*.de 🔒 | 7.0.2 | astra | F | — | Jul 28, 2026 |
| w*l*e*.events 🔒 | 7.0.2 | hello-theme-child-master | F | — | Jul 28, 2026 |
| s*d.nl 🔒 | Unknown | Divi | B | — | Jul 28, 2026 |
| d*s*i*n*s*t*e*s*n*.fr 🔒 | Unknown | Divi | F | — | Jul 28, 2026 |
| b*k.se 🔒 | Unknown | tazza | F | — | Jul 28, 2026 |
| d*s*a*i*e*e*d*s*i*m*.fr 🔒 | Unknown | Divi | F | — | Jul 28, 2026 |
| a*s*c*a*i*n*p*o*e*.org | 7.0.2 | twentytwentyone | F | — | Jul 28, 2026 |
| e*q*e*b*o*.fr 🔒 | 7.0.2 | oceanwp | F | — | Jul 28, 2026 |
| c*n*o.fr 🔒 | 5.1.22 | patti | F | — | Jul 28, 2026 |
| d*o*e*.bzh 🔒 | 7.0.1 | Avada-Child-Theme | F | — | Jul 28, 2026 |
| c*v*t*s.rs 🔒 | 4.7.5 | enfold | D | — | Jul 28, 2026 |
| s*d.o*g.rs 🔒 | 6.3.2 | astra | F | — | Jul 28, 2026 |
| o*i*i*e*u*a*i*n*l.c*.uk 🔒 | 7.0.2 | wp-bootstrap-starter | D | — | Jul 28, 2026 |
| w*l*b*s*d.eu 🔒 | 7.0.2 | dt-the7 | F | — | Jul 28, 2026 |
| m*n*y*r*k*r*4.com 🔒 | 7.0.2 | mission-news | F | — | Jul 28, 2026 |
| m*n*y*r*n*s*a*p*n*s*.com 🔒 | Unknown | hello-elementor | F | — | Jul 28, 2026 |