What this checks
- HTTPS: whether plain http visits are sent on to https.
- Security headers: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Guide
- XML-RPC: whether
/xmlrpc.phpanswers, the door for bulk password guessing. Guide - Usernames: whether login names are readable through the REST API or
?author=1. We count them; we never show them. Guide - debug.log: whether the WordPress debug log is readable from the internet. We look at the status only, never the contents.
- Directory listing: whether the uploads folder lists its files.
- WordPress version: whether the exact version is readable from the page or
readme.html.
What it does not check
PHP in the uploads folder, login limits and who can reach wp-admin can only be tested from inside, or by attacking the site. The guides show how to check each on your own server: PHP in uploads, login limits, wp-admin by address.
Seen in your logs?
Requests from this check carry the user agent NivoliEdgeCheck/1.0 with a link to this page. They are ordinary GET requests, a dozen per check, and the result for a domain is reused for ten minutes so nobody can use this page to flood a site.