# WordPress Security Posture Assessor

> WordPress Security Posture Assessor is a paid API for AI agents from api.webbersites.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-14).

Performs a passive WordPress security hygiene check on a public site URL, returning a 0-100 posture score and prioritized remediation findings.

## Facts

- Endpoint: GET https://api.webbersites.com/api/wp/assess
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/wordpress-security-posture-assessor-d69e0eee
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_laejpMCaGJd4Bv92XGt8l

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability wordpress-security-posture-assessor-d69e0eee
```

Example prompt: Can you run a passive security posture check on my WordPress site at https://myblog.example.com and tell me the score, grade, and what I should fix first?

## When to prefer this

Use this endpoint when you need a quick, passive, read-only WordPress-specific security hygiene assessment from publicly observable signals — especially useful for site owners or authorized auditors who want actionable remediation priorities without running active exploits or CVE scans. Prefer this over generic web security scanners when the target is known to be WordPress and you need a structured posture score.

## Known failure modes

- Non-WordPress site returns is_wordpress: false with limited findings
- Invalid or unreachable URL returns an error response
- Rate limiting or network timeout if target site is slow
- Private/localhost URLs may be rejected for security reasons
- Score may be incomplete if target blocks crawler user agents

## How this service works

WordPress security posture check — PASSIVE hygiene assessment from public signals: detects WordPress, flags version disclosure (generator tag, readme.html), xmlrpc.php exposure, user enumeration, uploads directory listing, login exposure, missing security headers, and HTTPS. Returns a 0-100 posture score with prioritized remediation. Flags security practice, not exploitable vulnerabilities — no CVE matching, no intrusion. For site owners and authorized auditors. ?url=

## Output

Returns a JSON object containing a 0-100 posture score, a letter grade, a boolean indicating whether the site is WordPress, and an array of prioritized findings covering issues like version disclosure via generator tag or readme.html, xmlrpc.php exposure, user enumeration risk, uploads directory listing, login page exposure, missing security headers, and HTTPS status.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "WordPress site URL to assess (homepage)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "grade": {
       "type": "string"
      },
      "findings": {
       "type": "array"
      },
      "is_wordpress": {
       "type": "boolean"
      },
      "posture_score": {
       "type": "number"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://example.com",
  "grade": "C",
  "findings": [
   {
    "fix": "Disable XML-RPC if unused…",
    "area": "xmlrpc",
    "detail": "xmlrpc.php is reachable…",
    "severity": "medium"
   }
  ],
  "disclaimer": "Passive hygiene assessment from public signals only.",
  "is_wordpress": true,
  "posture_score": 71,
  "finding_counts": {
   "low": 3,
   "medium": 2
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/wordpress-security-posture-assessor-d69e0eee/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webbersites.com](https://www.zero.xyz/host/api.webbersites.com/llms.txt)