wordpress.org

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

wordpress.org

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
TLS certificate
cert expires in 33 days
SOC 2 CC6.6ISO 27001 A.13.1.1
low
Security headers
4 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your wordpress.org scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 33 days
Redirect chainHTTPS served correctly
Security headers4 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2035-03-28
Certificate Transparency8 subdomain(s) found in CT logs (5 wildcard cert(s))

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=495 198.143.164.252
AAAA: ttl=600 2607:f978:5:8002::c68f:a4fc
NS: ttl=86237 ns3.wordpress.org.
ttl=86237 ns1.wordpress.org.
ttl=86237 ns4.wordpress.org.
ttl=86237 ns2.wordpress.org.
SOA: ttl=14440 ns1.wordpress.org. hostmaster.wordpress.org. 20123416 7200 7200 1209600 86400
CAA: ttl=14400 \# 31 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 63 61 61 40 77 6f 72 64 70 72 65 73 73 2e 6f 72 67
ttl=14400 \# 114 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67 3b 76 61 6c 69 64 61 74 69 6f 6e 6d 65 74 68 6f 64 73 3d 64 6e 73 2d 30 31 3b 61 63 63 6f 75 6e 74 75 72 69 3d 68 74 74 70 73 3a 2f 2f 61 63 6d 65 2d 76 30 32 2e 61 70 69 2e 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67 2f 61 63 6d 65 2f 61 63 63 74 2f 35 33 36 39 31 31 34 33
TXT: ttl=14400 "google-site-verification=UL0sGJ1dZbCT4J7pGrLW3hqM_I1LJ8pUi2WBEI_98kI"
ttl=14400 "google-site-verification=t8FjG1vzC4OFZJ8qL4SkR8xxtLyKldXKbswyeemQS5w"
ttl=14400 "v=spf1 ip4:66.6.42.0/24 ip4:66.155.40.0/24 ip4:198.143.164.0/24 include:helpscoutemail.com -all"

fetched 2026-05-23T08:25:13.131Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 smtp1-ord.wordpress.org.
pri=10 smtp2-ord.wordpress.org.

fetched 2026-05-23T08:25:13.132Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 ip4:66.6.42.0/24 ip4:66.155.40.0/24 ip4:198.143.164.0/24 include:helpscoutemail.com -all

v=spf1
ip4:66.6.42.0/24
ip4:66.155.40.0/24
ip4:198.143.164.0/24
include:helpscoutemail.com
-all

fetched 2026-05-23T08:25:13.133Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; pct=100; rua=mailto:0bqp2jnw@ag.dmarcian.com; ruf=mailto:0bqp2jnw@fr.dmarcian.com;

v=: DMARC1
p=: reject
pct=: 100
rua=: mailto:0bqp2jnw@ag.dmarcian.com
ruf=: mailto:0bqp2jnw@fr.dmarcian.com

fetched 2026-05-23T08:25:13.134Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 33 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: wordpress.org
issuer:: E7 / Let's Encrypt
valid:: Mar 27 19:43:57 2026 GMT → Jun 25 19:43:56 2026 GMT
authorized:: yes
sha256:: 0C:45:DC:06:31:A6:6D:CA:CA:41:C1:0B:D1:74:24:7B:51:4C:63:1A:C3:BD:88:90:CE:DE:B9:37:14:B2:46:D4
sans: *.wordpress.org
wordpress.org

fetched 2026-05-23T08:25:13.272Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://wordpress.org/

fetched 2026-05-23T08:25:13.319Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

4 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://wordpress.org/

security headers

strict-transport-security: max-age=3600
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

alt-svc: clear
connection: keep-alive
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 08:25:13 GMT
link: <https://wordpress.org/wp-json/>; rel="https://api.w.org/", <https://wordpress.org/wp-json/wp/v2/pages/457>; rel="alternate"; title="JSON"; type="application/json", <https://w.org/>; rel=shortlink
server: nginx
transfer-encoding: chunked
vary: Accept-Encoding, accept, content-type
x-nc: HIT ord 2
x-olaf: â

fetched 2026-05-23T08:25:13.321Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 405

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T08:25:13.315Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

Sitemap: https://wordpress.org/sitemap.xml
Sitemap: https://wordpress.org/news-sitemap.xml
Sitemap: https://wordpress.org/themes/sitemap.xml
Sitemap: https://wordpress.org/plugins/sitemap.xml
Sitemap: https://wordpress.org/news/sitemap.xml
Sitemap: https://wordpress.org/showcase/sitemap.xml
Sitemap: https://wordpress.org/documentation/sitemap.xml
Sitemap: https://wordpress.org/patterns/sitemap.xml
Sitemap: https://wordpress.org/photos/sitemap.xml
User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php
Allow: /wp-admin/load-scripts.php
Allow: /wp-admin/load-styles.php

User-agent: *
Disallow: /search
Disallow: /?s=

User-agent: GPTBot
Allow: /

User-agent: ClaudeBot
Allow: /

User-agent: anthropic-ai
Allow: /

User-agent: Google-Extended
Allow: /

User-agent: Applebot-Extended
Allow: /

User-agent: PerplexityBot
Allow: /

User-agent: Bytespider
Allow: /

User-agent: CCBot
Allow: /

User-agent: Copilot
Allow: /

User-agent: *
Disallow: /plugins/search/

sitemap.xml

present — 3 url(s)

head

title: Blog Tool, Publishing Platform, and CMS – WordPress.org
description: Open source software which you can use to easily create a beautiful website, blog, or app.

social

og:type: website
og:title: Blog Tool, Publishing Platform, and CMS - WordPress.org
og:description: Open source software which you can use to easily create a beautiful website, blog, or app.
og:url: https://wordpress.org/
og:site_name: WordPress.org
og:image: https://wordpress.org/files/2024/04/wordpress-homepage-ogimage-202404.png
og:locale: en_US
twitter:card: summary_large_image
twitter:creator: @WordPress

fetched 2026-05-23T08:25:13.507Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T08:25:13.158Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2035-03-28

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2003-03-28T01:07:35Z
expires: 2035-03-28T01:07:35Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-05-23T08:25:13.676Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

8 subdomain(s) found in CT logs (5 wildcard cert(s))

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

source: certspotter
certificates seen: 13
subdomains in CT: 8 discovered (full list in Domain Audit Report)
wildcards: *.forums.wordpress.org, *.git.wordpress.org, *.svn.wordpress.org, *.trac.wordpress.org, *.wordpress.org

fetched 2026-05-23T08:25:13.740Z

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.