I run a managed IT business in South Africa and look after a fair number of client WordPress sites. Over the past while I've been building a Python script to check those sites from the outside, and it's caught enough real problems for our clients that I figured it was worth sharing.

It's called WordPress Exposure Audit.

What it does
You point it at a site and it writes a self-contained HTML report you can hand to whoever owns it. It looks for things like:
Backup archives, database dumps, .env, .git and old wp-config copies left lying around
Author names leaking through REST, ?author=N, sitemaps and oEmbed (not just the one route everyone closes)
Plugin, theme, core and PHP versions checked against known CVEs, plus plugins that have been quietly pulled from the directory
Old uploads still downloadable but invisible in the Media screen
Security headers, TLS, XML-RPC, open registration, SPF/DMARC

Why I built it
Most "is my site safe" checkers just list paths that returned a 200, which is wrong on loads of sites. A site that redirects unknown paths to the homepage looks like it's serving /backup.sql. An early version of mine reported five critical findings on a tidy site, all false. So most of the effort goes into calibrating how each site answers a missing path, and the report tells you when it couldn't check something rather than giving you a green tick.

The safety bit
It's GET and HEAD only. No logins, no form posts, no password guessing, no payloads. It's not a pen test and the report says so. Single Python file, standard library only, Python 3.9+:

python3 wp_audit.py --site https://www.yoursite.com

Where I'd love your help
It's been tuned against the sites I manage, so it's seen a limited range of hosts, caches and WAFs. If you'd run it against sites you own or look after, I'd really appreciate hearing about:

False positives (anything it flagged that wasn't real)
Anything it obviously missed
Odd hosting setups where calibration fell over
Please only run it on sites you own or have permission to test. Issues and PRs are welcome on GitHub, and there's a --selftest if you want to add a case for a response shape it doesn't handle yet.

Apache 2.0, free to use. Hopefully it helps a few of you lock things down a bit tighter. Cheers!