Security & uptime
Headers, XML-RPC, REST users
Missing security.txt, open XML-RPC, or public REST user list — Health and Guard findings.
Typical symptom
Explorer reports security findings, pentest flagged xmlrpc.php, author enumeration.
Puluno modules
HealthGuard
Undo change
Yes — undo in Center
Issue codes
security_txt_missing, xmlrpc_public, rest_users_public, hsts_missing, csp_missing
What you see
security_txt_missing,xmlrpc_public,rest_users_public, missing HSTS/CSP/X-Frame-Options./wp-json/wp/v2/usersreturns login names.- Brute-force attempts on
xmlrpc.phpin host logs. - Client received audit “WordPress not hardened”.
Why it happens
WordPress defaults are not minimal attack surface. Hosts often leave endpoints open.
Typical risks:
- XML-RPC for pingback / old mobile apps — often unnecessary today.
- REST users endpoint for Gutenberg — public without auth.
- Missing
/.well-known/security.txt. - Missing HSTS / X-Frame-Options (Guard / Health).
What Puluno does
| Phase | Module | Action |
|---|---|---|
| Diagnose | Explorer + Health | headers, endpoints, security.txt |
| Apply | Health | hardening presets (XML-RPC off, REST users) |
| Apply | Guard | security.txt draft, monitoring |
| Verify | Explorer | same URL — findings cleared |
Not everything is Apply — some headers belong on nginx / Cloudflare.
Step by step
- Explorer — security section, note finding codes.
- Health Center → Apply hardening (after backup).
- Confirm legitimate services do not need XML-RPC (Jetpack, some sync).
- Publish security.txt with a security contact.
- HSTS and other headers — host or Cloudflare Transform Rules.
- Verify: Explorer again.
Rollback — undo the change
Health hardening can be reverted in Center.
If something breaks after disabling XML-RPC — rollback and find the dependency.
When it is not Puluno
- WAF at host level already filters attacks — finding may be informational.
- Headless WP without classic REST — different architecture.
- Puluno is not a WAF — not a Wordfence-style firewall.