wordpress.org website health report
Website health report
wordpress.org scores 91/100
Excellent — only minor polish left. We found 16 issues; the weakest area is Security (85/100).
- 2 Medium
- 14 Low
- 35 Passed
Free expert review
Send this report to SuperSiteBros. An expert will look it over and email you with the highest-impact fixes — no obligation.
Free weekly monitoring
Weekly monitoring is built and ready, but outbound email from this server is not reliable yet (no SPF/DKIM/DMARC and no SMTP). Sign-ups stay closed until that is fixed — use the free expert review above in the meantime.
Matched SuperSiteBros services
Score history
Previous scans (2)
| Date (UTC) | Score | Grade | Security | Performance | SEO | Accessibility | Best practices |
|---|---|---|---|---|---|---|---|
| Oct 27, 2026 17:47 | 91 | A | 85 | 94 | 88 | 98 | 100 |
| Oct 27, 2026 17:33 | 91 | A | 85 | 94 | 88 | 98 | 100 |
Site crawl
- Pages crawled
- 25
- Broken links
- 1
- Redirect chains
- 0
- Missing titles
- 0
- Duplicate titles
- 0
- Missing descriptions
- 10
- Missing H1
- 1
- Thin pages
- 1
- Noindex pages
- 0
- Mixed content pages
- 0
Pages checked
| Page | Status | Title | Words | Issues |
|---|---|---|---|---|
| / | 200 | Blog Tool, Publishing Platform, and CMS – WordPress.org | 488 | — |
| /showcase/ | 200 | The best websites, built with WordPress. | WordPress.org | 284 | — |
| /plugins/ | 200 | WordPress Plugins | WordPress.org | 976 | — |
| /themes/ | 200 | WordPress Theme Directory | WordPress.org | 338 | — |
| /hosting/ | 200 | Hosting | WordPress.org | 724 | — |
| /news/ | 200 | WordPress News – The latest news about WordPress and the WordPress community | 300 | no description |
| /documentation/ | 200 | Documentation – WordPress.org | 424 | — |
| /education/ | 200 | Education – WordPress.org | 493 | — |
| /support/forums/ | 200 | Forums | WordPress.org | 339 | no description |
| /blocks/ | 200 | Blocks – WordPress.org | 457 | — |
| /patterns/ | 200 | Block Pattern Directory – WordPress.org | 537 | — |
| /photos/ | 200 | WordPress Photo Directory | WordPress.org | 251 | no description |
| /about/ | 200 | About – WordPress.org | 475 | — |
| /five-for-the-future/ | 200 | Five for the Future | How five percent is powering the next generation of the web | WordP… | 580 | no description |
| /enterprise/ | 200 | Enterprise – WordPress.org | 425 | — |
| /gutenberg/ | 200 | The new Gutenberg editing experience – WordPress.org | 43 | thin |
| /download/ | 200 | Download – WordPress.org | 352 | — |
| /download/releases/7.1/ | 200 | WordPress 7.1 – WordPress.org | 3081 | no H1 |
| /playground/ | 200 | WordPress Playground | 406 | no description |
| /news/2026/10/wordpress-7-2-beta-2/ | 200 | WordPress 7.2 Beta 2 – WordPress News | 678 | no description |
| /news/category/development/ | 200 | Development – WordPress News | 862 | no description |
| /news/2026/10/critical-php-security-release/ | 200 | Critical PHP Security Release – WordPress News | 482 | no description |
| /news/category/security/ | 200 | Security – WordPress News | 850 | no description |
| /news/2026/10/wordpress-7-2-beta-1-is-ready-for-download-and-testing/ | 200 | WordPress 7.2 Beta 1 is Ready for Download and Testing – WordPress News | 1487 | no description |
| /about/privacy/ | 200 | Privacy – WordPress.org | 2067 | — |
Issues to fix on wordpress.org
MediumWordPress usernames are publicly listedSecurity
/wp-json/wp/v2/users lists 5 user slug(s) to anonymous visitors.
Why it matters
The REST API endpoint /wp-json/wp/v2/users lists author usernames, giving brute-force bots half of every login.
How to fix it
Restrict the users endpoint to logged-in users and use strong passwords plus two-factor authentication.
MediumBroken linksSEO
1 broken internal and 0 broken external link(s) found.
Why it matters
Links to missing pages frustrate visitors and waste the authority you pass through links.
How to fix it
Update or remove links that return 404/410 or server errors; redirect deleted pages to their closest replacement.
Details
- https://wordpress.org/plugins/browse/favorites/ (404) ← linked from /plugins/
LowFrames without titlesAccessibility
1 iframe(s) without a title.
Why it matters
Embedded frames (videos, maps) need a title so assistive tech can describe them.
How to fix it
Add a descriptive title="" attribute to each iframe.
LowRender-blocking scripts and stylesheetsPerformance
0 blocking script(s) and 8 stylesheet(s) in the page head.
Why it matters
Scripts in the <head> without async/defer, and stylesheets, must download before the browser paints anything.
How to fix it
Add `defer` to scripts that don’t need to run early, inline small critical CSS, and load the rest asynchronously.
LowOff-screen images not lazy-loadedPerformance
12 images further down the page load eagerly.
Why it matters
Images far down the page are downloaded straight away, competing with what visitors actually see first.
How to fix it
Add `loading="lazy"` to images below the fold — but not to the main hero/LCP image.
LowImages not in modern formatsPerformance
15 of 16 images are JPEG/PNG/GIF without a WebP/AVIF alternative.
Why it matters
WebP and AVIF are typically 25–50% smaller than JPEG/PNG at the same quality and are supported by all current browsers.
How to fix it
Serve WebP/AVIF (with <picture> fallbacks if you need them) or let an image CDN negotiate the format.
LowHSTS max-age is shortSecurity
HSTS max-age is 3,600 seconds (0.04 days).
Why it matters
A short max-age means browsers forget the HTTPS-only rule quickly, so the protection lapses between visits.
How to fix it
Raise max-age to at least 15552000 (180 days); 31536000 (1 year) is standard and required for preload.
LowNo Content-Security-PolicySecurity
No Content-Security-Policy header.
Why it matters
A CSP limits which scripts, frames and other resources the browser will run, which makes cross-site scripting (XSS) and injected code far less damaging.
How to fix it
Start with a report-only policy, then enforce. A practical baseline: `default-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests`, adding the third-party hosts you actually use. Prefer nonces or hashes over 'unsafe-inline'.
LowX-Content-Type-Options missingSecurity
X-Content-Type-Options: nosniff is not set.
Why it matters
Without `nosniff`, some browsers guess a file’s type from its contents, which can turn an uploaded “image” into executable script.
How to fix it
Send `X-Content-Type-Options: nosniff` on all responses.
LowNo Referrer-PolicySecurity
No Referrer-Policy header.
Why it matters
Browsers default to a reasonable policy today, but setting one explicitly guarantees full URLs (which can contain tokens or search terms) aren’t leaked to other sites.
How to fix it
Send `Referrer-Policy: strict-origin-when-cross-origin`.
LowNo Permissions-PolicySecurity
No Permissions-Policy header.
Why it matters
Permissions-Policy switches off powerful browser features (camera, microphone, geolocation, payment…) that your site doesn’t use, so injected or third-party code can’t use them either.
How to fix it
Send e.g. `Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()`, allowing only what you need.
LowWordPress version is publicly visibleSecurity
The generator tag reveals WordPress 7.2.
Why it matters
The generator tag or asset URLs reveal your exact WordPress version, which lets bots target known bugs in that release.
How to fix it
Keep WordPress updated (that’s what really matters) and remove the version from the page source.
LowXML-RPC is enabledSecurity
/xmlrpc.php responds (405).
Why it matters
xmlrpc.php is a legacy API that is widely abused for password-guessing (many attempts per request) and pingback DDoS.
How to fix it
If you don’t use the WordPress mobile app, Jetpack or remote publishing, block xmlrpc.php at the server.
LowPages without meta descriptionsSEO
10 of 24 other indexable page(s) have no meta description.
Why it matters
Google will pick its own snippet for these pages, which usually earns fewer clicks.
How to fix it
Add a 120–160 character description to your important pages.
Affected pages
- /news/
- /support/forums/
- /photos/
- /five-for-the-future/
- /playground/
- /news/2026/10/wordpress-7-2-beta-2/
- /news/category/development/
- /news/2026/10/critical-php-security-release/
- /news/category/security/
- /news/2026/10/wordpress-7-2-beta-1-is-ready-for-download-and-testing/
LowPages without an H1SEO
1 page(s) have no H1 heading.
Why it matters
A clear main heading helps search engines and screen-reader users understand each page.
How to fix it
Give each page one descriptive H1.
Affected pages
- /download/releases/7.1/
LowThin pagesSEO
1 page(s) have fewer than 200 words of visible text.
Why it matters
Pages with very little unique text rarely rank and can drag down how search engines judge the site’s overall quality.
How to fix it
Expand them with genuinely useful content, merge similar pages, or noindex utility pages.
Affected pages
- /gutenberg/ (43 words)
InfoDuplicate element IDsAccessibility
1 id value(s) are used more than once.
Why it matters
Duplicate IDs break label/field associations and ARIA references, so assistive tech may read the wrong thing.
How to fix it
Make every id attribute unique on the page.
No issues match these filters.
Passed checks (35)
- Valid SSL certificate — Trusted certificate for wordpress.org, valid until 2026-12-22 (56 days left), issued by Let's Encrypt.
- HTTP redirects to HTTPS — http://wordpress.org/ → https://wordpress.org/ (301).
- Clickjacking protection — X-Frame-Options: SAMEORIGIN
- No mixed content — Every resource referenced in the HTML uses https://.
- Fast server response — Time to first byte 0.49s.
- Brotli compression — Content-Encoding: br
- HTTP/2 supported — Served over HTTP/2.
- Lean HTML — The HTML document is 173.5 KB.
- Static files are cacheable — 4 sampled CSS/JS files have long cache lifetimes.
- Page loads successfully — HTTP 200.
- Page is indexable — No noindex directive in meta robots or X-Robots-Tag.
- Good page title — “Blog Tool, Publishing Platform, and CMS – WordPress.org” (55 characters).
- Good meta description — 90 characters.
- One clear H1 — “Meet WordPress”
- Canonical URL set — https://wordpress.org/
- Mobile viewport set — width=device-width, initial-scale=1
- Open Graph tags present — og:title, og:description and og:image are set.
- Structured data found — Types: Organization, WebSite, WebPage.
- Valid hreflang annotations — 157 language alternates.
- robots.txt allows crawling — 12 rule group(s).
- XML sitemap found — https://wordpress.org/sitemap.xml (index with 3 entries).
- Missing pages return 404 — A made-up URL returned 404.
- One preferred hostname — www.wordpress.org redirects (301) to the preferred version.
- Page language declared — lang="en-US"
- All images have alt attributes — 16 images checked.
- Form fields are labelled — 1 fields checked.
- Links and buttons have names
- Logical heading structure — 11 headings in order.
- Standards-mode HTML5 document — Doctype and charset are declared.
- security.txt published — /.well-known/security.txt has a Contact field.
- SPF record present — v=spf1 ip4:66.6.42.0/24 ip4:66.155.40.0/24 include:helpscoutemail.com -all
- DMARC policy enforced — v=DMARC1; p=reject; rua=mailto:dmarc-reports@automattic.com;
- CAA records restrict certificate issuance — iodef mailto:caa@wordpress.org; issue letsencrypt.org;validationmethods=dns-01;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/53691143
- Reachable over IPv6 — wordpress.org has an AAAA record.
- Page titles are unique — Across 25 crawled page(s).
Site facts
- Final URL
- https://wordpress.org/
- HTTP status
- 200
- Server response (TTFB)
- 490 ms
- Protocol
- HTTP/2
- Compression
- br
- HTML size
- 173.5 KB
- DOM elements
- 663
- Words on page
- 488
- Certificate
- Valid, 56 days left (Let's Encrypt)
- Email DNS
- SPF ✓ · DMARC ✓ · CAA ✓ · IPv6 ✓
- Server
- nginx
- Structured data
- Organization, WebSite, WebPage
Technology detected
Want these fixed for you?
SuperSiteBros care plans take care of security hardening, speed, updates and monitoring so your grade stays high.
See care plans