RECONNAISSANCE — FREE, PASSIVE, ONE-PAGE DOSSIER
The website is the reconnaissance surface.
Enter a Canadian municipal URL. The routine reads only what an attacker can read — the WordPress fingerprint, the plugin inventory, the exposed admin paths, the security headers, the TLS posture, and the email-spoofing risk — and returns a printed dossier.
Public surface only. No authentication, no probing, no path enumeration. Identical to what any logged-out browser sees.
WordPress vs Fit For Gov
Your current WordPress site is accumulating 8 categories of risk. Below is what each one costs you — and what you keep when you switch.
| Risk Category | Your WordPress Site | Fit For Gov |
|---|---|---|
| Credential Exposure | 11 admin accounts enumerable via /wp-json/users — each one a brute-force target | No API attack surface. Users managed server-side. No enumeration. |
| DDoS Participation | /xmlrpc.php enabled — your server is actively amplifying attacks on third parties right now | No legacy protocols. You are not liable for reflected traffic. |
| Breach Entry Points | 3 browsable directories (/wp-admin, /wp-includes, /wp-content/uploads) exposing structure and files | Static deployment. No directory traversal. No enumeration vectors. |
| Login Targeting | /wp-login.php subject to 24/7 botnet attacks. One weak password = full breach. | No admin UI exposed. Authentication integrated with corporate SSO or Cognito. |
| Data Disclosure | Staff photos, meeting notes, budget PDFs in /uploads are indexed by search engines and enumerable | All uploads behind authentication and CDN with headers. EXIF stripped. |
| Compliance Risk | AODA/WCAG violations, no HTTPS, mixed content, unpatched plugins = $100K+/year potential liability | WCAG AA by design. HTTPS only. No third-party plugin dependencies. |
| Incident Response | Plugin updates break things. No rollback. Hosting provider handles security - or they don't. | Deployment via Git. Full revision history. Rollback to any commit in 60 seconds. |
| Sovereignty | Hosted by third-party providers. Your data, backups, and recovery are not in your control. | Deployed to Vercel or your own infrastructure. You own the keys. |
Breach Cost Calculator
Enter your municipality size and annual IT budget to see the financial risk of staying on WordPress.
Current range: 10,000 to 500,000 residents
Current range: $50K to $1M annually
Chance of admin account compromise this year
Notification, remediation, legal liability + reputational impact
~20% of IT budget spent on plugin updates, patching, backups
The Math: You're paying $20K annually to maintain WordPress security. If a breach happens (which has a 98.8% chance this year), you're paying an additional $13950K in direct costs plus unquantifiable reputational damage.
A Fit For Gov migration costs $1,500–$25,000 once. The difference in annual risk is often paid back within 3 years.
What the routine reads
- § IPublic homepage and response headers
- § IICore version disclosures
- § IIIEnqueued plugin and theme inventory
- § IVStandard WordPress public endpoints
- § VTLS posture and HTTPS enforcement
- § VIEmail authentication — SPF, DMARC, DKIM, MTA-STS
What the routine never does
- ×Authenticate against the site or any service
- ×Probe known leak paths (.env, .git/, backups)
- ×Enumerate hidden directories or fuzz parameters
- ×Send any traffic that resembles attack traffic to a WAF
- ×Save or share the dossier without the requester’s consent
Every request the routine makes is one a normal browser, RSS reader, or feed consumer makes when the operator chooses to publish that file. The routine identifies itself with a user-agent that names the practice and links to this page; nothing about the traffic is concealed.
Findings are produced from real public data: the homepage HTML, the response headers, the WordPress readme.html and license.txt when present, the public REST endpoint at /wp-json/wp/v2/users, /xmlrpc.php, /robots.txt, the directory-listing surface on /wp-content/uploads/ and /wp-includes/, and DNS records for SPF, DMARC, DKIM (default selector), and MTA-STS.
Plugin and theme detection comes from <script> and <link> URLs the page itself enqueues. Cross-reference is against a curated registry of high-value WordPress targets with citations to Patchstack and WPScan; we do not claim a detected install is vulnerable to a specific CVE without an authoritative match.
NEXT STEP
Call first. Email second. Forms third.
If the dossier surfaces something your municipality should act on, the call is fifteen minutes. The principal answers the phone.