WordPress Hardening — plan the probes, then classify the capture you take

1. Target

Sample input is demo.example.com, a documentation-only host that is never contacted. Enter any host you are authorised to test.

2. Probe plan for this target

Probe	Request	Browser-observable	Hardened result to expect

Every request line below is generated from the target you typed. This page sends none of them.

3. Classify a capture you made yourself

Run one request line above from your own host (or your lab), then paste the whole curl -i output here. The HTTP status line and headers may be included. Matching is local, deterministic and offline.

4. Observation summary

Probe	Status observed by this page	Status you supplied	Verdict from your capture

5. Expected results on a hardened install

Probe	Expected status	Why that counts as hardened

Use this as the comparison baseline for the captures in section 3: the documented expectation for a hardened install, not a measurement of any host.

How a verdict is reached

This page observes none of the six probes: it sends no request, and cross-origin rules would block reading a cross-origin body anyway. So every probe reports as UNOBSERVABLE with its reason, and this page never reports a probe as secure on its own.

An unobservable result is not a clean result. Absence of evidence is not evidence that a hole is closed, so a host is only shown to be non-exposed when a capture you supply actually shows a blocked or absent response.

Signature matching and the SHA-256 fingerprint are computed in this file, so nothing is uploaded and no request leaves your browser.