WordPress REST Route Inventory: what a site hands out without a login

The directory under /wp-json/ lists every registered route, including those of every plugin. It says nothing about permissions: the check sits inside the route and runs only when the route is called. This tool therefore does both — it reads the directory and then requests ten known routes without credentials.

Eleven read requests are sent from this server: the directory and ten known routes. Nothing is written and no login is attempted. Only the calling IP address, the time and the size of the request are stored, for seven days; the address entered is not.

Read routes

Five queries per hour. Only GET requests to standard addresses, private address ranges are refused.