Website exposure scan — find the doors left open before an attacker does.

No. It's strictly non-intrusive reconnaissance: read-only GET requests to public URLs on the site you've verified you own. It never sends exploit payloads, brute-forces logins, fuzzes inputs, or changes anything — so it can't damage a live store. It also identifies itself as Relvato in the request, rather than acting like a stealth attacker.

The vulnerability scan checks your installed plugins and themes against known CVEs — it's about vulnerable code. The exposure scan checks configuration and what's reachable from the outside — exposed files, open endpoints, weak headers — which no code-level scanner sees. They're complementary: one finds vulnerable software, the other finds open doors.

Yes. The generic probes — keys published in your pages and scripts, source maps, cookie and CORS rules, exposed files, directory listing, missing security headers — apply to any site; the WordPress-specific probes (XML-RPC, REST user enumeration, readme version) simply don't match elsewhere. No plugin is required. On WordPress, installing it adds the part only the server can see: what is actually sitting in your web root, and the settings that widen the blast radius.

It's deliberately gentle: a small, curated list of requests at a low rate, each with a short timeout, from an identified user-agent. It only runs on a domain you've verified, and you opt in by enabling the monitor. It's the same non-intrusive first pass a security professional would run on a site they're authorized to test.

An exposed secret or backup fails the monitor and alerts you immediately — those are close-it-now issues. Hardening gaps (missing headers, enabled XML-RPC, enumeration) are flagged as warnings to review. Anything that's expected on your site you can mark as reviewed so it won't nag you again.

It shouldn't. Most of the scan is ordinary traffic — the pages and scripts a browser loads anyway. The part that asks for files like /.env is exactly what a server firewall is built to catch, so Relvato only makes those requests when they are worth making: with the plugin installed it asks your site which of those files actually exist, and requests only those. If your firewall does refuse them, the run says the file probe was refused instead of reporting a clean result.

No. When it asks your site from the inside, the answer is a list of names and sizes — never contents. That endpoint only answers for paths inside your web root and refuses anything that tries to walk out of it, and a finding quotes at most the first few characters of a key, so the report itself never becomes the leak.

On WordPress with the Relvato plugin, eight common findings have a one-click fix you apply in WordPress → Relvato, each of which can be switched back off there — from turning off XML-RPC to adding safe security headers. Relvato never adds a Content-Security-Policy or HSTS automatically: a wrong value for either can break a site, so they need a person to set them.

Yes, on WordPress 6.9 or newer with the Relvato plugin 1.43.0 or newer. Plugins can register abilities that AI assistants and the REST API can call. The scan lists them from inside your site and asks each one's own permission callback, as a logged-out visitor, whether anyone may run it, without running it. An ability anyone can run that isn't read-only is reported as serious; open read-only ones, destructive ones AI assistants can use and new ones after an update are warnings.