Accounts and roles

WM Guard checks, among other things, whether an account with the typical login admin or administrator exists and how many administrators are present. Usernames or email addresses are not sent out as a list for this status check.

Debugging and file access

The plugin checks publicly displayed debug output, the state of the built-in file editor, broad file-modification restrictions, and unusually permissive directory permissions.

Additional signals

WM Guard reviews XML-RPC status, detects several common two-factor solutions, and can note use of the default wp_ database prefix. These are risk signals, not standalone proof of an insecure installation.