Live product demo
URL Exposure Guard for WordPress.
Review the bounded, privacy-minimized findings produced by a deterministic read-only scan. The demonstration uses fictional results with the same labels, redaction format, rule names, severities, and summary fields as version 0.1.0.
Fictional administrator output
Five risks found without storing the private URL.
This public page does not connect to WordPress, accept visitor URLs, or scan external sites. It presents deterministic output from the packaged test scenario so the product's result format can be reviewed safely.
| Severity | Post ID | Finding | Redacted URL |
|---|---|---|---|
| CRITICAL | 101 | URL contains embedded username or password material. | http://outside.example/[PATH_REDACTED]?ordinary=%5BREDACTED%5D&token=%5BREDACTED%5D&utm_source=%5BREDACTED%5D |
| CRITICAL | 101 | Sensitive-looking query keys: token. | http://outside.example/[PATH_REDACTED]?ordinary=%5BREDACTED%5D&token=%5BREDACTED%5D&utm_source=%5BREDACTED%5D |
| HIGH | 101 | External URL uses unencrypted HTTP. | http://outside.example/[PATH_REDACTED]?ordinary=%5BREDACTED%5D&token=%5BREDACTED%5D&utm_source=%5BREDACTED%5D |
| MEDIUM | 101 | External hostname is not allowlisted: outside.example. | http://outside.example/[PATH_REDACTED]?ordinary=%5BREDACTED%5D&token=%5BREDACTED%5D&utm_source=%5BREDACTED%5D |
| LOW | 101 | Tracking query keys: utm_source. | http://outside.example/[PATH_REDACTED]?ordinary=%5BREDACTED%5D&token=%5BREDACTED%5D&utm_source=%5BREDACTED%5D |
Not retained in the stored findings
No post title, username, password, URL path, fragment, query value, or linked-page content is included. The real plugin also stores a SHA-256 digest of the original URL for deterministic evidence; this public demonstration intentionally does not expose that digest.
What this proves
The real result schema, with an honest public-demo boundary.
The product runs inside an authenticated WordPress administrator screen and uses WordPress core table, form, notice, and button styles. This public page reproduces the exact result labels and deterministic fictional test findings without pretending to be a connected WordPress installation.
Included rules
Seven deterministic checks.
Version 0.1.0 detects credential-bearing URLs, insecure external HTTP, sensitive query keys, common tracking parameters, blocked script/data/file schemes, external hosts outside an optional allowlist, and canonical duplicates.
- Install and activateUpload the plugin ZIP in WordPress and open Tools › URL Exposure Guard.
- Configure policyOptionally add approved external hosts and additional sensitive query keys.
- Run or scheduleStart a manual read-only scan or let traffic-triggered WP-Cron run the daily scan.
Product boundary
A content audit, not a web crawler.
The plugin is not a broken-link checker, remote vulnerability scanner, compliance product, or guarantee that every unsafe URL will be detected.