What happened
Our review found several security risks, including a publicly visible WordPress version (the core software that powers your website), which could help attackers plan a breach. We also identified redundant page-building tools and a test theme that may clutter your digital lobby and increase maintenance needs.
What we suggest
Remove unused test themes and duplicate site-building tools to simplify your digital infrastructure and reduce security entry points for better guest data protection.
Restrict public access to site configuration files to ensure your internal operations remain hidden from potential intruders.
What we need from you
- Approve a technical audit to remove unused software and secure sensitive files.
- Grant WordPress administrative access so we can confirm the exact impact of these findings.
What the public site reveals about WordPress, the page builders and the plugins behind it.
This looks at the site from the outside only, so it is not a full plugin inventory. Items marked "Needs WordPress admin access" must be confirmed from inside WordPress. A is one of the things we look for.
| Component | Installed | Latest known | Status | What we saw |
|---|---|---|---|---|
| Elementorbuilder | 4.0.8 | n/a | OK | Version 4.0.8 is printed in the page's generator tag.Needs WordPress admin access to confirm |
| Beaver Builderbuilder | 2.10.2 | n/a | OK | Version 2.10.2 appears in the page's body class (fl-builder-2-10-2).Needs WordPress admin access to confirm |
| Reviews Feedplugin | 2.5.4 | n/a | OK | Loads files from /wp-content/plugins/reviews-feed/ (version 2.5.4).Needs WordPress admin access to confirm |
| Beaver Builder PowerPackplugin | 3.5.1 | n/a | OK | Loads files from /wp-content/plugins/bbpowerpack/ (version 3.5.1).Needs WordPress admin access to confirm |
| Twenty Twenty-One (parent theme)theme | n/a | n/a | Watch | Parent theme in use. Twenty Twenty-One is a WordPress default theme that is no longer actively developed.Needs WordPress admin access to confirm |
| adgehotel-testtheme | n/a | n/a | At risk | Child theme "adgehotel-test" is live in production and its name suggests a test theme.Needs WordPress admin access to confirm |
| readme.htmlendpoint | n/a | n/a | At risk | Publicly reachable (200). It states the WordPress version. |
| REST API (/wp-json/)endpoint | n/a | n/a | Watch | Returned 200. Open by default in WordPress; the users list is also public. |
| xmlrpc.phpendpoint | n/a | n/a | OK | Returned 403, which is blocked. Good. |
| wp-cron.phpendpoint | n/a | n/a | Watch | Returned 200. When public, every visit can trigger background jobs. |
| WordPresscore | 7.1.3 | 6.7.1 | OK | Version 7.1.3 is printed in the page's generator tag.Needs WordPress admin access to confirm |
Medium priority (5)
WordPress version 7.1.3 is visible to anyone
The page source shows <meta name="generator" content="WordPress 7.1.3">.
https://adgehotel.com.au/
Recommended fix: Remove the generator tag (a short code snippet or a security plugin option).
Effort: 15 minutesNeeds WordPress admin access to confirm
readme.html is publicly reachable
The file returns 200 and states the WordPress version.
https://adgehotel.com.au/readme.html
Recommended fix: Delete readme.html from the server (it returns after core updates, so block it in server settings too).
Effort: 15 minutesNeeds WordPress admin access to confirm
Staff usernames are listed publicly
The REST API returns user slugs without logging in, which helps password-guessing.
https://adgehotel.com.au/wp-json/wp/v2/users
Recommended fix: Restrict the users endpoint to logged-in users.
Effort: 30 minutesNeeds WordPress admin access to confirm
Two page-builder stacks run on one site
Elementor 4.0.8 and Beaver Builder 2.10.2 (with PowerPack) both load on the same page. Each adds code, updates and security surface.
https://adgehotel.com.au/
Recommended fix: Choose one builder, migrate pages gradually, then remove the other's plugins.
Effort: Several daysNeeds WordPress admin access to confirm
Test theme "adgehotel-test" is running in production
The page uses the "adgehotel-test" theme alongside twentytwentyone.
https://adgehotel.com.au/
Recommended fix: Rename or rebuild as a clean production child theme and keep tests on a staging site.
Effort: 1 dayNeeds WordPress admin access to confirm
Low priority (2)
Elementor version 4.0.8 is visible to anyone
The page source shows Elementor 4.0.8 in a generator tag.
https://adgehotel.com.au/
Recommended fix: Hide builder version tags with a security plugin or code snippet.
Effort: 15 minutesNeeds WordPress admin access to confirm
wp-cron.php is publicly reachable
Returns 200, so visitors (or bots) can trigger background tasks.
https://adgehotel.com.au/wp-cron.php
Recommended fix: Switch to a real server cron job and disable the web trigger.
Effort: 1 hourNeeds WordPress admin access to confirm