An All-in-One archive is the entire site in one file: the whole database, every password hash, every stored key, every customer address. A downloadable one is not a leak, it is a total compromise.
The plugin drops a .htaccess into its archive directory to prevent exactly that. On nginx, IIS and Caddy that file is never read — so the protection is present, visible, and does nothing.
At a glance
| Ability | all-in-one/check-exposure |
| Toolset | All-in-One WP Migration — toolset/all-in-one-wp-migration |
| Group | All-in-One WP Migration › Archive security |
| Requires | All-in-One WP Migration, active on the site |
| Capability | manage_options |
| Safety | Read-only — changes nothing |
| Repeatable | Idempotent — running it twice leaves the same result |
| Ships in | AcrossAI Abilities Manager 0.0.34 and later |
How it works
This does not read configuration and infer a verdict. It asks the running web server for the real URL and reports the status code it actually returned, which is the only method that catches the nginx case.
htaccess_honoured names the problem directly: false on nginx, IIS and Caddy.
The single-file format makes this worse than it is for multi-archive plugins. One guessable filename is the entire site, not one component of it.
Input
This ability takes no input.
What comes back
| Name | Type | What it is |
|---|---|---|
server | string | The web server actually serving the site. |
htaccess_honoured | boolean | False on nginx, IIS and Caddy, where a .htaccess in the archive directory has no effect. |
directories | array | Each archive directory with the status code it returned. |
exposed_count | integer | How many are reachable over HTTP. |
note | string | Anything else worth knowing. |
success | boolean | Whether the call completed. |
message | string | A one-line summary of what happened, suitable for showing a human. |
error_code | string | Present only on failure — a stable machine-readable reason, such as a missing field, a wrong field type or an unmet confirmation. |
Example
Ask your assistant:
Are our All-in-One archives downloadable from the internet?
It resolves to one call:
{
"ability": "all-in-one/check-exposure",
"parameters": {}
}Worth knowing
- Read-only and fast. Worth running on every site you take over.
- A non-zero
exposed_countis an emergency. One archive is the whole site. - The fix is server configuration — a location block on nginx, a web.config rule on IIS — not a plugin setting.
Related abilities
- All-in-One Backup Status — where the archives are stored
- List Archives — what is sitting in that directory
Get the plugins:
AcrossAI Abilities Manager · AcrossAI MCP Manager
Browse the rest: Every ability, by category