It's every publicly reachable part of your WordPress install that something could probe or attack — login forms, the REST API, XML-RPC, plugin routes, and PHP execution itself. Static serving can remove or restrict most of this from public reach; it doesn't fix the software underneath it.
Any URL a request can reach without being blocked is attack surface, whether or not it's ever actually attacked: wp-login.php and wp-admin, the WordPress REST API, XML-RPC, admin-ajax.php, and every route an active plugin registers for itself.
Every one of those is normally backed by live PHP execution and a database connection — so it's not just "a URL exists," it's "a full application runtime is reachable behind that URL."
The Attack Surface tab maps every route Static Shield can see and lets you decide, per-route, whether it needs to stay reachable. Zero-WordPress Mode (Pro) enforces the result as a default-deny: once active, only static files and the specific routes you've approved are publicly reachable — everything else is blocked before it reaches WordPress at all.
Isolation changes what's reachable, not what's vulnerable. A plugin with a real security bug is still running that code — isolation just narrows how much of it the public internet can reach directly.
That's why keeping WordPress core, themes, and plugins updated stays important regardless of how strict your protection mode is.
Static Shield Lite is free to install and inspects your actual WordPress install, not just the public surface.
Get Static Shield
Tulapp