The $500 Bug Bounty Email Every Small Site Gets

A few weeks ago I got a polite email from a “security researcher” who had found a critical vulnerability on my blog. They would be happy to share the details. They also wanted to know if I had a bug bounty program.

If you run a small website, you have probably received the same email. Maybe several times. The wording changes. The pattern never does.

I didn’t pay. But I also didn’t delete it without reading. Both of those decisions matter.

What the “Critical Vulnerability” Actually Was

The finding was username enumeration. My blog runs on WordPress, and out of the box WordPress tells anyone who asks which usernames exist.

There are two classic ways. The REST API has a users endpoint that happily lists authors. And if you visit the site with ?author=1 in the URL, WordPress redirects you to an author archive whose URL contains the username. Increment the number and you walk the whole list.

Is that critical? No. Knowing a username does not get you in. You still need the password, and ideally there is a second factor behind that. But it does hand an attacker half of the login pair for free, which makes brute-force and credential-stuffing attempts cheaper. It is a real weakness. It is just not a $500 weakness.

Why These Emails Are Mostly Fishing

The security community has a name for this: beg bounties. Someone runs an automated scanner across thousands of small sites, collects the same handful of low-severity findings, and sends templated emails asking for payment.

The economics are simple. The scan costs almost nothing. If one site owner in a hundred gets nervous and pays, the campaign works. The goal is not to make your site safer. The goal is to make you anxious enough to send money before you check.

The usual suspects in these reports:

• Username enumeration on WordPress
• Missing security headers
• Missing SPF or DMARC records
• “Clickjacking” on a page with nothing to click
• A version number visible in a readme file

None of these are nothing. All of them are things you can find yourself in ten minutes with free tools. Small sites rarely get breached through clever exploits. They get breached through the boring defaults nobody had time to look at, which is the same story I wrote about in When Product Owners Ignore Security.

What Was Still Worth Fixing

Here is the part people skip. The email was fishing, but the finding was accurate. So I fixed it. Not because of the email, but because a free audit is still a free audit.

Three changes:

1. A small must-use plugin that blocks the REST users endpoint for anyone who isn’t logged in. Must-use plugins load automatically and can’t be deactivated from the admin screen, which is exactly what you want for a security rule.
2. Author archives turned off, so ?author=N no longer redirects to a URL that reveals the username. On a single-author blog those pages add nothing anyway.
3. Generic login errors. By default WordPress tells you whether the username or the password was wrong. That is another enumeration channel. Now it just says the login failed.

Total time: under an hour. That one email also kicked off a wider hardening pass on the whole setup, which turned up more interesting problems than the one in the report.

How to Tell a Beg Bounty From a Real Report

Real researchers do exist, and some of them do email small sites. Here is how I separate them:

• Payment comes before details. A real report explains the problem first. A beg bounty withholds it until you talk money.
• The severity doesn’t match the finding. “Critical” next to missing headers is a tell.
• It reads like a template. No mention of your actual site, your stack, or a specific URL.
• You never published a bounty program. Nobody is owed a bounty from a program that doesn’t exist.
• A real report has reproduction steps. Specific requests, specific responses, a clear impact. You can verify it yourself in minutes.

My rule is simple. Read it, verify it yourself, fix what’s real, and don’t pay for what you could have found alone. If a report is genuinely serious and well documented, thank the person. A public thank-you is often what real researchers want anyway.

The scammers are betting you will either panic or ignore them. The right move is neither.

Have you gotten one of these emails? Did you check what it found?

---

If this resonated with you, I would love to hear your perspective. Drop me a message or connect with me on Twitter (X) or LinkedIn. I write regularly about the intersection of AI, software engineering, and leadership at ivanturkovic.com.