Public checks and connected evidence are different facts

Plenty can be established about a WordPress site without any access at all: whether it responds, whether its certificate is valid and when it expires, what its DNS says, how its security headers are configured.

What the outside view can establish

• Reachability, and the status actually returned.
• Certificate validity and how many days remain before expiry.
• DNS records as they currently resolve.
• Security headers present and absent, and what that implies.

What it cannot

It cannot tell you which plugins are installed, which versions are running, what the update posture is, or whether a published advisory applies to this site. Those facts require a connection, and no amount of external probing substitutes for them.

Why the boundary is worth preserving

An operator who knows exactly which facts are established and which are merely inferred can make a defensible decision. One who has been shown a confident summary blending both cannot.