What does the WordPress Security Scanner check?

It confirms the site is WordPress, reads the core version if it is exposed, fingerprints plugins and themes from their public asset paths and matches them against a local vulnerable-version dataset, and checks conventional exposure points: the REST users route (user enumeration), XML-RPC, security headers, and whether files like readme.html, debug.log or wp-config backups are publicly reachable. Every finding shows the evidence it was measured from.

Is this safe and legal to run?

Yes. It is strictly passive: it only reads what your site already serves to any browser or bot. It never logs in, never submits a form, never brute-forces, and never sends an exploit. For sensitive files it checks only whether they respond, and never reads or displays their contents. It is an indicative posture check, not a penetration test.

Why does it not find every plugin?

Passive fingerprinting only sees plugins and themes that load a public asset on the page it scans. A plugin with no front-end footprint on that page will not appear, and a version that is hidden cannot be matched. That is a limitation of staying passive, and we would rather report less than guess.

How current is the vulnerability data?

The scanner matches against a curated local dataset of well-known vulnerable version ranges, with the "as of" date shown in every report. It is a self-hosted seed, not a live commercial CVE feed, so treat matches as a strong prompt to update, and the absence of a match as "nothing known here", not a clean bill of health.

Is your WordPress site exposed?

Enter your URL for a passive WordPress security check: outdated core and plugins, exposed endpoints and files, user enumeration, XML-RPC and missing security headers. Read-only, no login, results in seconds.

Your score

Category scores

Top issues found

Scan a different page

Get the full report free

Every issue with evidence and a recommended fix, emailed to your work email. No calls unless you ask.

Your full report is on its way

It is being prepared by our system and will arrive at within 5 hours, usually much sooner.

Book a call to walk through it

Passive analysis of publicly available signals. We never log in, submit, or read file contents. Findings are indicative, not a penetration test. One site per scan.

What we check

Core & version

Confirms WordPress and reads the core version if it is publicly exposed, then matches it against known advisories.

Plugins & themes

Fingerprints plugins and themes from their public asset paths and flags versions with known vulnerabilities.

Exposed endpoints

The REST users route (user enumeration) and XML-RPC, both common brute-force and abuse routes, checked for reachability only.

Exposed files

readme.html, debug.log, wp-config backups and other conventional leak paths, checked for existence, never read.

Security headers

CSP, HSTS, clickjacking and MIME-sniffing protection, plus HTTPS and mixed content.

Outdated libraries

Front-end libraries (jQuery and friends) with public CVEs, matched against a local dataset.

Want it hardened, not just scored?

A score tells you where you stand. Our team fixes it: updates, hardening and a rebuild on a modern stack when that is the right call.

Hire a WordPress developer Talk to us