WordPress security scan

Check your WordPress site for open doors.

Most WordPress break-ins start with an outdated plugin or theme. Find yours in seconds, with the safe version to update to and the exact lines to paste. No plugin to install.

Passive scan. Nothing is attacked without your permission.

What we check on WordPress

Core: whether your WordPress version is public, and whether it is out of date.
Known vulnerabilities: core, plugins and themes we can see from the outside, matched against the Wordfence Intelligence vulnerability database.
Outdated plugins and themes, with the version that fixes the problem.
Usernames on show through author archives or the REST API, which makes password guessing easier.
XML-RPC left on, a common target for password-guessing attacks.
Plus everything every site gets: HTTPS, security headers, cookies, PHP version, outdated JavaScript libraries and email spoofing.

Fixes written for your dashboard

Each issue comes with steps you can follow in wp-admin, or with lines for wp-config.php, .htaccess, nginx or a small must-use plugin. For example, blocking XML-RPC on Apache:

.htaccess

<Files "xmlrpc.php">
  Require all denied
</Files>

Re-scan after each change and watch the grade move.

After verification: the deep WordPress tests

Verified owners can run deeper tests: exposed wp-config backups and debug logs, user enumeration through the REST API, WP-Cron exposure, plugin-specific checks and, for stores, WooCommerce REST and checkout tests.

Limits we’re upfront about

From the outside we only see the plugins and themes that leave traces in your public pages. A plugin that loads nothing on the front end can be invisible to any remote scanner. Keep auto-updates on and review your plugin list in wp-admin too.

Frequently asked questions

Is this WordPress scan free?

Yes. The grade, the full list of issues and step-by-step fixes for the first 3 are free. Paid plans add every fix, weekly deep scans and alerts.

Will scanning slow down or break my WordPress site?

No. The free scan reads public pages like a visitor does. It doesn’t log in, submit forms or send attack traffic.

Where does the vulnerability data come from?

We match the versions we detect against the Wordfence Intelligence vulnerability database and show the attribution with your results.

Do I need to install a plugin?

No. Nothing is installed. If you want the deep tests, you verify ownership with a DNS record, an uploaded file or a meta tag.

Guides with copy-paste fixes

Guide

More free checks

Free · Instant · No sign-up

Find out your grade before someone else does.