Free WordPress vulnerability scanner
Is your WordPress site exposed?
Enter your address and we'll check the things attackers check first: outdated plugins and core, configuration files left readable, and missing security headers. Read-only, no login, nothing to install.
Scan sites you own or are authorised to test.
What the scan looks at
Outdated core, plugins, and themes
Old plugins are the most common way WordPress sites get compromised, precisely because the flaws fixed in each release are documented in public. The scan pins down the versions your site is running and compares them to what WordPress.org currently ships.
Files that should not be public
Backups, .env files, exposed .git directories, and debug logs routinely leak database passwords and API keys. These are found by search engines and automated scanners long before anyone notices.
Configuration and hardening
Whether HTTPS is enforced, which security headers are set, whether XML-RPC is reachable, whether the REST API is handing out your usernames, and whether the server is still running a PHP version that stopped getting security fixes.
What it deliberately doesn't do
It never attempts a login, so it cannot tell you whether your passwords are weak or whether login attempts are rate limited — measuring that means attacking your site. It also reports confidence rather than certainty: a version it cannot read is reported as unknown, not guessed at.
Common questions
- How do I know if my WordPress site is vulnerable?
- Enter your address above. The scan reads what your site already tells the public — its WordPress version, the plugins and themes it loads, the files it serves, and the headers it returns — then reports outdated components and exposed configuration. It takes a few seconds and needs no login.
- Does this scan hack or attack my site?
- No. Every check is a read-only request for a public URL, the same kind your browser makes when it loads a page. The scanner never attempts a login, never sends an exploit payload, and never changes anything. Because it does not attempt logins, it also cannot assess password strength or login rate limiting.
- What does it actually check?
- Three things. First, versions: your WordPress core, plugins, and themes compared against the current releases published by WordPress.org. Second, exposure: publicly readable files that should not be reachable, such as .env files, .git directories, debug logs, and wp-config backups, plus directory listings and REST API username disclosure. Third, hardening: HTTPS, security headers, XML-RPC, and the PHP version your server advertises.
- Why does it say a version is unknown?
- A hardened WordPress site strips its generator tag and the ?ver= query strings on its assets, which is good practice and means there is nothing left for a scanner to read. When that happens the report says the version is unknown rather than guessing, and every detection carries the confidence level behind it.
- Do I need to install a plugin?
- No. The scan runs entirely from outside your site. Nothing is installed, and you do not need to give anyone access to your dashboard or hosting.