WordPress Security Scanner

Detect WP vulnerabilities, version, and misconfigurations — free

We automatically add https:// — just type your domain. We'll run the relevant scanners and email you the full report.

What We Check

Detects the WP version and flags if it is outdated (< 6.4).

Checks if the login page is publicly accessible.

Looks for backup copies of wp-config.php with credentials.

Detects the WordPress readme.html which discloses the version.

Checks if XML-RPC is enabled (brute-force attack vector).

Verifies the WP REST API is not leaking user data.

Detects installed plugins via fingerprinting.

Identifies the active theme and checks for known issues.

This checker is just part of our 27-scanner security assessment. Run a full scan for a complete report.