WordPress Security Scan
Enter your website address to get a quick security report. We check for exposed XML-RPC and REST API endpoints, whether WordPress and PHP are up to date, and which themes and plugins are running outdated, removed or unmaintained versions.
How it works
- Enter your website address and confirm that you own the site or have permission to scan it.
- We load the homepage and a few public URLs the way a visitor or search crawler would, and read the versions the site exposes.
- Each version is compared with what WordPress.org and the PHP project list as current. You get a prioritized report with what was found, why it matters and how to fix it.
Frequently asked questions
- Is this scan safe for my site?
- Yes. The scan is passive: it only makes ordinary public GET requests, about ten in total, never sends logins, payloads or exploit traffic, and does not try to break in. It is rate limited and can only target public websites.
- Does it find known vulnerabilities (CVEs)?
- No. We do not look up a vulnerability database. The report shows where a newer release exists, a version is end of life or a plugin was removed from WordPress.org, which are the strongest warning signs. Outdated does not prove a flaw exists, and an up-to-date result does not guarantee a site is safe.
- Why are some versions marked as unknown?
- Sites can hide their versions, and that is good practice. Plugin versions are also read from asset URLs, which not every plugin sets. When a version cannot be read we say so instead of guessing.
- Is an enabled XML-RPC or REST API a vulnerability?
- Not on its own. The REST API is part of modern WordPress and is shown as information. XML-RPC is rarely needed today and is a common brute-force target, so we flag it as worth disabling if you do not use it. Listing usernames through the REST API is flagged because it helps password guessing.
- Can I scan someone else's site?
- Only with permission. You must confirm that you own the site or are authorized to test it. Scanning is limited to a few sites every ten minutes per visitor.
- What should I fix first?
- Work from the top of the report. High findings, such as unsupported PHP, an insecure WordPress version or removed plugins, come first, followed by medium findings like exposed XML-RPC or outdated plugins. Take a backup before updating anything.