Skip to content
Explore plugins

WordPress Vulnerability Scanner

A free, passive security check for any WordPress site: insecure versions, closed and outdated plugins, exposed files and missing security headers, with a fix for each one.

Try:

  • Free, no sign-up
  • Reads only public pages
  • Results in about 10 seconds

What the scanner checks

Check Why it matters
WordPress version Versions marked insecure by WordPress.org have known, published problems.
Closed plugins Plugins removed from WordPress.org, often for security, stop getting fixes.
Outdated and abandoned plugins Most WordPress break-ins go through plugins that were not updated.
debug.log An open log file shows server paths, plugin names and sometimes customer data.
Folder listing An open uploads folder lets anyone browse files that were never linked.
Usernames Visible usernames make password guessing easier.
XML-RPC and readme.html Old endpoints and files that scanners and bots look for.
HTTPS and security headers Encryption, HSTS, clickjacking and MIME sniffing protection.

Each problem in the report comes with a short, plain fix you can hand to whoever looks after the site.

Passive on purpose

The scanner only reads what any visitor can open: the home page, a few public files and the response headers. It does not log in, submit forms, try passwords or send attack payloads. That makes it safe to run on any site, including one you do not own, and it means a clean result is a good sign rather than a guarantee.

How the score works

The report starts at 100 and takes points off for each problem, weighted by how much it matters. An open debug log or an insecure WordPress version costs far more than a missing referrer policy. A, B and C are fine to good, D needs attention, F means something serious is exposed.

What it does not do yet

It does not yet match every plugin version against a vulnerability database, so a plugin that is up to date but still has an unfixed problem will not be flagged. Outdated and closed plugins are the strongest signal the scan can give from outside, and in practice they cover most real cases.

Interested in one part only? The WordPress version checker and the plugin detector open the same report with that part first.

Questions

Is it safe to scan a site I do not own?

Yes. The scan reads only public pages and files, once, and says who it is in an X-Scanner header, the same way a search engine or a visitor would read them. It never tries to break in.

Does a good score mean the site is secure?

It means nothing serious shows from outside. Weak passwords, a vulnerable plugin that is up to date, or a problem on the server cannot be seen this way. Treat it as a quick health check, not an audit.

How is this different from WPScan?

WPScan is a command line tool with a vulnerability database and many more tests. This scanner runs in the browser, needs no setup, explains every result in plain words and is meant for site owners as much as developers.

My site got a low score. What first?

Fix the problems marked in red first: an exposed debug log, an insecure WordPress version or a closed plugin. Then update outdated plugins. Headers can wait until last.

How do I recognise the scanner in my server logs?

Every request carries an X-Scanner: PlugStackInspector header. A check reads your home page and a few public files once, the same files any browser can open. It never logs in, posts forms or tries passwords, and it is rate limited per site.

Why can some sites not be checked?

Some sites sit behind bot protection, such as a Cloudflare or AWS challenge, that stops every automated visitor. The tool does not try to get around it. Instead it offers a second way: open the site in your own browser, copy the page source and paste it in. The theme, plugins and versions are read from that, and the checks that need the live site are marked as skipped.

Do you save the sites I check?

Each report is saved for 30 days so the share link keeps working, then deleted. Your IP address is not stored with it. Nothing about you is sent to the site you check.

Explore plugins