WordPress checker:Is your WordPress site making the classic launch mistakes?
See whether search engines are blocked, default content is still live, the admin user is exposed or core is out of date, and where in wp-admin each setting lives.
- Free, no account
- Results in under a minute
- Works on any WordPress site
example-shop.hr
WordPress 6.8Sample shop · homepage · mobile Chrome · the same check you get for your own site
8 passed · 2 failed · 3 warnings. Biggest issue: The site is served over HTTP, not HTTPS.
What we found
Show 8 passed checks
Fix these first
From the example above. Check your own site to get the fixes that apply to it.
Problem: The site is served over HTTP, not HTTPS
Browsers label HTTP pages "Not secure" and Google ranks HTTPS pages higher.
How to fix it: Get a certificate (Let's Encrypt is free) and enable HTTPS on your host.Problem: Sensitive files are readable by anyone
/.env holds database passwords and API keys; /.git exposes your source code and every secret ever committed.
How to fix it: Block dotfiles at the web server (nginx: location ~ /\. { deny all; }; Apache: RedirectMatch 404 /\..*$).Warning: Plain permalinks are in use (12 links like ?p=123)
Addresses like ?p=123 carry no keywords, look untrustworthy in search results and break when content is migrated.
How to fix it: Go to Settings → Permalinks and choose "Post name". WordPress redirects the old ?p= addresses automatically.
What this tool checks
The rookie-mistakes scan plus security basics, all from the outside. Nothing logs in, submits a form or brute-forces paths.
WordPress search visibility
Checks the WordPress "Discourage search engines" setting is off, since it hides the whole site from Google.
Default WordPress content
Checks the sample post and page WordPress creates on install are gone, so the site does not look unfinished.
WordPress tagline
Checks the tagline is not "Just another WordPress site", which shows in the title and search results.
WordPress permalinks
Checks addresses use readable words instead of ?p=123, which look better in results and survive migrations.
WordPress attachment pages
Checks image attachment pages stay out of search, since they are empty pages that dilute your site.
Public staging copy
Looks for a public staging or dev copy that search engines can index alongside the live site.
Default admin author
Checks whether a public author page reveals a WordPress login named "admin".
CMS version
Compares the CMS version your page reveals with the latest release, since old versions have known holes.
Duplicate SEO plugins
Checks only one SEO plugin is active, so Google does not get duplicate or conflicting tags.
Plugins closed on wordpress.org
Flags detected plugins that wordpress.org has closed, often because of a security issue.
Abandoned plugins
Flags detected plugins with no update in over 2 years, which no longer get security fixes.
HTTPS connection
Checks the site is served over HTTPS, so browsers don't label it "Not secure" and visits stay private.
Show 11 more checks
WordPress attachment pages
Checks image attachment pages stay out of search, since they are empty pages that dilute your site.
Public staging copy
Looks for a public staging or dev copy that search engines can index alongside the live site.
Default admin author
Checks whether a public author page reveals a WordPress login named "admin".
CMS version
Compares the CMS version your page reveals with the latest release, since old versions have known holes.
Duplicate SEO plugins
Checks only one SEO plugin is active, so Google does not get duplicate or conflicting tags.
Plugins closed on wordpress.org
Flags detected plugins that wordpress.org has closed, often because of a security issue.
Abandoned plugins
Flags detected plugins with no update in over 2 years, which no longer get security fixes.
HTTPS connection
Checks the site is served over HTTPS, so browsers don't label it "Not secure" and visits stay private.
HSTS header
Checks the header that keeps return visits on HTTPS, so they never start on interceptable plain HTTP.
Exposed .env and .git files
Checks that files holding passwords, keys or source code can't be downloaded by anyone.
Directory listings
Checks folders don't show an automatic list of every file, including backups and settings.
Show 3 more checks
HSTS header
Checks the header that keeps return visits on HTTPS, so they never start on interceptable plain HTTP.
Exposed .env and .git files
Checks that files holding passwords, keys or source code can't be downloaded by anyone.
Directory listings
Checks folders don't show an automatic list of every file, including backups and settings.
How it works
Recognise WordPress
We fetch your page and recognise WordPress from what it reveals: wp-content paths, the generator tag and the wp-json link.
Visit eight known addresses
At most eight public addresses are requested: /hello-world/, /sample-page/, /?author=1, the attachment sitemap and the staging., dev. and test. subdomains.
Check the plugins
Plugins are read from asset paths and plugin comments, never guessed, and looked up in the wordpress.org directory for closed or abandoned entries.
We only see what the public site reveals. Plugins that work purely in the admin area leave no trace on the page, so they can't be checked.
Questions
Is this really free?
Yes. getReport is funded by donations, not plans. This tool runs the full report and shows you the part it is about; the complete report with all seven modules is one click away, also free.
Is this safe to run on my site?
Yes. It reads public URLs only: the page, a fixed list of at most 15 well-known paths (such as /?author=1 and /.env) and the files the page loads. There are no login attempts and no form submissions. Sensitive findings, such as the exposed admin user, are shown as yes/no only.
It did not detect my plugins.
Only plugins that leave a trace on the page (an asset under /wp-content/plugins/ or an HTML comment) are detected. Plugins that work purely in the admin area are invisible from outside, by design.
Why a WordPress-specific check?
Generic site checkers see symptoms: a noindex tag, an ugly URL, an old jQuery. WordPress sites share the same handful of causes, and each has a two-click fix in wp-admin. Knowing that the noindex comes from Settings → Reading saves an hour of guessing. The eight rookie mistakes here show up on most new WordPress sites we test, and every one costs rankings or security for no benefit. The report tells you how many you made and where the setting lives.
Do you store my results?
The report is kept for 12 months at its shareable link so you can come back to it. Reports are not listed publicly and carry a noindex tag; nothing about your visitors is collected.
Related free tools
All 41 tools →Free, funded by the people who use it
€0 of €75 this month. At €75, site crawl up to 500 pages + weekly re-check switches on for everyone.