Skip to content

WordPress security scan: find the classic launch and security mistakes

This WordPress security scan and health check looks at your site from the outside: out-of-date core, closed plugins, an exposed admin user or files, and search engines blocked.

  • Free, no account
  • Results in under a minute
  • Works on any WordPress site

Example result:example-shop.hr

WordPress 6.8

Sample shop · homepage · mobile Chrome · the same check you get for your own site

Run it on your site
WordPress health check
8 passed · 2 failed · 3 warnings. Biggest issue: The site is served over HTTP, not HTTPS.The score counts only the 13 checks this tool shows, not the whole SEO score of the full report.
WordPress 6.8WooCommerce0 pluginsRookie mistakes: 3 of 8

What we found

2 failed3 warnings8 passed
Show 8 passed checks

Fix these first

From the example above. Check your own site to get the fixes that apply to it.

  1. Problem: The site is served over HTTP, not HTTPS

    Browsers label HTTP pages "Not secure" and Google ranks HTTPS pages higher.

    How to fix it: Get a certificate (Let's Encrypt is free) and enable HTTPS on your host.

  2. Problem: Sensitive files are readable by anyone

    /.env holds database passwords and API keys; /.git exposes your source code and every secret ever committed.

    How to fix it: Block dotfiles at the web server (nginx: location ~ /\. { deny all; }; Apache: RedirectMatch 404 /\..*$).

  3. Warning: Plain permalinks are in use (12 links like ?p=123)

    Addresses like ?p=123 carry no keywords, look untrustworthy in search results and break when content is migrated.

    How to fix it: Go to Settings → Permalinks and choose "Post name". WordPress redirects the old ?p= addresses automatically.

What the WordPress security scan checks

The rookie-mistakes scan plus security basics, all from the outside. Nothing logs in, submits a form or brute-forces paths.

  • WordPress search visibility

    Checks the WordPress "Discourage search engines" setting is off, since it hides the whole site from Google.

  • Default WordPress content

    Checks the sample post and page WordPress creates on install are gone, so the site does not look unfinished.

  • WordPress tagline

    Checks the tagline is not "Just another WordPress site", which shows in the title and search results.

  • WordPress permalinks

    Checks addresses use readable words instead of ?p=123, which look better in results and survive migrations.

  • WordPress attachment pages

    Checks image attachment pages stay out of search, since they are empty pages that dilute your site.

  • Public staging copy

    Looks for a public staging or dev copy that search engines can index alongside the live site.

  • Default admin author

    Checks whether a public author page reveals a WordPress login named "admin".

  • User list in the REST API

    Checks whether /wp-json/wp/v2/users hands out the site's user names to anyone who asks.

  • Public debug log

    Checks whether /wp-content/debug.log can be downloaded by anyone.

  • Public config backup

    Checks for a readable copy of wp-config.php, which holds the database password.

  • Uploads folder listing

    Checks whether /wp-content/uploads/ shows a browsable list of every uploaded file.

  • XML-RPC endpoint

    Checks whether /xmlrpc.php accepts requests, an old remote-publishing door often used for login attacks.

Show 16 more checks

  • WordPress attachment pages

    Checks image attachment pages stay out of search, since they are empty pages that dilute your site.

  • Public staging copy

    Looks for a public staging or dev copy that search engines can index alongside the live site.

  • Default admin author

    Checks whether a public author page reveals a WordPress login named "admin".

  • User list in the REST API

    Checks whether /wp-json/wp/v2/users hands out the site's user names to anyone who asks.

  • Public debug log

    Checks whether /wp-content/debug.log can be downloaded by anyone.

  • Public config backup

    Checks for a readable copy of wp-config.php, which holds the database password.

  • Uploads folder listing

    Checks whether /wp-content/uploads/ shows a browsable list of every uploaded file.

  • XML-RPC endpoint

    Checks whether /xmlrpc.php accepts requests, an old remote-publishing door often used for login attacks.

  • CMS version

    Compares the CMS version your page reveals with the latest release, since old versions have known holes.

  • Duplicate SEO plugins

    Checks only one SEO plugin is active, so Google does not get duplicate or conflicting tags.

  • Plugins closed on wordpress.org

    Flags detected plugins that wordpress.org has closed, often because of a security issue.

  • Abandoned plugins

    Flags detected plugins with no update in over 2 years, which no longer get security fixes.

  • HTTPS connection

    Checks the site is served over HTTPS, so browsers don't label it "Not secure" and visits stay private.

  • HSTS header

    Checks the header that keeps return visits on HTTPS, so they never start on interceptable plain HTTP.

  • Exposed .env and .git files

    Checks that files holding passwords, keys or source code can't be downloaded by anyone.

  • Directory listings

    Checks folders don't show an automatic list of every file, including backups and settings.

Show 8 more checks

  • CMS version

    Compares the CMS version your page reveals with the latest release, since old versions have known holes.

  • Duplicate SEO plugins

    Checks only one SEO plugin is active, so Google does not get duplicate or conflicting tags.

  • Plugins closed on wordpress.org

    Flags detected plugins that wordpress.org has closed, often because of a security issue.

  • Abandoned plugins

    Flags detected plugins with no update in over 2 years, which no longer get security fixes.

  • HTTPS connection

    Checks the site is served over HTTPS, so browsers don't label it "Not secure" and visits stay private.

  • HSTS header

    Checks the header that keeps return visits on HTTPS, so they never start on interceptable plain HTTP.

  • Exposed .env and .git files

    Checks that files holding passwords, keys or source code can't be downloaded by anyone.

  • Directory listings

    Checks folders don't show an automatic list of every file, including backups and settings.

How the WordPress security scan works

  1. Recognise WordPress

    We fetch your page and recognise WordPress from what it reveals: wp-content paths, the generator tag and the wp-json link.

  2. Visit a fixed list of addresses

    At most 13 WordPress-specific public addresses are requested, such as /hello-world/, /?author=1, /xmlrpc.php, /wp-content/debug.log and the staging. subdomain.

  3. Check the plugins

    Plugins are read from asset paths and plugin comments, never guessed, and looked up in the wordpress.org directory for closed or abandoned entries.

We only see what the public site reveals. Plugins that work purely in the admin area leave no trace on the page, so they can't be checked.

WordPress health check questions

Can I check a WordPress site I don't own?

Yes. The scan reads only what the public site shows any visitor and requests only a fixed list of public addresses, so it works on any WordPress site without a login, and the owner is not notified. That makes it useful for vetting a site before you buy it, take it on as a client or recommend it to someone.

How can I check if a site is WordPress?

Look at the page source for /wp-content/ or /wp-includes/ paths, a generator meta tag naming WordPress, or a link to /wp-json/. This check does it for you and says which evidence it found. Some sites hide the generator tag, but the asset paths almost always give WordPress away.

Does this scan my WordPress site for vulnerabilities?

Partly. It flags an out-of-date WordPress core, plugins closed or abandoned on wordpress.org, exposed .env or .git files, open directory listings and missing HTTPS or HSTS. It does not match every plugin version against a vulnerability database or scan the files on your server, so keep core, plugins and theme updated and use your host's malware scanning as well.

How do I check if my WordPress site is hacked?

Run the hacked site checker. It fetches your page as a normal visitor, as Googlebot and as a visitor arriving from Google, and shows any spam links, injected text or redirects that only some of them receive, which is how most WordPress hacks hide. Also search Google for site:yourdomain.com with words like viagra or casino.

How is this different from Site Health in wp-admin?

Site Health, under Tools in wp-admin, checks your server and configuration from the inside: PHP version, database, scheduled tasks. This check sees what the public and search engines see from the outside: a noindex from Settings, Reading, default content still live, the admin user exposed or a public staging copy. Use both; they rarely overlap.

Is this safe to run on my site?

Yes. It reads public URLs only: the page, a fixed list of well-known paths (at most 15 per report, 13 of them WordPress-specific), such as /?author=1 and /.env, and the files the page loads. There are no login attempts and no form submissions. Sensitive findings, such as a public debug log or user list, are shown as yes or no only: no usernames, file names or contents are stored.

Why did it not detect my plugins?

Only plugins that leave a trace on the page, an asset under /wp-content/plugins/ or an HTML comment, are detected, and we never guess plugin names. Plugins that work purely in the admin area, such as backup or security plugins, are invisible from outside by design. Check the page where a plugin is actually used.

Related free tools

All 59 tools →

Free, funded by the people who use it

No account, no paid plan. Donations keep it running.

Chip in