Free WordPress Scanner

Scan any WordPress site for security issues

Enter a URL to detect whether a site runs WordPress, identify its version, check for exposed endpoints like xmlrpc.php and the REST API, detect visible plugins and themes, and test for user enumeration — all without authentication.

Trusted by teams at

Ramp
Pilot
Vercel
Stripe
Better Auth
SST
OpenCode

How it works

How WordPress Scanner works

01

Enter a URL

Paste any website URL. The scanner first checks whether the site is running WordPress before proceeding with security checks.

02

Fingerprint WordPress installation

We detect the WordPress version from meta tags and source code, enumerate exposed endpoints (REST API, xmlrpc.php, wp-login), and extract visible plugin and theme paths from the HTML.

03

Get a vulnerability assessment

Each finding is analyzed for security risk. You get specific remediation steps for exposed endpoints, outdated versions, and configuration weaknesses.

Features

What WordPress Scanner checks

Detect WordPress version

Extracts the WordPress version from the meta generator tag and source code. Outdated versions have known CVEs that attackers actively exploit with automated tools.

Check xmlrpc.php exposure

Tests whether xmlrpc.php is accessible, which enables brute-force password attacks, pingback DDoS amplification, and username enumeration. Most modern sites should disable it.

Test REST API user enumeration

Checks if /wp-json/wp/v2/users is publicly accessible, which exposes usernames that attackers use for targeted brute-force attacks against wp-login.php.

Enumerate plugins and themes

Detects plugin and theme slugs from wp-content paths in the page source. Known vulnerable plugins are the most common WordPress attack vector — responsible for over 90% of WordPress compromises.

Check wp-login.php accessibility

Verifies whether the WordPress login page is publicly accessible without IP restrictions or additional authentication, which exposes the site to brute-force attacks.

Use cases

Who should use the free WordPress Scanner

WordPress Site Owners

Check your own site for common misconfigurations before attackers find them. Verify that xmlrpc.php is disabled, the REST API is restricted, and your version is current.

Security Professionals

Quickly fingerprint a WordPress target during a penetration test. Identify the version, exposed endpoints, and installed plugins to prioritize further testing.

Web Agencies

Audit client WordPress sites for security issues during onboarding or maintenance. Generate evidence of misconfigurations that need remediation.

More tools

All free security tools

FAQ

Frequently asked questions

Everything you need to know about the free WordPress Scanner.

Go beyond WordPress Scanner

This free WordPress Scanner checks a handful of things. Maced's AI pentest checks thousands.

Get a full autonomous penetration test — including OWASP Top 10, authentication flaws, business logic errors, API security, and more — with a compliance-ready report in hours.

Proof of exploit on every finding · SOC 2 & ISO 27001 compatible