Free tool
WordPress vulnerability scanner
Check a WordPress site's version, PHP, plugins, theme and security headers against public vulnerability data. One passive request to the homepage, the same one any browser makes. Results usually in under 20 seconds.
Scan a WordPress site
What the scanner checks
Everything comes from the homepage's HTML and response headers, compared with public data.
| Check | How we read it | Compared with |
|---|---|---|
| WordPress version and whether it still gets security fixes | The generator tag, or the version on core files | WordPress.org stable-check (latest, outdated, insecure) and WPVulnerability.net core records |
| PHP version and end of life | The X-Powered-By or Server header | php.net supported versions |
| Visible plugins, releases behind and known vulnerabilities | Plugin folders and version numbers in file addresses | WordPress.org release lists and WPVulnerability.net plugin records |
| Theme | The theme folder and stylesheet version | WordPress.org theme releases and WPVulnerability.net theme records |
| HTTPS, HSTS and other security headers | The final address and the response headers | OWASP Secure Headers Project recommendations |
| Exposed version strings | Generator tags, plugin banners, X-Powered-By and Server headers | Nothing: we list what the site announces |
Passive only, and why
This scanner makes one request for the homepage and follows at most three redirects, exactly as a browser does. It does not request any other address. It does not test the login page, call xmlrpc.php, list users through the REST API, look for readme or backup files or try a single password.
That is a deliberate ethical and legal line. Reading the page a site serves to every visitor is public. Probing a site for weaknesses without the owner's permission can be unauthorized access under computer misuse laws, including in Canada. So we stop at what the site already shows the world, and we ask you to scan only sites you own or are allowed to check. A deeper check of your own site is something we do with your permission and your login, as part of a fix.
How this scanner works
- One safe request. We resolve the address first and refuse private, loopback and reserved networks, then fetch the homepage with a 10 second limit and a 3 MB cap.
- Read the signals. We look for WordPress (the wp-content and wp-includes folders, the generator tag and the REST API link), its version, the plugin and theme folders and their version numbers, the PHP version in the headers and six security headers.
- Keep only real versions. A plugin version counts only when it matches a real release in the WordPress.org directory. That throws out file timestamps, build hashes and the WordPress version that core sometimes appends to plugin files.
- Compare with public data. Core status comes from WordPress.org's stable-check service. Known vulnerabilities come from WPVulnerability.net, which combines records from the CVE program, Wordfence, Patchstack and WPScan, counting only issues that already have a fix. PHP support dates come from php.net. Lookups are cached for up to 24 hours.
- Rank by severity. A plugin with a known vulnerability takes the severity of its worst record. An insecure WordPress version and end-of-life PHP are high. Missing HTTPS is high or critical. Missing headers and exposed version strings are medium or low.
This is the same method we used to scan 1,102 Canadian small business websites. In that study, 70.4% of WordPress sites with a comparable plugin version ran at least one outdated plugin, and 45.6% loaded a plugin version with a publicly disclosed, already fixed vulnerability. Read How out of date are Canadian small business WordPress sites?
Limits. Plugins that do not load on the homepage are invisible. Sites behind a firewall that blocks automated requests cannot be read. Version numbers can be wrong if a site rewrites file addresses. And a clean result never proves a site is secure.
Want the issues fixed?
We fix what the scanner finds: WordPress, plugin, theme and PHP updates on a staging copy first, then the live site, plus the missing security headers. Fixes are one fixed price after a free look, agreed before any work starts. If the site is already hacked, see hacked WordPress site recovery. To keep it patched, see care plans, or work through the WordPress security checklist yourself.
Frequently asked questions
Is this WordPress vulnerability scanner free?
Yes. The scan and the top five issues on screen are free and need no sign-up. If you want the full report, enter your name and email and we send it as a PDF. That is one email; follow-ups only go out if you tick the box.
Is it safe and legal to scan a website with this tool?
The scanner makes one ordinary request for the homepage, the same request a browser makes when anyone visits. It never probes other addresses, never touches the login page or xmlrpc.php and never tries a password, because going further without the owner's permission can amount to unauthorized access. Even so, please scan only sites you own or have permission to check. The form asks you to confirm that.
How do I check my WordPress version?
Run the scanner: it reads the version from the page's generator tag or from the version number WordPress adds to its own core files. If the site hides both, log in to WordPress and open Dashboard, then Updates; the version is shown there and in the footer of most admin screens.
Why did the scanner not find all of my plugins?
It can only see plugins that load a file on the homepage. Plugins that work only in the admin area or on other pages are invisible from outside. Some plugins also hide their version, and paid plugins are not in the WordPress.org directory, so we can only compare two of them (Elementor Pro and Gravity Forms) against their public changelogs. The full report lists every plugin folder we saw.
What does "releases behind" mean?
It is the number of stable releases of that plugin published after the version your site runs, counted from the plugin's WordPress.org release list. A plugin can be one release behind and fine, or ten behind and exposed; the known vulnerability check tells you which.
The scan found no issues. Is my site secure?
Not necessarily. A passive scan sees only what the homepage reveals. It cannot see admin accounts, weak passwords, file permissions, plugins that do not load on the homepage, malware already on the server or whether your backups work. A clean result means nothing obvious is showing from the outside.
What does it cost to fix the issues?
Fixes are one fixed price after a free look: we check the site, then send one price before any work starts, and it does not change unless the job does. To keep a site patched afterwards, care plans are about 15 to 20 percent of the build cost per year. See care plans.
Do you keep the addresses I scan?
The result is held in memory for up to an hour so the report can be emailed if you ask, then dropped. A repeat scan of the same site within 15 minutes is answered from memory, so the site is not fetched twice. Nothing is written to disk unless you ask for the emailed report, which is handled as described in our privacy policy.
My site is already hacked. Will a scan help?
It may show the outdated plugin that let the attacker in, but it will not clean anything. If your site redirects to spam, shows a Google warning or has users you did not create, go straight to hacked site recovery or call +1 (365) 440-1786.
Sources
- WordPress core stable-check API (latest, outdated, insecure), WordPress.org. Checked 1 November 2026.
- WordPress core version-check API, WordPress.org. Checked 1 November 2026.
- Plugin information API, WordPress.org. Checked 1 November 2026.
- Security (official support and backport policy), WordPress.org. Checked 1 November 2026.
- WPVulnerability database (core, plugin and theme records), WPVulnerability.net. Checked 1 November 2026.
- Supported versions, The PHP Group. Checked 1 November 2026.
- Unsupported branches (end of life dates), The PHP Group. Checked 1 November 2026.
- OWASP Secure Headers Project, OWASP Foundation. Checked 1 November 2026.
Start here
Get a fixed quote in 24 hours
Tell us what is wrong or what you need. Within 24 hours you get a written, fixed price or the questions we need answered to give you one.
- A reply within 24 hours
- Fixed price agreed before any work starts
- You own the code, content and accounts
Site down or hacked right now? Call +1 (365) 440-1786 or email info@fourcents.ca.
Request your fixed quote
Fields marked with an asterisk are required. Phone and budget are optional.
Thank you
We have received your details and will reply within 24 hours.