Free WordPress vulnerability checker: plugins, version and known holes
Type an address to see which WordPress version and plugins the site shows to any visitor, and how many known vulnerabilities each has in the public WPVulnerability database. Nothing is logged into or submitted.
Free, and only reads what any visitor can see.
What it checks
- Whether the site runs WordPress, and which version
- Every plugin visible in the page, with its version where it shows
- Known vulnerabilities for each plugin, from WPVulnerability.net
- Whether the admin login page is open to the internet
Reading the result
- Known vulnerabilities
- Published security holes for that plugin. A count above zero for the version you run means it needs updating or replacing.
- Version not shown
- The plugin hides its version, so we can't tell whether yours is affected. Check it in the WordPress dashboard.
- What we can't see
- Plugins that leave no trace in the page's code. Your dashboard's plugin list is the complete one.
Understand the result
- Is your WordPress site a security risk? Plugins, PHP and what to check
Over half of WordPress sites run a plugin with a known vulnerability. The five things to check on yours, and what to do about each.
The other free checks: accessibility checker, security headers checker, php version checker and website speed test. Or run the full scan, which does all five at once.