WordPress Security Check

WordPress is the most widely used CMS in the world and therefore the most popular target of automated attacks. Most break-ins do not rely on clever tricks but on doors left open. Our check shows you which of them are visible from outside on your website.

We only request publicly accessible addresses, just like a visitor. No login attempts or attacks are performed.

How to read the result

Points marked red should be fixed soon because they give attackers concrete help. Yellow points increase the risk but are rarely the sole reason for a break-in. Points marked blue describe what we found without rating it.

OKThis point is implemented correctly.
ReviewNot an acute error, but room for improvement.
ProblemLikely has a negative effect and should be fixed.
InfoFor information, without rating.

WordPress version

By default, WordPress writes its version number into the source code and the RSS feed. If it is visible, we compare it with the official data from wordpress.org: red means known vulnerabilities, yellow an older but not insecure version, green the current version.

Usernames

On many websites, the login names of editors can be read via the REST API at /wp-json/wp/v2/users or via the address ?author=1. For password attacks, that is half the job done. We only show found names in truncated form.

XML-RPC and login

The XML-RPC interface is a leftover from before the REST API and allows hundreds of passwords to be tested with a single request. The login page at /wp-login.php, on the other hand, is normal but should be protected with two-factor authentication.

Open files and directories

We check whether readme.html, the error log debug.log and directory listings of uploads and plugins are publicly accessible. The error log is especially critical because it contains server paths, plugin details and sometimes form data.

Plugins and theme

From the source code, we read which plugins and which theme your website loads. We determine the installed version from the public info file of each plugin (readme.txt) or theme (style.css). We then compare it with the official directory and with a database of known security vulnerabilities (WPVulnerability). Red means a vulnerability is publicly known for this version. For each vulnerability you see the plugin’s real name, the type of vulnerability in plain words, its severity, whether it can be exploited without login and from which version it is fixed. The most urgent ones are listed first. Plugins that load nothing in the frontend cannot be detected from outside.

Why WordPress security is not a one-off task

Around four in ten websites worldwide run on WordPress. For attackers, it pays to build tools that automatically scan millions of websites for known weaknesses. Your website does not have to be well known or interesting for that. Being reachable is enough.

Most successful attacks exploit outdated plugins and themes, followed by guessed or reused passwords. The consequences range from spam pages that ruin your Google rankings and redirects to fraudulent sites to stolen customer data, which may have to be reported under the GDPR.

The most effective protection is unspectacular: regular updates of WordPress, plugins and theme, strong passwords with two-factor authentication, as few plugins as possible and working backups that have actually been restored at least once.

This check does not replace a full security audit. But within seconds it shows whether the obvious doors are closed. Those are exactly what automated attacks check first.

Quick hardening via functions.php

// Remove version number from source code and feed
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

// Disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');

// REST API user list for logged-in users only
add_filter('rest_endpoints', function ($endpoints) {
  if (!is_user_logged_in()) {
    unset($endpoints['/wp/v2/users']);
    unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
  }
  return $endpoints;
});

Ideally in a child theme or a small custom plugin so the changes survive theme updates. Many security plugins offer the same settings with a single click.

Frequently asked questions about WordPress security

Does the check attack my website?

No. We only request addresses that any visitor could open in a browser and send no credentials, forms or attack patterns. The check amounts to roughly a dozen normal page views.

My result is green everywhere. Does that mean my website is secure?

It does not have the most common weaknesses visible from outside. What happens inside, such as password strength, plugins without frontend output or permissions on the server, cannot be seen by an external check. Regular updates and backups therefore remain essential.

Should I change the login address?

It reduces automated login attempts and therefore server load and log noise, but it is not real protection. Two-factor authentication and a limit on login attempts matter more.

Do I need XML-RPC?

In most cases, not anymore. It is still required by the Jetpack connection and by some older apps or services that publish posts. The WordPress app and the block editor use the REST API.

How often should I update plugins?

Security updates as soon as possible, ideally automatically. Larger feature updates after a backup and a quick test. If you would rather not handle this yourself, a maintenance contract is a good choice.

Is my input stored?

We store the checked address and the result anonymously for statistical purposes. Your IP address is not stored. More in our privacy policy.

See all 35 tools

Security Headers Check
Checks which protective headers your server sends: HTTPS, HSTS, CSP, framing protection, cookies. With a grade and a snippet.
PHP Version Check
Checks whether your server reveals its PHP version and whether it still receives security updates.
CMS Detector
Shows which system a website runs on, whether the version still receives security updates and, for WordPress, which plugins are outdated or vulnerable.
Speed & Hosting Check
Measures load time with Google PageSpeed and shows where your website is hosted, when certificate and domain expire and who runs your e-mail.

WordPress in safe hands

We look after WordPress websites with regular updates, backups, security monitoring and quick help if something does go wrong. Get in touch, we will be glad to take a look at your website.

Get in touch