Free WordPress Security Scanner
A free online WordPress scanner that checks 200+ plugins, themes, and known vulnerabilities instantly with 12+ detection methods. No installation, runs right in your browser.
- Free
- No signup required
- Read-only scan
- Known-CVE matching
Trusted by agencies, developers, and site owners worldwide
200+ Plugin & Theme Detection
Advanced detection covers 70% of all WordPress sites with accurate version tracking using 12+ detection methods.
- 96% plugin version accuracy
- 99% WordPress core accuracy
- Active theme identification
- Real-time WordPress.org API
CVE Intelligence
Comprehensive vulnerability database with real-time CVE tracking and version-specific matching.
- CVSS 3.1 severity scoring
- Version-specific matching
- Exploit availability tracking
- Actionable remediation steps
Smart Security Alerts
Intelligent analysis with actionable recommendations and security patch tracking.
- Outdated component detection
- Missing security patches
- Exploit availability status
- Fix recommendations
Know what to update, and to which version
Every vulnerable plugin, theme or core version is listed with what the flaw allows and the version that fixes it, so the fix is one update rather than an investigation.
- Core, plugin and theme versions detected
- Known vulnerabilities with CVSS severity
- The version that fixes each one
Vulnerable plugin
Highsimple-contact-forms 3.2.1
- This version has a known vulnerability that lets unauthenticated visitors upload files.
- Fixed in 3.2.4. Update the plugin to close it.
- Installed
- 3.2.1
- Fixed in
- 3.2.4
- CVSS
- 8.1 (High)
12+ Advanced Detection Methods
Our scanner uses multiple detection techniques to ensure the highest accuracy in the industry
Generator Meta Tags
WordPress version from meta tags
Static File Analysis
Plugin/theme CSS & JS fingerprinting
Path-Based Detection
wp-content, wp-includes analysis
WordPress.org API
Real-time version validation
readme.txt Parsing
Stable tag version extraction
Theme Stylesheet Headers
Active theme version detection
Complete WordPress Security Analysis
Component Detection
- 200+ Popular Plugins: WooCommerce, Elementor, Yoast SEO, Contact Form 7, ACF, Jetpack, WPForms, Rank Math, and more
- Theme Detection: Active and installed themes with accurate version tracking
- WordPress Core: 12+ detection methods with 99% accuracy
- Metadata Enrichment: Last updated dates, active installs, popularity metrics
Vulnerability Analysis
- 100,000+ CVEs: Comprehensive vulnerability database with real-time tracking
- CVSS 3.1 Scoring: Critical, High, Medium, Low severity classification
- Version-Specific Matching: Exact version range comparisons for accuracy
- Actionable Fixes: Security patch recommendations and upgrade paths
Why WordPress sites get hacked
WordPress runs a large share of the web, which makes it the most targeted CMS. Most new WordPress vulnerabilities are found in plugins and themes rather than core, and most hacks use a flaw that already had a fix available.
Detects 200+ Popular WordPress Plugins
Covers 70% of all WordPress installations worldwide
Trusted by WordPress site owners, agencies, and developers worldwide
Frequently Asked Questions
Is the WordPress security scanner really free?
Yes. The scanner is free to use with no signup required, and ScanTower includes a free tier so you can keep monitoring your sites at no cost.
How accurate is the plugin detection?
Our scanner achieves 96% accuracy for plugin versions and 99% for WordPress core using 12+ detection methods including WordPress.org API integration.
What vulnerabilities can it detect?
We scan against 100,000+ CVEs covering plugins, themes, and WordPress core with CVSS severity scoring.
How often is the vulnerability database updated?
Daily updates. We integrate with WordPress.org API for real-time version validation.
Do I need to install anything on my WordPress site?
No installation required! This is a fully online tool: just enter your WordPress URL in your browser and get instant results. Our scanner works externally for security and convenience.
This is one check. A full scan runs them all.
FreeThe WordPress Security Scan covers one area. A full scan runs every check on the same site in one go, so nothing it does not reach goes unnoticed.
Covered by this check
- 200+ plugin & theme detection
- Known-vulnerability database
- 12+ detection methods
- WordPress.org API integration
- CVSS 3.1 severity scoring
- Version-specific matching
- Active theme identification
- Security patch alerts
- Outdated component detection
- Metadata enrichment
Added by a full scan
- SSL/TLS certificate validation
- Malware & backdoor detection
- HTTP security headers
- DNS security (DNSSEC, SPF, DMARC)
- Domain reputation & blocklists
- Certificate transparency logs
- Server misconfiguration scanner
- Port scanning
- Card skimming detection
- Script security analysis
- 15+ additional security checks
Want it checked automatically? A free account rescans one site every week and emails you new findings. No credit card.
Start free monitoringMore WordPress and CMS tools
WordPress Version Checker
Detect the exact WordPress core version and whether it is out of date.
WordPress Plugin Checker
List the plugins a WordPress site runs and their known issues.
WordPress Theme Detector
Identify the active theme on any WordPress site.
Drupal Version Checker
Find the Drupal core version any site is running.
Joomla Version Checker
Find the Joomla version any site is running.
Magento Version Checker
Detect the Magento / Adobe Commerce version of any store.