Is your WordPress site running vulnerable plugins?
Outdated plugins are how most WordPress sites get hacked. Enter your address to check your core, plugin and theme versions against thousands of known vulnerabilities.
- Free
- No signup
- About a minute
- Read-only
Enter your address and your scores, failed checks and warnings appear here.
Three places attacks get in.
- The version from the generator tag, core files or your feed
- Known vulnerabilities in that exact release
- Whether a fixed release exists
- Every plugin that loads files on your public pages
- Its version from asset URLs or its readme.txt
- Free and premium plugins alike
- Your active theme and its parent theme
- The version from the theme's style.css
- Known vulnerabilities for that version
- 01
Enter your address
Any public WordPress site. No signup, no plugin to install, no login needed.
- 02
We read your versions
A few requests to your homepage and public files, identified as CodexpertAuditBot. Nothing is attacked or probed.
- 03
See what's exposed
A score, a severity count for core, each plugin and theme, and the full vulnerability list with fixes by email.
Rather not chase updates yourself? We update, test and monitor WordPress, plugins and themes every month.
Maintenance Plan →Questions
Where does the vulnerability data come from?
From the Wordfence Intelligence database, one of the largest public records of WordPress vulnerabilities, refreshed daily. CVE data is from The MITRE Corporation.
Does the scan attack or test my site?
No. It only reads public pages and files any visitor can load (your homepage, feed, plugin readme.txt and theme style.css), then compares the versions it finds with known vulnerabilities. It never tries a login, a form or an exploit.
Why are some plugins missing?
We can only see plugins that load CSS, JavaScript or images on your public pages. Plugins that only work in the dashboard, and sites that strip version numbers or combine files, show less. A clean result means nothing known was found in what is visible, not that the site is guaranteed safe.
Why is the full list sent by email?
The report page is a public link, so it only shows counts and severity. The names of each vulnerability, their CVE numbers and the version that fixes each one go to the address you give us, together with a PDF.
A vulnerability was found. What now?
Back up, then update the affected plugin, theme or WordPress to the fixed version in your emailed report. If no fix exists yet, replace or remove the plugin. Our Maintenance Plan keeps everything updated and tested for you.
What happens to my data?
Results are kept for 90 days. To have them deleted sooner, email [email protected]. See our Privacy Policy.
Find the holes before a bot does.
Free, read-only, and done in about a minute.