WordPress Security Check: Free Website Security Audit Tool

Paste your URL and get a free WordPress security scan in seconds. This online security audit tool inspects your HTTP security headers, HTTPS setup, WordPress exposure and common information leaks, then turns everything into a risk score with plain-English fixes. It’s passive and safe, with no plugin to install and no account to create.

• Free to use
• No signup
• Passive, non-intrusive checks
• 25 checks in 5 categories
• Results in seconds

What is a WordPress security checker?

A WordPress security checker is an online tool that looks at your website from the outside, the same way a visitor or an automated bot would, and flags weak spots in its public configuration. It answers questions like: Is HTTPS set up properly? Are modern browser protections switched on? Is WordPress telling strangers its version number or your usernames?

This is a free website security audit aimed at the everyday misconfigurations that attackers look for first. Most WordPress compromises don’t start with a clever exploit. They start with something simple: an outdated component, a guessable username, or a missing safeguard. A quick WordPress security check shows you those gaps before anyone else finds them, which makes it a practical first step in any free cyber security audit of your site.

How the WordPress security scan works

The scanner sends a small number of ordinary requests to your public URL, reads the responses, and compares what it finds against security best practices. It never logs in, never tries passwords, and never attempts an exploit. Here’s the process:

1. Enter your website URL in the box above and click Start Security Scan.
2. Wait a few seconds. Only public websites can be scanned. Private, local and reserved network addresses are blocked.
3. Review the report: an overall risk score, five category scores and a list of findings.
4. Apply the fixes starting with the highest-risk items, then scan again to confirm.

What the security audit tool checks

Each scan runs 25 checks grouped into five categories, so you can see at a glance where your site is strong and where it needs attention.

How to read your results

Every report opens with an overall risk score. Unlike a school grade, a lower number is better, because the score measures risk. Beneath it you’ll see counts of passed checks, warnings and failures, a score for each of the five categories, and a detailed list of findings.

Each finding also shows a risk value, the evidence the scanner saw (for example, the exact header it found) and a recommendation written for site owners, not just security specialists.

HTTP security headers explained

HTTP security headers are short instructions your server sends along with every page. Browsers read them and switch on built-in protections. They’re one of the cheapest, highest-impact ways to harden a site, and a missing header is one of the most common findings in any WordPress security scan. The OWASP Secure Headers Project is a good reference for recommended values.

If you want to go deeper on any individual header, MDN’s documentation on the Content-Security-Policy header explains every directive.

The simpler headers can be added in one go. For Apache, place this in your .htaccess (the mod_headers module must be enabled):

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

On Nginx, the equivalent is add_header lines in your server block. Many managed hosts and security plugins also have a one-click toggle for these.

Common WordPress exposure findings and fixes

These are the findings you’re most likely to meet in the WordPress exposure and information-disclosure categories. For a wider list of hardening steps, the official Hardening WordPress guide is the place to start.

WordPress version exposed

WordPress adds a generator tag to your page source that reveals your version. Removing it reduces information leakage, but it is not a substitute for updating. An up-to-date site is safe even when the version is visible.

// Add to a small custom plugin or your child theme's functions.php
remove_action( 'wp_head', 'wp_generator' );
add_filter( 'the_generator', '__return_empty_string' );

User enumeration via REST API or author archives

Visiting /?author=1 or /wp-json/wp/v2/users can reveal real login names, handing attackers half of a credential pair. If you don’t need public author pages or a public users endpoint, close them:

// Hide the users REST endpoints from logged-out visitors
add_filter( 'rest_endpoints', function ( $endpoints ) {
    if ( ! is_user_logged_in() ) {
        unset( $endpoints['/wp/v2/users'] );
        unset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] );
    }
    return $endpoints;
} );

// Stop ?author=1 style username probing
add_action( 'template_redirect', function () {
    if ( ! is_admin() && isset( $_GET['author'] ) ) {
        wp_safe_redirect( home_url(), 301 );
        exit;
    }
} );

XML-RPC, readme.html and sensitive files

If xmlrpc.php is reachable and you don’t use it, disable it, since it’s a popular target for brute-force attempts. Delete or block readme.html, and make sure files like wp-config.php backups, .env and .git are never served. Turn off directory listing in your server config.

Application Passwords and the login page

The login page and Application Passwords are normal parts of modern WordPress, so the scanner marks them as informational. Limit Application Passwords to accounts that need them, use strong unique passwords with two-factor authentication, and consider a firewall or CDN in front of wp-login.php. A good WordPress security plugin can handle login limits, two-factor authentication and firewall rules in one place.

Passive checker vs WordPress vulnerability scanner

“Security scanner” can mean several different things, so it helps to know what each type does and doesn’t do. Used together, they cover far more than any single tool.

This checker is deliberately a configuration audit. It isn’t a WordPress vulnerability scanner that tests each plugin for known CVEs, and it doesn’t scan for malware. Keep WordPress, plugins and themes updated, and pair this audit with a reputable security plugin or monitoring service. Our roundup of the best WordPress security plugins compares your options.

Benefits of using the free security checker

Who is it for? Site owners who want a quick health check, agencies auditing client sites before handover, developers testing a launch or staging environment, and anyone who has just changed hosting, CDN or SSL settings. After a server or database move, rescan to make sure nothing got undone. If you work with the underlying data too, our PHP to JSON converter helps you read the serialized PHP arrays WordPress stores in its options table, and the MySQL to Postgres converter is handy for planning database migrations on other projects.

What to do after the scan

• Back up first. Always take a full backup before changing server or theme code.
• Keep everything updated. WordPress core, plugins and themes. This matters more than hiding version numbers.
• Use strong logins. Unique passwords, two-factor authentication, and no default admin username.
• Choose themes and plugins carefully. Stick to maintained, well-reviewed code. Looking for a polished theme for a security or IT business? See our picks of cyber security WordPress themes.
• Add a firewall or CDN for login protection and traffic filtering.
• Scan regularly. Rerun the checker after any significant change.

Frequently asked questions