Does your WordPress site have known security holes?

Almost every known WordPress vulnerability is in a plugin or theme, and a published one is exactly what automated attack scanners look for. We find your WordPress version, plugins and theme, and check each one against Wordfence's database of known vulnerabilities.

Every plugin and theme your pages load, and its version
Each known vulnerability, how serious it is, and the version that fixes it
What has no fix at all, so you know what to replace
Checked against data Wordfence updates daily

Run your free check

What an attacker's scanner sees.

Every WordPress site shows the outside world which plugins and theme it runs, and usually their versions, in the files its pages load. Automated scanners read exactly that and look it up against lists of known vulnerabilities. This check does the same, so you see it first.

It only reads public files, the same ones any visitor's browser loads, and it never tries to break in. It cannot see code on your server, plugins that load nothing on public pages, or anything behind a login. A clean result means nothing on the outside is known to be vulnerable. For a review of the code itself, we scope it and send a fixed estimate you approve before any work starts.

WordPress check FAQs

No. It checks the versions of WordPress, your plugins and your theme against known vulnerabilities, which is how most sites actually get broken into. Reading custom code for security holes is a code review, and we do those too: we scope the job and send a fixed estimate you approve first.

Yes. It loads a few of your pages and reads public files like a plugin's readme, the same requests any browser or search engine makes. It never logs in, submits forms or tries an exploit.

Wordfence Intelligence, the database behind the Wordfence security plugin. It covers WordPress core, plugins and themes, and we refresh our copy every day.

The plugin does not show its version in public files, so we cannot tell which known issues apply. We still list any vulnerability with no fix at all, since that affects every version, and tell you how many older ones were fixed so you can confirm you are up to date.

Usually because a plugin has a vulnerability with no fix released yet, or because it was abandoned by its developer. Updates cannot help with either; replacing the plugin can.

Yes. We update or replace the affected plugins and theme and test the site afterwards. If you would rather it never comes up again, Site Care keeps WordPress, plugins and theme patched every month.