Register
Prelumen Analytics

WordPress has its own attack surface. Scan accordingly.

Version exposure, vulnerable components, configuration weaknesses — a WordPress-specific audit with concrete hardening steps.

Is this your website?
  • Match your core, plugin and theme versions against known vulnerabilities
  • Find out whether wp-admin and XML-RPC are open to the internet
  • Get the version that closes each vulnerability, not just its name

Scan a WordPress site

Enter a URL and get core, plugin, theme and configuration findings with the fixing versions.

Installation detection

Identifies WordPress and its version from the REST API, the readme and the markup, without needing any access from you.

Vulnerable components

Matches core, plugins and themes against the Wordfence Intelligence vulnerability data and lists what applies to your versions.

Exposed endpoints

Probes whether wp-admin answers unauthenticated requests and whether XML-RPC is enabled and reachable.

Hardening recommendations

Every finding carries what to do about it, and every vulnerability carries the version that fixes it.

Do I need to install a plugin or grant access?
No. Everything is read from what your installation already exposes publicly. There is nothing to install and no credentials to hand over.
Are all my plugins detected?
Only those visible from the outside — through their assets, readme files or markup on the page that was scanned. A plugin that leaves no public trace stays invisible.
What if the vulnerability data is unavailable?
The check says so. It reports that components could not be matched rather than presenting an unchecked installation as clean.
Is a detectable version number a problem in itself?
Not on its own. The version matters because it is matched against known vulnerabilities — an outdated version is the finding, not a visible one.

Every check runs on our servers: you provide a public URL, there is nothing to install, and pages are rendered with JavaScript first so single-page apps are read the same way a browser reads them. Each result gets a permanent link you can share. On a website you have claimed, findings become tracked issues, and result pages offer AI summaries and developer guidance on plans that include them.