Free WordPress security check
Scan any WordPress site for machine-detectable hardening issues — version disclosure, user enumeration, XML-RPC, exposed files, security headers and HTTPS. Non-intrusive, no signup, results in seconds.
A security check across four key areas
Enter any WordPress URL and we run deterministic, non-intrusive checks — only public GET requests, never exploitation — then score them and explain how to fix each issue. We also flag, honestly, what still needs a hands-on audit. This is not a penetration test.
🔎 Information disclosure
readme.html, debug.log, directory listing and version numbers leaked in the source — the clues attackers use first.
🚪 Access & exposure
User enumeration via REST and author archives, XML-RPC, and publicly readable wp-config backups.
🧱 Security headers
Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
🔒 Transport security
HTTPS, mixed content, HSTS and server-software version disclosure.
Three steps to a clearer picture
1. Enter your URL
Paste your WordPress site address and run the scan.
2. We analyse it
We fetch the page plus a few non-intrusive probes and run 16 deterministic security checks.
3. Read your report
Get a security score, per-area results, fixes, and what still needs a hands-on audit.
Hardening is a checklist, not a verdict
This scan looks at what any visitor can see without logging in: version numbers in the page source, readable backup files, open XML-RPC, usernames exposed through the REST API and the headers your server sends. None of that is a vulnerability on its own. It is the information an attacker uses to choose which known weakness to try first.
So we treat a clean result as a good start, not as proof of safety. Plugins, accounts and server settings still need a human review, and that is a different job from a public scan.
The order we fix things in
- Remove what advertises your setup: version strings, readme files, debug logs and directory listings.
- Close what you do not use: XML-RPC, user enumeration and public copies of configuration files.
- Send the headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
- Force HTTPS everywhere and add HSTS once you are sure nothing still loads over plain HTTP.
Questions we get
Yes. It is non-intrusive: it requests public URLs and reads the responses, and it does not try to log in or exploit anything.
No. It means the machine-detectable hardening items passed. It does not review plugin code, user accounts or your hosting.
We can. Most of them are small configuration changes, and we will tell you which ones matter for your setup.
Want a full security audit?
Automated checks see only the outside. AutCode's engineers harden your WordPress end-to-end — plugins, accounts, server config and a malware scan — and set up monitoring and backups. Send us your scan for a free quote.