WordPress Security Check
A read-only external scan for leaked version numbers, exposed backups, missing security headers and a few well-known information leaks.
What it checks, and its limits
This runs the same handful of checks a real attacker's first, automated pass would run: whether HTTPS is enforced, which security headers are set, whether a backup file or readme.html leaks your WordPress version, whether the REST API lists usernames, and whether xmlrpc.php is reachable. It's entirely read-only and external, the same view a stranger's browser gets.
It can't see anything behind a login, scan your files for malware, or check for a known vulnerability in a specific plugin version. For that, use a dedicated security plugin (Wordfence, Sucuri) that can see inside the server.
Fixing what it finds
- Missing security headers: see the hardening rules generator for ready-made Apache/Nginx rules, including a Content-Security-Policy pre-filled for Stripe, PayPal and Google Pay.
- A leaked WordPress version: remove the generator meta tag, and block or delete readme.html at the server.
- An exposed backup file: delete it immediately; if it contains real database credentials, rotate them.
- REST API username exposure: WordPress's own position is that this isn't a vulnerability by itself, but a security plugin can restrict it if you'd rather not expose it.
Questions people ask
Does a low score mean my site is hacked?
No. It flags missing hardening and information leaks, not signs of an active compromise. A brand-new, unmodified WordPress install can still score poorly here simply because nothing extra has been hardened yet.
Should I disable XML-RPC?
If you use Jetpack, the WordPress mobile app, or another tool that needs it, no. Otherwise, blocking it removes a common pingback-based brute-force target; WordPress's own xmlrpc_enabled filter or the hardening generator's server rule both do it.
Why does it flag readme.html as a problem?
It's WordPress's default file and, unless blocked, states the exact core version. That's a small piece of reconnaissance an attacker doesn't need to work for.
Is REST API user enumeration really a security issue?
WordPress core's official stance is that it's not a vulnerability by itself, since usernames aren't secret. It does hand a would-be attacker a list of real usernames to try passwords against, which is why many stores restrict it anyway.
Related tools
Want this builtinto your store?
I'm Emmanuel, a Shopify and WooCommerce developer. If this tool pointed at something you'd rather have fixed for you (a faster store, cleaner product data, a migration, a custom feature), send me a note.
Emmanuel Asika
Shopify & WooCommerce developer, Dublin
I build and fix online stores: new builds, migrations, speed, SEO and the custom bits apps can't do.
Last reviewed 30 September 2026.