Is your WordPress site secure enough? Find the flaws in your website and fix them before someone misuses it.
The latest research by SUCURI shows 90% of scanned WP sites were infected with one or more vulnerabilities.
There are plenty of online scanners to check the common web vulnerabilities, but that may not be sufficient as a security risk may arise from WordPress core, plugin, theme or misconfiguration.
For that, you need a specialize security scanner which not just detect the common but also particular to WordPress vulnerabilities.
The following scanner can help you to audit your website and let you know for security risk. So you can take necessary action to prevent from being hacked.
WordPress Security Scanner Tools
WordPress Security Scan
WordPress check by Hacker Target test for a vulnerable plugin (1800+), outdated WordPress version, web server configuration and the following.
- Google safe browsing test
- Directory indexing
- Admin account status (enabled/disabled)
- Hosting provider reputation
- Vulnerable themes (2600+)
- Basic level of brute force
Hacker Target downloads a few pages from the URL and examines the HTTP header and HTML code.
SiteCheck by SUCURI helps to quickly find out if the site is blacklisted, infected with known malware or using outdated software stack.
You can also install their plugin to initiate the scan from your WordPress admin dashboard.
And if you are not just looking for one time but continuous protection and performance then I would recommend checking out SUCURI services. Their popular WAF is two-in-one. You get a global CDN and cloud-based web application firewall to protect from DDoS, OWASP top 10 and more.
Detectify is enterprise vulnerability scanner which tests for more than 500 vulnerabilities including OWASP top 10 & WordPress specific.
If you are running an enterprise-level of business on WordPress and looking for complete vulnerability scan, then Detectify would be a good choice. They offer 14-days trial so explore their platform to see if it works for you.
WPScan cover more than 6100 vulnerabilities database. If you are looking to use WP Scan on your server/PC, then you may refer this guide about how to install and use it.
Ninja security is a plugin, so a test is done from within your WordPress admin. It checks for more than 50 metrics with one click, and you get a detailed report including test name, status, how-to fix & results.
It took less than 2 minutes to scan my site and got the excellent report covering the latest version, database connectivity exposure, a connection over SSL, etc.
It enumerates the plugin, theme, users and fingerprint the WordPress version.
Exploit Scanner is a plugin which you got to install within your WordPress site. It scans for files, database, comments for anything suspicious.
If you suspect your WordPress is compromised, then this would be very handy to run a quick scan to find anything hidden/malicious.
It doesn’t remove/change anything.
WP Loop performs 11 basic checks covering information leakage, enumeration & file accessibility.
- WP, PHP version disclosure
- html, install.php, upgrade.php accessibility
- Login enumeration
- Windows live writer and EditURI link
If you have a just setup WordPress site, then it would be a good place to start testing & securing.
WP Neuron tool scan WordPress vulnerabilities in core files, plugins, libraries. It also enumerate weak password to test brute force attacks and scan all code to ensure none of the scripts is exposed to online threats.
Quttera plugin scan your WordPress site for known and unknown malware and suspicious activity. You can initiate the scan from your WordPress admin dashboard, and it will make an HTTP call to Quttera to scan and get the results.
Along with malware lookup, it also does the following.
- Check if URL is blacklisted
- No signature or pattern detection
- Inject PHP shells detection
- External link detection
- Investigate WordPress core files
I hope above WP scanner helps you to find the online threat so you can prevent from being hacked. If you find your site is hacked or having a malicious code and not sure how to fix that, then you may try professional help from SUCURI.