WordPress audit · 8 WordPress-only checks

Free WordPress audit. 8 checks for WordPress only.

A scan focused only on WordPress. We find the typical holes that generic scanners miss: forgotten wp-config backups, a public user list, a readable debug.log and more.

Passive scan · no signup · results in 30 seconds

https://

Scan takes 30 seconds. You can request the PDF report with a button on the results page.

How it works

3 steps · 30 seconds

Enter your WP domain

We detect WordPress ourselves. You don't need to tell us the version or theme.

8 WordPress-only checks

xmlrpc, user listing over REST, author archives, debug.log, uploads directory listing, readme.html, license.txt and wp-config backups.

Results and PDF report

You see the most serious findings right away. We email you the full PDF report for free. In it we explain each finding and add a step to fix it.

What we check on WordPress

WordPress has its own typical problems. A generic scanner often misses them, so we look for them deliberately.

WP RESTcritical

User enumeration via /wp-json/wp/v2/users

Anyone can download the list of all authors, including user_login. That's halfway to a brute-force attack.

GET /wp-json/wp/v2/users → ["admin","editor"]

Exposedcritical

debug.log readable from the internet

WP_DEBUG_LOG = true writes to /wp-content/debug.log. It may contain queries, paths, sometimes passwords.

GET /wp-content/debug.log → 200 OK

xmlrpcwarning

XML-RPC is enabled

Through xmlrpc.php an attacker can try 1000 passwords in one request. 99% of WordPress sites don't need it.

POST /xmlrpc.php → system.listMethods OK

Listingwarning

Uploads directory allows listing

A visitor sees all uploaded files including invoice PDFs or test images.

GET /wp-content/uploads/ → Index of

Fileswarning

readme.html reachable from the internet

The file confirms the site runs WordPress, and on older installs it also reveals the version. Delete it or block access.

GET /readme.html → 200 OK

Backupwarning

wp-config.php.bak in root

Anyone can download your database credentials.

GET /wp-config.php.bak → 200 OK (4.3 KB)

About Vulscan

We've managed WordPress sites for clients for years and know where common plugins and themes leave weak spots. This scan looks for what we've seen used in real attacks.

hello@vulscan.app LinkedIn

Passive scan

No invasive tests. We behave like an ordinary visitor, and your site won't notice the check.

European context

We know local hosting providers, CMSes and registrars, so our recommendations are specific.

Real help

If you don't understand a finding, write to us. We'll answer.

Frequently asked questions

Does it work for multi-site WP too?+

Yes, but we scan only the main domain. For a network on subdomains or subdirectories, write to us. We'll tell you the easiest way.

Is the scan safe? Won't it damage the site?+

Yes. The scan is passive and behaves like an ordinary visitor. We don't try exploits, crack passwords or send attack requests. Your site won't notice the check.

What do you do with the data? Where do results go?+

You see the most serious findings on the site right away. You can email yourself the full PDF report with one click. We keep your email so we can alert you if a new serious finding appears on your domain. You can unsubscribe at any time.

What if you find a critical problem?+

You'll get a report where every problem is explained with a concrete remediation step. Most things your webmaster can handle. If not, write to us. We're happy to take a look.

Does it cost money? What's the catch?+

A one-off scan is free.

Free WordPress scan. PDF report with the steps to fix.

We find xmlrpc, debug.log, user listing, an exposed wp-config and other WordPress problems. For each one we tell you how to fix it.