WordPress audit · 1,800+ WP sites checked

Free WordPress audit. We find 15+ specific WP issues.

A scan focused only on WordPress. We find typical holes that generic scanners miss — forgotten backups, public user list, outdated plugins and more.

Passive scan · no signup · results in 30 seconds

https://

Scan takes 30 seconds. You can request the PDF report with a button on the results page.

How it works

3 steps · 30 seconds

Enter your WP domain

We detect WordPress automatically. No need to tell us the version or theme.

20 WP-only checks

xmlrpc, REST user enum, debug.log, uploads listing, readme.html, plugin versions, theme leaks, and more.

Results and PDF report

You'll see findings right away. Request the PDF report via the button — we explain each finding and give a concrete remediation step.

WP-specific findings we check

WordPress has its own typical problems. Generic scanners often miss them. We look for them on purpose.

WP RESTcritical

User enumeration via /wp-json/wp/v2/users

Anyone downloads the list of all authors including user_login. That's half the way to a brute-force attack.

GET /wp-json/wp/v2/users → ["admin","editor"]

Exposedcritical

debug.log readable from the internet

WP_DEBUG_LOG = true writes to /wp-content/debug.log. It may contain queries, paths, sometimes passwords.

GET /wp-content/debug.log → 200 OK

xmlrpcwarning

XML-RPC is enabled

Through xmlrpc.php an attacker tries 1000 passwords in one request. 99% of WP sites don't need it.

POST /xmlrpc.php → system.listMethods OK

Listingwarning

Uploads directory allows listing

A visitor sees all uploaded files including invoice PDFs or test images.

GET /wp-content/uploads/ → Index of

Versionwarning

WP version in meta tag

An attacker knows exactly which known vulnerability to try. Just one filter in functions.php.

<meta name="generator" content="WordPress 6.2">

Backupwarning

wp-config.php.bak in root

Anyone downloads database credentials. We see this on 1 in 30 WP sites.

GET /wp-config.php.bak → 200 OK (4.3 KB)

1,821

WordPress sites checked

612

With open xmlrpc.php

With public debug.log

About Vulscan

We've managed WordPress sites for clients for years and know where common plugins and themes leave doors open. This scan looks specifically for what we've seen in practice as a real attack — not hypothetical vulnerabilities.

hello@vulscan.app LinkedIn

Passive scan

No invasive tests. We behave like a visitor — your site won't notice we're there.

European context

We know local hostings, CMSes and registrars. Recommendations are concrete, not generic.

Real help

If you don't understand a finding, write us — a human replies, not a bot.

Frequently asked questions

Does it work for multi-site WP too?+

Yes, but we scan only the main domain. For a network of subdomains / subdirectories write us — we'll tell you the easiest way.

Is the scan safe? Won't it damage the site?+

Yes. The scan is passive — it behaves like an ordinary visitor. We don't try exploits, don't crack passwords, don't send invasive payloads. The site won't notice we're there.

What do you do with the data? Where do results go?+

You'll see the results right on the site and can then email yourself the PDF report with one click. We keep your email so we can alert you if a new serious finding appears on your domain. You can unsubscribe at any time.

What if you find a critical problem?+

You'll get a report where every problem is explained with a concrete remediation step. Most things your webmaster can handle. If not, write us — we're happy to take a look.

Does it cost money? What's the catch?+

A one-off scan is free.

Free WordPress scan. PDF report with plugins and code.

We find xmlrpc, debug.log, user enum, exposed wp-config and 15+ other WP-specific problems. For each we say specifically which step leads to the fix.