Scan any WordPress site for exposed config files, version leaks, user enumeration, open XML-RPC and missing security headers — and get a 0–100 security score with plain-English fixes. No install, no login, no attacks.
Running security checks…
Enter a URL and the scanner runs a set of read-only checks in parallel — the same requests a browser can already make — then scores what it finds.
Type any WordPress site's address. We validate it and confirm it resolves to a real, public server before anything runs.
The server sends read-only requests to well-known WordPress paths all at once — no logins, no brute force, no exploitation.
Each result is graded Critical, High, Medium, Low or Pass, and weighted into a single 0–100 security score.
Every issue comes with a plain-English explanation and the exact step to fix it — worst problems first.
A WordPress security checker is a free online tool that scans a live WordPress site from the outside and flags common security weaknesses — like exposed wp-config backups, a publicly visible WordPress version, username enumeration, an open XML-RPC endpoint, directory listing, and missing HTTP security headers — then scores the site from 0 to 100.
This scanner runs passive checks only: it reads publicly accessible URLs the same way any browser would, without logging in or exploiting anything. For a deeper look behind the login — plugin and theme vulnerabilities, malware, file integrity — pair it with a full manual WordPress security audit.
WordPress powers a huge share of the web, which makes it the most-scanned CMS on the planet. Automated bots hammer well-known paths looking for exactly the weaknesses this tool checks — and most hacks start with a misconfiguration, not a zero-day.
An exposed wp-config.php.bak can hand over your database credentials outright. A visible version number lets an attacker match your site to a known vulnerability in seconds. Username enumeration gives them half of every login before they even start. None of this needs a sophisticated attack — just a scanner finding the door unlocked. Once you've fixed what's here, keep the site fast and lean too with a website speed test and lock down which bots can crawl it using a block-AI-crawlers tool.
Most WordPress security tools are plugins you have to install, or malware-only scanners. Here's how a free, no-install external scan compares.
| Feature | H&U Security Checker | Security plugin | No check |
|---|---|---|---|
| Install required | ✓ None — just a URL | Must install & configure | — |
| Sees what attackers see | ✓ External, outside-in view | Inside-out only | ✗ Blind |
| Config / version leaks | ✓ Detects exposed files | Sometimes | ✗ No |
| 0–100 score & fixes | ✓ Scored, with fixes | Varies | ✗ No |
| Works on any site | ✓ Scan any public URL | Only your own site | — |
| Price | ✓ Free, no signup | Free / freemium | Free |
Your grade reflects how much an attacker or automated bot could find without ever logging in.
Plain-English definitions of the weaknesses this checker looks for.
WordPress's master config holding your database credentials and secret keys. A leftover backup of it (.bak/.txt) being downloadable is the most dangerous leak possible.
A legacy remote-publishing endpoint. Often abused for brute-force amplification and pingback DDoS. Disable it if you don't use the app or Jetpack.
Tricks like ?author=1 or the REST users endpoint that reveal real login names — handing attackers half of every login.
Response headers like HSTS, CSP and X-Frame-Options that block entire classes of attack (clickjacking, XSS, protocol downgrade).
When a folder like /wp-content/uploads/ shows a browsable file index, exposing files you never meant to be discoverable.
A publicly visible WordPress version lets attackers instantly match your site to known CVEs for that exact release.
A publicly catalogued security flaw. Attackers cross-reference your software version against CVE databases to find a working exploit.
An attack that tricks a server into requesting internal resources. This tool is itself SSRF-guarded so it can't be abused to probe private networks.
No — they do different jobs, and you want both. This WordPress security checker gives you the outside-in view: exactly what an attacker or bot sees before they ever touch your login. It needs no install and works on any site, which makes it perfect for a fast pre-launch check or auditing a client's site.
A security plugin gives you the inside-out view — malware scanning, a firewall, login limiting and file-integrity monitoring behind your dashboard. The smart workflow is to scan here first to catch the exposed basics, harden them, then run a plugin for ongoing protection. When you're ready for a thorough review, our team can run a full WordPress security audit covering both sides.
Security is one layer. Pair this scan with these free tools to cover speed, crawlability and search visibility too.
Test LCP, CLS and INP against Google's thresholds — speed is a ranking and security signal.
Open tool →Find dead links and redirects that waste crawl budget and erode trust.
Open tool →Control which crawlers reach which paths — the first line of crawl hygiene.
Open tool →Run a full technical + on-page SEO audit to catch issues beyond security.
Open tool →Everything you need to know about scanning and securing your WordPress site.
/xmlrpc.php) is a legacy WordPress feature for remote publishing and the mobile app. If you don't use those, disable it — it's commonly abused for brute-force amplification and pingback-based DDoS..git and server banners) and scores those.Beyond security, H&U Solutions offers a full suite of free tools to help your site rank and perform. Every tool is live and free — no signup.
Score your page's GEO readiness and see if you'll appear in Google AI Overviews.
Open tool →Pixel-accurate SERP preview with keyword and rewrite-risk analysis.
Open tool →Generate valid FAQ, Article and Organization JSON-LD schema in seconds.
Open tool →Score your content's depth, clarity and E-E-A-T — the signals AI search rewards.
Open tool →Test LCP, CLS and INP against Google's thresholds in one click.
Open tool →Find and fix broken links that waste crawl budget and hurt trust.
Open tool →Build a clean robots.txt to control exactly how crawlers reach your site.
Open tool →Get a complete WordPress security + hardening review from our team.
Book now →H&U Solutions runs full WordPress security audits and hardening — we fix every issue this scanner finds, plus the ones behind your login.
Get a security audit →Your global digital partner. We combine creative design with robust code to build high-performance websites that drive real business growth.
Legal
Contact@hnusolutions.com
+92 309 5975615
Shop 7 & 22, 1st Floor, Khyber Plaza
02 Markaz, Jammu & Kashmir Housing Society G 15/1 G-15, Islamabad, 44150
24/7
© 2026 H&U Solutions. All Rights Reserved.
