What does the WordPress check look at?

Three sections. Setup: whether the WordPress version is printed in the page, which page builder is used, whether a caching plugin and an SEO plugin are present, the jQuery version, the REST API. Plugins & theme: every plugin visible in the homepage and the theme, each checked against wordpress.org for last update, tested-up-to and install counts. Security: usernames via the REST users endpoint, XML-RPC, readme.html, debug.log, uploads directory listing, the login page, HTTPS and mixed content, and the HSTS, X-Frame-Options and X-Content-Type-Options headers.

Is this a security scan?

No. It reads public files and headers — the things a browser can open without logging in — and flags the common mistakes. It does not try passwords, probe for vulnerabilities or match versions to exploits. Treat it as a first checklist, not as an audit.

Why are usernames exposed a problem?

WordPress's REST API lists authors by default at /wp-json/wp/v2/users, which gives an attacker the login names. Combined with XML-RPC, that is everything needed to try passwords in bulk. Most security plugins close both in one setting.

Why does it say a plugin is stale?

wordpress.org shows when each plugin was last updated. Two years without an update means it may no longer be maintained — nobody fixing its bugs or checking it against new WordPress and PHP versions — and a plugin with a known hole that never gets patched is one of the usual ways into a WordPress site.

It only found a few plugins. I have more.

Only plugins that print something in the homepage (a script, a stylesheet, a block) can be seen from outside. Admin-only and backend plugins are invisible here, so the real count is higher — which is itself a reason to review them.

Can it check a site behind Cloudflare?

Usually. Cloudflare's default settings pass normal page requests; only the aggressive bot-protection modes block them, and then the tool says it could not read the site rather than guessing.

WordPress Site Check

A light, automated check — not a security scan and not the deep audit. Enter a WordPress site; we read the homepage and a few public WordPress URLs any browser can open, look every visible plugin and the theme up on wordpress.org, and report three things: how the site is set up, which plugins are stale, closed or behind, and what is exposed — usernames, XML-RPC, readme, debug log, directory listing, missing security headers. One score, a fix for each finding.

A free WordPress site check that reads your homepage and a few public WordPress URLs, looks every visible plugin and the theme up on wordpress.org, and reports the setup (version exposure, page builder, caching, SEO plugin), the plugins that are stale, closed or behind, and the light security findings — exposed usernames, XML-RPC, readme.html, debug.log, directory listing, missing security headers. One score, a fix for each. Nothing stored; not a vulnerability scan.

An out-of-date plugin is one of the usual ways into a WordPress site — and you find out when a customer tells you.

Your site, checked from outside in about 10 seconds. No login, nothing installed, nothing stored.

The page you enter is fetched once by our server (public sites only), read, and discarded — nothing is stored, and your own files never come into it.

After the check

Your site, looked after every week

Left: your site as it stands today, with whatever this check finds and the things it cannot see from outside. Right: the same site with my team looking after it. It is checked every week, a backup is taken before anything changes, and if something breaks, my team looks into it and tells you what happened.

The findings fixed, in the order they matter
Checked again every week, with a backup taken first
Someone watching: uptime, speed, what Google sees

900+ projects
since 2017: 4.9★
400+ five-star reviews on Fiverr: 9+ years
building WordPress and Next.js sites

Support is the whole team, not one person — reach us any time, and someone picks it up.

“Working with Sandipan Das was fantastic! The attention to detail and professionalism in his work was outstanding, and his proactive communication and timely delivery made the entire process smooth. He crafted the website exactly as I envisioned—highly recommend! 👍”

Indoor Pro Golf · 3-page WordPress site · the project

Schedule a Meeting

Bring what the tool found. I lead every project, and on the call we go through the list together and decide what to fix first.

Schedule a Meeting

How it works

How to use the WordPress Site Check

01Enter the site address — the homepage is enough.
02Read the three sections: Setup (version exposure, builder, caching, SEO plugin), Plugins & theme (each one against wordpress.org: last update, tested-up-to, installs, flags), Security (what is public that should not be).
03Fix the red items — most are one plugin setting or one file — or hand the list to whoever looks after the site. Doing that every month is what a care plan covers.

Good to know

What 'light' means here

Only public reads: the page itself and a handful of well-known WordPress URLs that any browser can open, plus wordpress.org's public directory. No login attempts, no vulnerability probing, no version-to-CVE matching. It finds the visible mistakes that leave a WordPress site open, without doing anything to the site.

In more depth

About the wordpress site check

How WordPress sites usually get broken into

Usually through something ordinary: an abandoned plugin with a known hole, a username taken from the REST API, XML-RPC left on so passwords can be tried many at a time, and updates left undone for months. Every one of those is visible from outside, which is what this check reads.

The fixes are small — an update, a setting, deleting a file — but they have to be done every month. That monthly round is what a care plan from my team covers.

What the score means

It is the share of checks that pass across setup, plugins and security, so a higher number means fewer findings. Whatever the number, the list under it is the plan, in order.

FAQ