Is your WordPress site exposed?
We read the WordPress version, theme and plugins your homepage reveals and match them against the WPScan database of known security issues. It takes about 15 seconds and never touches your login.
Quick check
Your website
Not checked yet
Enter your website and this sheet fills itself in. Try a competitor’s site too.
- Platform
- —
- Theme or builder
- —
- Plugins on the homepage
- —
- Known security issues
- —
- Server response
- —
- Homepage weight
- —
- Words ChatGPT’s crawler reads
- —
- AI crawlers blocked
- —
- Description and structured data
- —
Request received
- Report within 24 hours Reviewed by a person
- No WordPress login We work from the public site
- Same URLs 301 redirects where a page moves
- Changes in 1 business day Just email us
How the check works
WordPress sites tell the browser a lot. The generator tag, the feed, and the file addresses under /wp-content/plugins/ and /wp-content/themes/ reveal the core version, the theme, and each plugin the homepage loads. Often the version number is there too.
We match what is visible against the WPScan database of known WordPress vulnerabilities. If your version is already patched, the issue is left out.
Why this matters for a small business site
Most WordPress security problems are in plugins, not in WordPress itself. In 2025 researchers logged 11,334 new WordPress vulnerabilities. 91% of them were in plugins, and 46% had no fix from the developer when they went public (Patchstack, 2026).
Every plugin on your site is one more thing someone has to keep updated.
The other way out
Updating fixes today’s list. A static HTML site has no WordPress login, no database and no plugin folder on the public web, so this whole class of problems has nothing to attach to.
Your hosting and domain still need ordinary care. We won’t call any website unhackable.
Questions about this check
Does this scan try to break into my site?
No. It loads your public homepage, your public feed and REST index, and robots.txt, the same files any visitor’s browser can load. It never tries passwords, user names or hidden folders.
Why might a plugin I use not show up?
We only see plugins your homepage actually loads. A plugin that runs only in the admin area, or only on other pages, stays invisible from the outside. The full report covers more of the site.
A known issue is listed. Has my site been hacked?
Not necessarily. It means the version your site shows has a published flaw. Attackers scan for exactly these versions, so update or remove that plugin soon. If the version is hidden, we list recent issues as possible matches.
Other free checks
- Can ChatGPT read your website?Find out in about 15 seconds which AI crawlers your robots.txt shuts out, and how much of your homepage they can read without running JavaScript.
- Is your page builder slowing you down?We detect Elementor, Divi, WPBakery and other builders, then measure your homepage’s weight, its script and style files, and how fast your server answers. About 15 seconds.
- Is this site built on WordPress?Enter any address to see whether it runs WordPress, plus the version, theme, page builder and plugins its homepage loads. About 15 seconds.
Tired of keeping WordPress alive?
We move business sites to fast, plain HTML with the same pages and URLs. You email changes and a person ships them within one business day. It starts with the free report.