WordPress & public exposure
Visible WordPress version signals, exposed configuration or backup files, directory listings, and publicly discoverable usernames can point to areas worth reviewing. Detection is limited to what the site makes visible.
AMBRITE / FREE WEBSITE TOOL
Free WordPress Security Scanner
See what your website reveals.
Decide what to do next.
Check your WordPress website for publicly visible security and configuration issues. Get the findings, the context, and a practical place to start.
Ready when you are. Enter your website address above.
YOUR PRIVATE SCAN
The findings.
The next move.
Reports are private to this browser session, not public share links. Backend reports are retained for 7 days. Save a copy if you need it later.
Want help acting on this? Ambrite can take care of updates, backups and monitoring, or answer a question about a finding.
WordPress maintenance & security plans Ask about a findingAn external snapshot, not a guarantee of security. “Compliant” applies only to the named check. Unavailable, skipped or inconclusive checks are not passes. Review the evidence before changing a live site; back up and test changes first.
01 / KNOW WHAT YOU’RE LOOKING AT
Small signals.
Useful questions.
The WordPress security checker looks at information available from outside your site. The report shows which checks returned evidence and which could not be completed.
Connections & configuration
TLS, browser security headers, XML-RPC, and visible firewall or CDN signals help you understand your public setup. A missing signal does not prove a protection is absent; your host or developer can confirm it.
Reputation & supporting checks
Reputation services may flag known unsafe activity. The engine also includes supporting website checks, such as mobile performance and privacy-policy visibility. External providers may be unavailable or unconfigured; those results stay inconclusive.
This is not an authenticated plugin inventory, internal file inspection, penetration test, or malware-removal service. No scan result proves that a site is infection-free.
- 01
Enter your full website address
Use the public http or https URL for a WordPress website you are authorized to test. You do not need to provide a WordPress password or install a plugin.
- 02
Follow the actual scan state
A browser verification helps limit automated abuse. Your request then joins the scan queue. The page reports queued, running, and completed states from the scanner, not an estimated percentage or a countdown.
- 03
Read, save, and decide
Open a finding to see its description and evidence. Filter the checks, save your private JSON or PDF report, and take the questions to your developer or hosting provider.
03 / CONTEXT BEFORE CONCLUSIONS
A finding isn’t
a diagnosis.
Use the report to decide what to investigate, not to measure how “safe” your business is. Different checks have different consequences.
Deficient / needs review
The check identified a potential issue or a configuration that did not meet its criteria. Read the evidence and confirm it. A missing header and an exposed backup are not automatically the same level of risk.
Compliant
The check met its criteria at scan time. That is useful evidence for that check, not a statement that every plugin, account, file, or connection is secure.
Inconclusive / unavailable
A blocked request, timeout, missing provider, or limited public information can leave a check unresolved. Do not count it as a pass. Follow up through your host or an authenticated review.
Severity is shown only when supplied by the scanner. An unassigned severity is not silently promoted to “critical.”
THE REASON TO KEEP LOOKING
Your website is part
of your business.
Look after both.
A compromised WordPress site can interrupt enquiries, damage trust, or expose customer information. Outdated software and forgotten configuration changes can create opportunities long before you notice a visible problem.
A public scan is one useful checkpoint. Regular updates, tested backups, access controls, and monitoring are ongoing work. Keep that routine even when a scan returns no deficiencies.
LEARN / THE DETAILS
Before you scan.
After you scan.
Is this WordPress security scan really free?
Yes. The public scanner is free, with no email gate or WordPress installation required. To keep capacity available, the service limits public scans to 3 per IP address per day, 2 per domain per day, and 60 total per day, with one active scan per IP. Shared networks may reach the IP limit together.
Does it check every WordPress plugin for vulnerabilities?
No. The scanner inspects publicly visible information. It does not log in, inventory every installed plugin or theme, inspect your database, or review every server-side file. An authenticated review and a reliable update process are needed to understand those areas.
Can it tell me whether my website has malware?
Reputation checks can report known unsafe activity when their providers return data. They cannot rule out hidden malware. If you see unexpected redirects, new admin users, or altered files, investigate with your host or developer even if public checks are compliant.
Why was WordPress not detected, or a check inconclusive?
The site may not run WordPress, may hide its platform signals, or may block automated requests. Provider outages and timeouts can also prevent a check from finishing. Unsupported detection does not mean the site is insecure, and inconclusive checks are not counted as successful checks.
Who can see my report, and how long is it kept?
Results and downloads are tied to your browser’s private scanner session. There is no public report-link feature. Reports are retained by the backend for 7 days; your browser session may end sooner. Downloads are available only while the session can access the report. Treat downloaded reports as potentially sensitive and share them deliberately.
Does the scan change my website or send data elsewhere?
The scanner makes external requests to your website and uses server resources; it does not install software or apply fixes. Only scan sites you own or have permission to test. Some engine checks use external reputation, performance, or analysis services and may submit the website address or public page content to those providers. Do not submit private or sensitive URLs.
How long does a scan take?
It depends on the queue, the target website, and the checks that respond. The page shows the state reported by the backend. A blocked or unreachable site can fail instead of returning findings. If the connection is interrupted, use the status retry control rather than starting the same scan again.
What should I do with the findings?
Review the descriptions, evidence, and any supplied recommendations. Confirm potential issues with your developer or host, back up first, and test changes before applying them to a live site. For ongoing help, see Ambrite’s WordPress maintenance and security plans or ask a question.