scan.now
Premium Scan a site

Scan a WordPress Site for Vulnerable Plugins, Themes and Core

Enter a WordPress site. Scan.now reads its REST route index, page markup and readme files to identify the plugins, theme and core version, then matches every version against a Wordfence-derived database of 43,000+ known vulnerabilities. No payloads, no login attempts.

Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use

43,199 vulnerability records and 5,344 plugin route signatures loaded, refreshed 47 h ago. Data from Wordfence Intelligence, © Defiant, Inc.

Illustration of the wordpress vulnerability scanner in use

How it works

  1. Fingerprint the install

    The REST route index (/wp-json/ and ?rest_route=/) is matched against 5,300+ plugin route signatures, and slugs are pulled from wp-content paths in the HTML.

  2. Read the versions

    Each plugin's readme.txt gives its Stable tag; the theme's style.css gives its version; core comes from the generator tag, asset URLs or readme.html.

  3. Match known CVEs

    Every version is checked against the vulnerability database. Findings list each CVE with its CVSS score, whether exploitation needs a login, and the version that fixes it.

Wondering how this stacks up against the tool you already use? We wrote up how this compares with Sucuri SiteCheck, including the things it does better than us.

After this one, most people run Website Scanner, SSL / TLS Checker, or Security Headers. Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

9 min read · Updated Sep 15, 2026 Scanning a WordPress Site for Vulnerabilities: What Attackers Look For First

WordPress runs a large share of the web and is attacked accordingly. What an external scan reveals about a WordPress site, from version...

Read the guide 9 min read · Updated Sep 12, 2026 Exposed Files: .git, .env, Backups and Debug Pages That Leak Your Site's Secrets

Many breaches start with a file that should never have been public: A .git folder, a .env with database credentials, a backup archive or...

Read the guide 9 min read · Updated Sep 16, 2026 CVE and CVSS Explained: How Vulnerabilities Are Named, Scored and Prioritised

Every public vulnerability gets a CVE identifier and usually a CVSS score. How the numbering works, what the score measures and does...

Read the guide 9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide 8 min read · Updated Sep 20, 2026 Outdated JavaScript Libraries: Why Old jQuery and Angular Are a Real Risk and How to Find Them

A page that ships an old library ships its known vulnerabilities. How Retire.js-style detection works, the most common vulnerable...

Read the guide 13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide

Frequently asked questions

How are plugins detected without logging in?

WordPress publishes a REST route index at /wp-json/ that every installed plugin adds its own routes to. Matching those routes against a database of known plugin signatures identifies what is installed, a technique the open-source WPProbe project developed. Slugs in wp-content paths and readme.txt files fill in the rest.

Where does the vulnerability data come from?

A processed copy of the Wordfence Intelligence feed, redistributed by the WPProbe project and refreshed daily. It covers plugins, themes and core, with an affected version range, CVE, CVSS score and whether exploitation needs authentication for each record.

A plugin is listed but I do not have it installed. Why?

Some plugins register identical REST routes, usually because they are forks or share a framework. Those are marked ambiguous in the report with the alternatives listed. A low confidence percentage means only a few of the plugin's known routes matched.

My plugin version is not shown.

Version detection reads readme.txt from the plugin directory. Hosts that block direct file access, or plugins that ship no readme, leave the version unknown, so we cannot say whether it is vulnerable. That is reported as unknown rather than guessed.

Is this the same as WPScan?

The goal is similar; the method is passive only. Scan.now never attempts logins, never enumerates users by brute force and never sends exploit payloads. It reads public files and the public REST index.

How current is the vulnerability database?

It is refreshed by a daily job on the server. The report footer shows the age of the data used for that scan.