WordPress Security Scan

Online WordPress Security Scanner to test vulnerabilities of a WordPress installation. Checks include application security, WordPress plugins, hosting environment and web server.

On this WordPress security testing page there are two options. The first is a passive (safe) check that downloads a few pages from the website and performs analysis on the raw HTML code. The second option is a more aggressive active scan that attempts to enumerate all plugins, and users with the WordPress auditing scripts included with Nmap.



Option 2: Enumerate Plugins and Users
Login to access the WordPress Enumeration Tool

Membership is required to use this online security scanner. Immediate access is available to new members or login now if you already have an account.


New features and options are in the works for our WordPress Security testing capabilities. Hit up the mailing list below or follow on Twitter for updates.

       
  • Aggressively discover the WordPress plugins installed on a site. Utilizes a database of over 18000 plugins during testing.

  • This brute force method of discovery will discover plugins that are enabled and those that are not active (but still may be vulnerable).
  •    

  • Enumerate users of a WordPress installation, as a possible precursor to a brute force attack against those users passwords.


About the WordPress Security Scans

The basic security check will review a WordPress installation for common security related mis-configurations. Testing with the basic check option uses regular web requests. The system downloads a handful of pages from the target site, then performs analysis on the resulting html source.

The more aggressive enumeration option attempts to find all plugins that are being used on the WordPress installation and can attempt to enumerate users of the site. These tests will generate HTTP 404 errors in the web server logs of the target site. If you test all plugins, be warned that this will generate more than 18000 log entries and potentially triggered intrusion prevention measures.

About WPScan, this tool was previously used on our site but due to licensing changes we have had to remove this tool. Note that it is still freely available (with licensing restrictions). Install WPScan yourself with this guide for Ubuntu.

Comparing the Options

Option 1: Security checks in Passive scan:

  • WordPress Version Check
  • Site Reputation from Google
  • Default admin account enabled
  • Directory Indexing on plugins
  • Sites Externally linked from main page (reputation checks)
  • List WordPress Plugins detected through basic HTML analysis (try the Active enumeration option for more aggressive discovery of plugins).
  • Javascript linked
  • iframes present
  • Hosting Reputation and Geolocation information

Option 2: Enumerate Plugins and Users:
The active Nmap NSE script option requires a current membership.

  • Uses the Nmap NSE scripts for WordPress auditing
  • Identify plugins in /wp-content/plugins/ from a database of over 18000
  • Enumerate up to 50 user names



Wordpress SecurityWordPress is the worlds leading content management system. This makes it a popular target for attackers.

Analysis of compromised WordPress installations, shows that exploitation most often occurs due to simple configuration errors or through plugins and themes that have not had security fixes applied.

The checks performed by our WordPress security scan will point out any obvious security failures in the WordPress installation. As well as providing recommended security related configuration improvements to enhance the security of the website against future attacks.