Find What’s Putting Your WordPress Site at Risk
Check any website for vulnerable plugins, malware signs, speed problems and SEO gaps. Nothing to install, no login needed.
Your score shows right away. Checks public pages only, like a visitor would.
Scanning
0syoursite.com
Google speed test still running. Your score will update.
Fix These First
Now Check What the Scan Can’t See
The scan looked at your site from the outside. Six quick questions cover the inside: backups, logins, monitoring and who fixes things when they break.
- About a minute, six questions
- Your answers are added to the full report
- “I don’t know” is a valid answer, and a useful one
Get Every Check, Explained
See all 30 checks for your site, what each one means, and exactly how to fix it.
- Every plugin and theme we detected, with versions and known vulnerabilities
- Step-by-step fixes for security, speed and SEO issues
- Clear labels showing what’s confirmed and what needs a closer look
Every Check, Explained
Tap any row for details. Confirmed means we saw it directly. Likely and Possible are based on clues, so check those before acting.
Around 30 Checks Across Four Areas
The same first look I take before quoting any maintenance or cleanup job, done automatically.
Security
- Plugins and themes with known vulnerabilities
- Signs of malware, spam and cloaked redirects
- HTTPS, security headers and exposed files
WordPress Health
- Outdated WordPress, plugins and theme
- Abandoned or removed plugins
- Public usernames and XML-RPC
Speed
- Google’s mobile speed score
- Core Web Vitals and real-visitor data
- Server response and page caching
SEO Basics
- Pages hidden from Google by mistake
- Titles, descriptions, sitemap and schema
- Analytics and social sharing previews
Some Problems Only Show Up From the Inside
This scanner checks what anyone can see from the outside. A clean result is a good sign, not a guarantee. These need access to your dashboard or server:
Hidden malware
Backdoors and malicious files on the server that never show on a public page.
Database spam
Injected links and content stored in the database, sometimes shown only to Google.
Backups
Whether backups exist, where they’re stored, and whether they actually restore.
Admin security
Old admin accounts, weak passwords and missing two-factor login.
Hidden plugins
Plugins that only run in the dashboard, like backup, email and security tools.
Other pages
Forms, checkout and inner pages. This scan looks at your homepage.
Questions About the Scanner
If yours isn’t here, send it over and I’ll answer directly.
Is it safe to scan my site?
Yes. The scanner only loads public pages and files, the same way a visitor or search engine would. It never logs in, submits forms, or tries to break anything, and it sends only a few dozen requests.
How accurate are the results?
Speed, HTTPS and SEO results are very reliable. Plugin versions are often hidden, so vulnerability matches are labeled Likely or Possible rather than Confirmed. Malware checks catch visible infections but can’t prove a site is clean. That’s why every finding shows how sure we are.
Where does the vulnerability data come from?
From the Wordfence Intelligence vulnerability database, refreshed every day, plus version information from WordPress.org. Speed data comes from Google PageSpeed Insights.
My site isn’t built with WordPress. Will it still work?
Yes. Security, speed and SEO checks work on any website. The WordPress-specific checks are simply skipped.
Why do you ask questions after the scan?
Some of the biggest risks can’t be seen from outside: missing backups, logins held by a former developer, or nobody watching for downtime. Six quick questions cover those, and your answers are added to the full report.
What happens after I unlock the full report?
The full report opens straight away on this page. If you’d like help fixing anything, you can book a free 15-minute call. There’s no obligation.