Free tool
Free WordPress Security Check
Type your site's address and see what an attacker sees: an open login page, exposed usernames, missing headers. A score out of 100 and a plain fix for each finding, in about ten seconds.
What it looks at
What the WordPress security check tests
Only what is public. These are the same first checks automated attack tools run against millions of WordPress sites every day.
HTTPS and HSTS
Is every visit encrypted, and are browsers told to never fall back to plain http?
Security headers
Clickjacking, MIME sniffing, referrer and browser feature protection, plus a Content Security Policy.
What WordPress gives away
Your version number, usernames through the REST API and author pages, and open folder listings.
Doors bots knock on
Whether the default login page and XML-RPC are open to anyone who asks.
Questions
WordPress security check: questions
Is this WordPress security check really free?
Yes. There is no sign-up and no limit beyond a few checks every few minutes to stop abuse. We built it so site owners can see in seconds what attackers see.
Does the WordPress security check change or store anything on my site?
No. It reads public pages the same way any visitor or search engine does. It never signs in, never submits forms and never tries a password. We do not keep the address you check or the results.
Can it find malware?
No. Malware hides in files that are not public, so no outside check can find it reliably. Stack Guard's malware scanner runs inside WordPress and compares your files with the official copies.
Why does my site score low when it has a security plugin?
Many security plugins leave the login page, XML-RPC or user listing open by default, and most do not send security headers. The check shows what is actually reachable, whatever is installed.
How do I fix what the check finds?
Each finding links to a plain fix. Stack Guard Free can hide the login page, turn off XML-RPC, block user listing, hide the version and send the core headers, each with one switch.
Fix every finding in a few clicks
Stack Guard Free closes the open doors this check finds. No key, no sign-up, every site.