WordSec VS WordPress Security Scanner

• Firewall
  Inspect every request, write your own rules, and harden WordPress with one-click toggles. - Multi-condition custom rule builder with regex and wildcard matching - Built-in rules across the major attack categories (SQL injection, XSS, path traversal, PHP and command injection, and more) - WAF learning and active modes, bot blocking and security headers - 25+ one-click hardening toggles for wp-config access, author enumeration, REST API and more - Optional Extended Protection: pre-WordPress request inspection via an auto_prepend_file bootstrap - Endpoint rate limiting, XML-RPC protection and detailed firewall logs
• Scanner
  A seven-stage scanning system that examines files, the database and scheduled tasks. - Malware detection rules (synced from the WordSec service) based content scanning - WordPress core, plugin and theme file-integrity verification (via the WordPress.org API) - Scheduled scans with batch processing to avoid timeouts - One-click quarantine and restore, with complete scan history
• Login Security
  - Role-based two-factor authentication (RFC 6238 TOTP), no external library required - Three CAPTCHA providers (reCAPTCHA, hCaptcha, Cloudflare Turnstile) plus a built-in math CAPTCHA - Brute-force protection with progressive lockout and honeypot traps - Leaked-password checking (Have I Been Pwned, k-anonymity) and Argon2 password enforcement - Session management and a custom login page designer
• Live Traffic
  - Real-time request logging (IP, URI, method, status, response time) - Safe request and response inspection with automatic bot detection - Exclusion filtering by role, IP, country or URI, with CSV export
• Blocking
  - Country and continent allow or block lists - Single IP and CIDR range blocking, temporary or permanent, with allow-list support - Automatic abuse protection and endpoint rate limiting - Custom block messages
• Supply Chain
  - Reputation scoring for every installed plugin and theme - Known-vulnerability alerts (data from the WordSec service) for core, plugins, themes and PHP - Abandoned plugin and theme detection - Update-integrity verification with automatic backups and a full SBOM inventory
• Audit Log
  - Complete activity tracking across 11 object types and 14 actions - Content, plugin, theme and setting changes - Fast filtering and one-click export
• Alarm
  - 36 event types across six categories - Delivery by Email, Telegram or Slack - Basic, Advanced and Full alert modes

• Comprehensive Security Check
  The WordPress Security Scanner provides a thorough analysis of the website's vulnerabilities, helping identify potential security risks such as outdated plugins or weak passwords.
• User-Friendly Interface
  The tool has an accessible and straightforward interface, making it easy for users of any technical background to navigate and run scans without any hassle.
• Quick Scanning
  The scanner performs security checks rapidly, allowing users to receive results and take action promptly to mitigate potential risks.
• Real-Time Monitoring
  The scanner includes real-time monitoring capabilities, providing continuous security checks to ensure the WordPress site remains protected against new threats.

Possible disadvantages

• Potential False Positives
  The scanner might occasionally flag non-issues or safe plugins/themes as risks, which could lead to unnecessary concerns or effort to investigate.
• Limited to WordPress
  The tool is specifically designed for WordPress websites, which limits its utility for users managing different CMS or custom websites.
• Possible Overlap with Hosting Security
  For users whose hosting providers already offer robust security features, the scanner might provide redundant or overlapping functionality.
• Subscription Costs
  Access to some advanced features of the security scanner might require a subscription or one-time fee, which could be a barrier for cost-sensitive users.

No WordSec videos yet. You could help us improve this page by suggesting one.

WPScan WordPress Security Scanner

Tracking WordSec since Jul 2026.

• My web site can't be found by the geekflare security scanner anymore - seems like a good thing

  I had my website deployed as a virtual host using web station. Then I moved it into a virtual DSM where I setup web station and backends etc. Exactly the same (restored a hyper backup of web station and website files/databases into the... Source: about 4 years ago