WordPress Security Check
See what attackers see, in plain language.
- No sign-up
- Read-only
- About 30 seconds
Results for
Checked . Read-only; nothing on the site was changed.
Every site we host gets a security setup when it moves in.
From January 2027, every site that moves in is reviewed and secured: behind Cloudflare, login page moved, user names hidden, passwords and administrator accounts checked. No provider can promise a site will never be hacked, but these steps close the doors attackers try first.
What it checks
The weak spots automated attacks look for first, on any WordPress site.
- WordPressConfirms the site runs on WordPress before the WordPress checks.
- Secure connectionA valid certificate, and visitors always sent to the secure address.
- WordPress versionWhether the version is shown publicly, and whether it's out of date.
- Login pageWhether it's at the default address automated attacks try first.
- User namesWhether anyone can list them. We report yes or no, never the names.
- XML-RPCAn old feature few sites need, often used for password guessing.
- Exposed filesReadable error logs and folders that list their contents.
- FirewallWhether a security network filters attacks before they arrive.
- Browser securityThe basic security settings browsers rely on.
Questions
Does it change anything on my site?
No. It only opens public pages, the same way a visitor's browser does. It never signs in, sends forms, or tries passwords.
Can I check any site?
It only looks at publicly visible information, but please check sites you own or look after.
Are the results saved?
No. Results aren't stored or shared. If the same site was checked in the last 15 minutes, you'll see that recent report instead of a new check, so the tool can't be used to flood a website.
What doesn't it check?
It doesn't scan plugins or look inside your site. Our security review when a site moves in goes much further.