wordpress vulnerability scanner

This check answers a narrow, useful question from outside the site: is this WordPress, which version is it, and is that version old enough to be a problem? It does not log in, does not attempt any exploit, and does not touch anything a normal visitor cannot reach.

Why version age is the whole story

WordPress vulnerabilities are public by design. When a security release ships, the fix is documented and the flaw it fixes becomes a published recipe. A site running a version below the current supported branch is not theoretically at risk; it is running software whose weaknesses are written down and automated. Most compromises are not targeted — they are bots walking address lists, fingerprinting versions exactly like this check does, and trying the published exploit against everything that matches.

What gets found from the outside

Version information leaks from more places than most owners realise: the generator meta tag, readme files, the RSS feed, asset query strings on core CSS and JavaScript, and the REST API. Removing those markers is worth doing — it takes you off the easy list — but it is cosmetic on its own. A bot that cannot read your version will simply try the exploits anyway. Hiding the number is not the same as fixing the software.

The part an external check cannot see

Most real WordPress compromises come through plugins, not core. Core updates itself well; plugins are installed once and forgotten, abandoned by their authors, or left active after the feature that needed them was dropped. An outside scan cannot enumerate your plugin versions reliably and should not pretend to. Treat a clean result here as "the front door is not obviously unlocked", then go and look at the plugin list in the admin, remove what is unused, and turn on automatic updates for what remains.

A sensible response to a bad result

Update core first, from a backup, on a staging copy if the site earns money. Then audit plugins and themes: remove anything inactive, replace anything unmaintained, update the rest. Then reduce the attack surface — restrict admin login, remove unused user accounts, and stop editing files from the dashboard. Then keep watching, because the version that is current today will be behind in six weeks.