Look at your WordPress site the way an attacker does

What we check

The standard scan is open to everyone. The deep scan also probes sensitive file paths, so it only runs on a domain whose ownership you have verified in your account.

The standard scan requests at most 10 URLs, the deep scan at most 48. All of them are read-only (GET) requests; the content of a sensitive file is never stored, only its path appears in the report.

• Core version

  The version is matched against WordPress core vulnerabilities, branch by branch.

  Standard

• Plugins and their versions

  Every plugin brings its own vulnerabilities; a readable version makes the match exact.

  Standard

• Themes

  The active theme and child theme are matched against the same directory.

  Standard

• wordpress.org status

  Was the plugin removed from the directory, is the installed version behind the latest, does WordPress.org mark the core version as insecure?

  Standard

• HTTPS redirect

  A site left on HTTP carries session cookies and passwords in clear text.

  Standard

• Username exposure (REST API and author archive)

  Leaked usernames make password-guessing attacks easier.

  Standard

• User registration

  With open registration, plugin flaws that need a “subscriber” become exploitable from outside.

  Standard

• XML-RPC

  Allows many password guesses per request and pingback abuse.

  Standard

• readme.html

  A leftover install file that tells what the site runs.

  Standard

• Directory listing (uploads)

  Every uploaded file can be browsed without guessing URLs.

  Standard

• Pinning plugin and theme versions

  readme.txt and style.css are read; “possible” records become “confirmed” or “clean”.

  Deep

• wp-config backups

  Can the database password and secret keys be downloaded?

  Deep

• debug.log

  Contains file paths, queries and sometimes personal data.

  Deep

• Database backup and backup folders

  All content and user password hashes; are backup-plugin folders listed?

  Deep

• .env and .git

  Can passwords, API keys and source code be downloaded?

  Deep

Open data and feeds

Use our WordPress vulnerability data in your own tooling. Fields derived by Noroxi (component mapping, access level, fix status) are CC BY 4.0: with attribution, commercial use is fine. No output contains exploit code or links.

What is free, what paid plans add

Scanning, reports and the directory are free. Paid plans add more frequent re-scans and more sites.

Without an account you can still run 3 passive scans per day.

See plans

Limits and what we do not do

• A passive scan only sees components the site reveals; plugins that leave no trace on the front end are not listed.
• Records for a component whose version cannot be read stay “possible” and never affect the score; we do not guess versions.
• No password guessing, no form submissions, no exploitation attempts. We infer a vulnerability from the version, not by exploiting it.
• If a firewall returns a challenge page, the report says so; we do not impersonate a browser.
• Government domains are never scanned in any mode.
• The access level is read from the record's text, otherwise from CVSS; when neither says, it stays “unknown” and no discount is applied.
• “No fix seen” is only stated when the record explicitly lists the latest wordpress.org release as affected. No such claim is made for components that are not on wordpress.org (paid ones); status data is refreshed regularly and the check date is shown on the component page.
• This is not a penetration test: business logic, authorization and custom-code flaws are out of scope.

Frequently asked

Can the scan harm or slow down my site?

No. The standard scan sends one read-only request to each of at most 10 URLs, no different from a visitor opening a few pages. It writes nothing and never tries to log in.

Can I scan someone else's site?

The standard scan only requests URLs anyone can open in a browser, so it does not require ownership. The deep scan, which probes sensitive file paths, only runs on a domain you have verified.

What is the difference between “confirmed” and “possible”?

Confirmed: we read the component's version and it falls inside the affected range. Possible: the component is present but its version could not be read; you may not be affected. Possible records do not lower the score.

I hide version numbers. What will you see?

Less. If we see a component but cannot read its version, its records are shown as “possible”. Once you verify the domain, the deep scan reads the version from the plugin's own readme.txt.

Are results stored, and who can see them?

Every scan is saved and gets an unguessable link. Only someone with the link can open the report; report pages are closed to search engines.

How do I hear about a new vulnerability?

Add the site to your watch list. We re-scan weekly on the free account and daily on Pro and Team; if the number of confirmed vulnerabilities rises, you get a notification in your account and in your daily email digest when it is enabled.

I do not want my site scanned.

Requests come with the NoroxiWP user agent; you can block that name on your server or firewall. A site that blocks it returns no scan result.

Where do labels like “unauthenticated” or “subscriber+” come from?

From the record's own text. WordPress vulnerability records usually state the required role (e.g. “subscriber-level access and above”). When the text names no role we use the CVSS “privileges required” field and only say “login required” or “high privilege”; we do not invent a role name. If registration is open on your site, “subscriber+” issues are moved up as issues anyone can try.

The report says “closed on wordpress.org”. What should I do?

The plugin was removed from the official directory (the report shows when and why) and no longer receives updates. It keeps running on your site but its vulnerabilities will not be fixed. Remove it or move to a maintained alternative.

Is there an API, feed or MCP tool?

Yes. Keyless RSS and JSON feeds carry the newest records. With an API key, /api/v1/wordpress?host= returns the scan and /api/v1/wordpress/component the plugin-and-version lookup; the MCP server offers the same as wordpress_scan and wordpress_component. The full directory is in the open data dump.