Check your WordPress website
Enter your website domain to start a passive security assessment. The scanner checks publicly accessible WordPress endpoints and selected security configuration.
Public checks use non-invasive HTTP requests. Additional verification requires proof of ownership or explicit authorization.
What does the WordPress security checker examine?
The initial WordPress profile focuses on publicly observable security signals. It examines application fingerprints, endpoint availability and selected configuration issues.
1. WordPress Version Disclosure
WordPress version information may be exposed through
generator metadata, RSS feeds and publicly accessible
files such as readme.html.
The scanner checks these signals to identify potentially relevant software versions and guide further security review.
2. Login and Administration Exposure
The checker examines the public availability of:
/wp-login.php/wp-admin/
These are standard WordPress endpoints. Their availability helps establish which administration surfaces are publicly reachable and what additional protections may be appropriate.
3. XML-RPC Availability
The scanner checks whether /xmlrpc.php
is accessible.
XML-RPC is a legitimate WordPress interface used by some integrations. Depending on how it is configured and protected, it can increase the available attack surface.
4. REST API User Enumeration Exposure
The checker examines the public behaviour of
/wp-json/ and looks for signals that may expose
user information through the REST API.
The findings help identify publicly accessible user data that may require a closer review of the site's configuration.
5. Upload Directory Listing
The scanner checks whether directory listings are enabled
in /wp-content/uploads/.
Public directory indexing can expose filenames and directory structures that do not need to be discoverable.
6. Security Headers and HTTPS
The profile also checks selected security configuration signals:
- Content-Security-Policy (CSP).
- X-Frame-Options.
- X-Content-Type-Options.
- Referrer-Policy.
- HTTP Strict Transport Security (HSTS).
- HTTPS redirection and TLS certificate status.
These findings help identify missing or incomplete security configuration.
How the WordPress security audit works
1. Enter your domain
Provide the domain of your WordPress or WooCommerce store. The scanner examines publicly available pages and HTTP responses to identify the platform and relevant signals.
2. Review the report
The results show which checks were performed, what was observed and which issues may require further investigation. Each finding includes a description and relevant evidence.
3. Verify your installation
More specific security testing requires proof that you own or are authorized to test the website. This allows the assessment to move beyond publicly observable information.
4. Get help with remediation
If the report identifies a concern, our team can investigate the relevant WordPress components, plugins, custom code and server configuration.
WordPress security goes beyond public endpoints
A public scan provides useful information about exposed application surfaces, but it cannot establish whether a website's files or administrative accounts have been compromised.
If you suspect an intrusion, a deeper investigation may need to examine modified plugins and themes, unexpected PHP files, administrator accounts, database changes and hosting access.
Removing an exposed endpoint does not necessarily remove access an attacker has already obtained.
Our security services cover application-level investigation and remediation beyond the automated checks.
Security services for WordPress & WooCommerce
Recode Commerce works with ecommerce applications, custom integrations and server-side functionality. When a security problem is confirmed, the objective is to address the underlying issue while preserving your store's functionality.
- WordPress and WooCommerce application security review.
- Vulnerable plugin and theme investigation.
- Custom PHP code security remediation.
- Suspicious file and code-change investigation.
- Administrator access and credential review.
- Server configuration hardening.
- Post-incident security assessment.
Frequently asked questions
Does this checker detect all WordPress vulnerabilities?
No. It checks a defined set of public security signals. It does not replace a complete source-code audit, plugin assessment or penetration test.
Is an accessible wp-login.php a vulnerability?
No. WordPress normally exposes this endpoint. The check records its availability as part of the site's public attack surface assessment.
Should I disable XML-RPC?
Not necessarily. Some integrations depend on XML-RPC. Whether it should remain enabled depends on your site's requirements and security controls.
Does the scanner check WooCommerce payment security?
The initial profile focuses on WordPress public exposure and general security hygiene. It does not validate payment gateway implementation, transaction handling or PCI DSS compliance.
Can the scanner find malware or backdoors?
Not in its initial passive mode. Filesystem analysis and malware investigation require authorized access to the website or hosting environment.
Can Recode Commerce secure an already compromised store?
Yes. We can investigate suspicious changes, review application code, identify vulnerable components and assist with remediation. The scope depends on the access and evidence available.
Protect your WordPress & WooCommerce business
If your store handles customer accounts, orders and payment integrations, security issues deserve more than a superficial check.
Start with the automated audit. If you need to investigate a suspected compromise or resolve identified vulnerabilities, contact Recode Commerce.