What we check on WordPress sites
The check combines our technology detector and our security scan, and it works from the outside, as any visitor or automated scanner would. It does not log in and does not attempt anything intrusive. If the site is not WordPress, you still get the full technology and security findings.
- WordPress core version exposed in the generator tag, feeds or asset URLs.
- Plugins visible on the homepage through wp-content/plugins paths, and how many there are.
- jQuery and other library versions loaded by the theme.
- Exposed files such as wp-config.php backups, .env files, .git metadata and phpinfo pages.
- PHP and web server version disclosure, security headers, cookie flags, HTTPS and mixed content.
Why plugins are the weak spot
WordPress core is well maintained and updates itself for security releases by default. Most WordPress compromises instead come through plugins and themes: a contact form, slider or page builder with a known vulnerability that was never updated, or a premium plugin whose licence lapsed. Attackers scan the internet for those versions automatically, so a small firm's site is targeted just like a large one.
A compromised firm website is more than an embarrassment. It can be used to host phishing pages, send spam that gets your domain blocklisted or inject links that harm your search rankings.
Keeping WordPress healthy
Update core, themes and plugins regularly, and remove plugins and themes you do not use instead of just deactivating them. Prefer well-maintained plugins with recent updates. Use strong unique passwords and two-factor login for every administrator, limit the number of administrators and keep daily off-site backups you have actually tested restoring.
Hide version numbers as a minor hardening step, add security headers at the server or with a plugin, and make sure configuration backups are never left in the web root. A managed WordPress host or a maintenance plan takes most of this off your plate.
Signs a site needs attention now
Treat these findings as urgent: an exposed configuration backup or .env file, a .git folder reachable from the web, a WordPress core version several releases behind, plugins you do not recognise, or an old jQuery loaded by the theme. Any of them suggests maintenance has lapsed. Fix the exposure first, then update everything with a fresh backup at hand.