Scan your WordPress site and receive recommendations on how to improve load time, performance and security.

Dmitriy

Scanner FMS

A simple scanner for your main theme. Looks for suspicious inclusions in theme files. ( base64, eval, shell_exec, etc. )

MAHESH KUMMARA

Siteklean Website Scanner

The SiteKlean WordPress Website Scanner Plugin is a comprehensive security tool designed to ensure the safety and integrity of WordPress websites.

Peter Butler

Timthumb Vulnerability Scanner

Scans your wp-content directory for vulnerable instances of timthumb.php, and optionally upgrades them to a safe version.

WP Doctorワードプレスドクター

WPDoctor Malware Scanner & Vulnerability Checker & IP blocker with Hack monitor Lite

This plug-in can exhaustively scan program files on the site to detect malware and vulnerability. Also record hacking attempts against your site and b …

GeekParadize

N0WPScan

Secure your Wordpress of WPScan Prevent hackers using WPScan to find vulnerabilities in your site, disable this plugin when you are security testing o …

wpgear

Hack-Info

Ext Security. Monitoring about evil hacking attempts. Our reports - Simply, Briefly and in Detail.

A5hleyRich

<p>Monitor your site’s load time, performance and security using <a href="https://wpscanner.io" rel="nofollow ugc">WP Scanner</a>. Gain an insight into how quickly your site loads for visitors over time and receive suggestions on how to improve performance. Ensure your site is secure by monitoring file changes, permissions, server headers and other security concerns.</p>
<h4>Metrics</h4>
<p>View important metrics about your WordPress install, including:</p>
<ul>
<li>Load time</li>
<li>WordPress version</li>
<li>PHP version</li>
<li>Plugin updates</li>
<li>Content breakdown</li>
</ul>
<h4>Performance</h4>
<p>The following performance rules are checked when scanning your site:</p>
<ul>
<li>Use PHP 7 or HHVM</li>
<li>Enable object caching</li>
<li>Minimize HTTP Requests</li>
<li>Use a Content Delivery Network</li>
<li>Avoid empty src or href</li>
<li>Add an Expires or a Cache-Control Header</li>
<li>Gzip Components</li>
<li>Put StyleSheets at the Top</li>
<li>Put Scripts at the Bottom</li>
<li>Avoid CSS Expressions</li>
<li>Make JavaScript and CSS External</li>
<li>Reduce DNS Lookups</li>
<li>Minify JavaScript and CSS</li>
<li>Avoid Redirects</li>
<li>Remove Duplicate Scripts</li>
<li>Configure ETags</li>
<li>Make AJAX Cacheable</li>
<li>Use GET for AJAX Requests</li>
<li>Reduce the Number of DOM Elements</li>
<li>No 404s</li>
<li>Reduce Cookie Size</li>
<li>Use Cookie-Free Domains for Components</li>
<li>Avoid Filters</li>
<li>Do Not Scale Images in HTML</li>
<li>Make favicon.ico Small and Cacheable</li>
</ul>
<h4>Security</h4>
<p>The following security rules are checked when scanning your site:</p>
<ul>
<li>Verify WordPress Core Files</li>
<li>Verify Directory and File Permissions</li>
<li>Serve Site Over HTTPS</li>
<li>Keep Plugins Updated</li>
<li>Keep WordPress Updated</li>
<li>Keep PHP Updated</li>
<li>Disable Debug Display</li>
<li>Disable File Editing</li>
<li>Remove Accounts with “Admin” Username</li>
<li>Change the Default Table Prefix</li>
<li>Configure Public-Key-Pins Header</li>
<li>Configure Content Security Policy Header</li>
<li>Configure X-Frame-Options Header</li>
<li>Configure X-Content-Type-Options Header</li>
<li>Configure X-Xss-Protection Header</li>
<li>Configure Strict-Transport-Security Header</li>
<li>Disable Server Header</li>
<li>Disable X-Powered-By Header</li>
</ul>


Alternatives to WP Scanner – Performance and Security

Top alternatives