Marcus Downing

<p>This plugin adds an admin page under the Tools section that reports on any known vulnerabilities in your version of WordPress and any installed themes or plugins.</p>
<p>This information is only visible to administrators (or more precisely, those with the <code>manage_options</code> capability). Subscribers, authors and editors cannot see the data.</p>
<h3>Source</h3>
<p>The information this plugin uses comes from the WPScan Vulnerability Database: https://wpvulndb.com/. It uses a cache and internal throttling to ensure its use of the API is not excessive or abusive.</p>
<h3>Note</h3>
<p>Using this plugin does not guarantee that your site has no vulnerabilities. It also does not absolve you from responsibilities as a site owner to secure your site in other ways, such as SSL or host security. This plugin is only a tool; using it responsibly is up to you.</p>
<h3>WP-CLI</h3>
<p>This plugin registers a WP-CLI command, that allows you to scan from the command line. The response codes are compatible with Nagios (1 for critical error, 2 for warning, 3 for unknown).</p>
<ul>
<li><code>wp vuln scan</code>, to report all known vulnerabilities.</li>
<li><code>wp vuln plugins</code>, to report only vulnerabilities in plugins.</li>
<li><code>wp vuln themes</code>, to report only vulnerabilities in themes.</li>
<li><code>wp vuln wp</code>, to report only vulnerabilities in WordPress core.</li>
<li><code>wp vuln details</code>, to show a more detailed output on known vulnerabilities.</li>
<li><code>wp vuln clear</code>, to clear the internal cache of vulnerability data. This will result in making extra requests to the API, and is probably not needed.</li>
</ul>


Bang Vulnerability Scanner

Reports if your WordPress site has any known vulnerabilities.

Esteban

<p><strong>Aipatch Security Scanner</strong> is a lightweight security scanner that helps you understand and improve your site’s security posture.</p>
<p>Unlike heavy security suites, Aipatch Security Scanner focuses on <strong>clarity over complexity</strong>:</p>
<ul>
<li><strong>Security Score:</strong> A simple 0–100 score that summarizes your site’s security status at a glance.</li>
<li><strong>Local Scanner:</strong> Detects outdated plugins, themes, core versions, risky configurations, and common security weaknesses — all locally, with no external dependencies.</li>
<li><strong>Known Vulnerabilities:</strong> Checks your installed software against a built-in knowledge base of known vulnerabilities. Future versions will support external vulnerability feeds for broader coverage.</li>
<li><strong>Safe Hardening:</strong> Toggle security improvements like XML-RPC blocking, REST API restrictions, WordPress version hiding, and login brute-force protection — each with clear explanations and compatibility warnings.</li>
<li><strong>Security Logs:</strong> A clean log of all security events, scans, and changes made through the plugin.</li>
<li><strong>Site Health Integration:</strong> Adds custom security tests to the WordPress Site Health screen.</li>
<li><strong>Scan History:</strong> Every scan is saved so you can track your security score over time.</li>
<li><strong>Module Control:</strong> Enable or disable individual modules (scanner, hardening, vulnerabilities, login protection) from settings.</li>
</ul>
<h4>Philosophy</h4>
<p>Aipatch Security Scanner is designed to give site owners <strong>clear, actionable information</strong> without being overwhelmed by technical jargon or upsell pressure. Every finding includes what it means, why it matters, and what to do — in plain language.</p>
<h4>What Aipatch Security Scanner Does</h4>
<ul>
<li>Runs 12 local security checks against your installation</li>
<li>Calculates a risk score based on findings</li>
<li>Compares installed plugins, themes, and core against known vulnerabilities</li>
<li>Applies optional hardening rules via WordPress filters (no file modifications)</li>
<li>Logs all security events to a dedicated database table</li>
<li>Integrates with WordPress Site Health</li>
</ul>
<h4>What Aipatch Security Scanner Does NOT Do</h4>
<ul>
<li>It is NOT a firewall or WAF.</li>
<li>It does NOT scan files for malware.</li>
<li>It does NOT modify your .htaccess or wp-config.php automatically.</li>
<li>It does NOT phone home or require an account to function.</li>
<li>It does NOT intercept frontend requests or affect page load performance.</li>
</ul>
<h4>Future Roadmap</h4>
<ul>
<li>External vulnerability feed integration (API-based)</li>
<li>File integrity monitoring</li>
<li>Email alerts for critical findings</li>
<li>Extended multisite support</li>
</ul>


Aipatch Security Scanner

Lightweight security scanner for WordPress. Checks for outdated software, risky configurations, and applies safe hardening measures.

Bang Vulnerability Scanner vs Aipatch Security Scanner