Scan any WordPress website to discover its version, themes, plugins, users, and security vulnerabilities like exposed directories.
Comprehensive WordPress security scanner that analyzes any WordPress website to reveal its technical configuration. Detect WordPress version from multiple sources, enumerate installed themes and plugins with versions, discover user accounts, identify generators and third-party components, and find exposed directories that could pose security risks. Essential for security audits, competitive analysis, and WordPress site maintenance.
Common giveaways are paths like /wp-content/ and /wp-includes/ in the page source, a generator meta tag that names WordPress, and a /wp-json/ REST API. Theme and plugin names usually appear inside those /wp-content/ paths, which is how detectors identify them.
If usernames are public, attackers only need to guess passwords, which makes brute-force logins easier. WordPress can reveal usernames through author archive URLs and the REST API users endpoint, so use strong passwords, two-factor login and a security plugin that limits these endpoints.
It is a quick summary based on three exposures: a visible WordPress version, public usernames and directories with indexing switched on. None found shows Good, one shows Fair and two or more shows Needs Attention. It is not a full vulnerability audit.
On OpenTools' servers, not in your browser. You only enter a public URL, so nothing is installed on the target site and no login is needed. Only scan sites you own or have permission to test.
