WordPress security
Find outdated and abandoned WordPress plugins before attackers do.
The Lavawall® domain scan checks WordPress sites from the outside: outdated core, plugins and themes, plugin versions with publicly disclosed vulnerabilities, abandoned plugins, exposed admin pages and listable usernames, plus the email, TLS and DNS around the site. 2 domains are free forever with Scout.
Last updated
Scan only domains you own or have permission to assess.
What the WordPress checks find
- Outdated WordPress core
- Outdated plugins and theme, with the version to update to
- Plugin versions with publicly disclosed vulnerabilities, with a risk rating
- Plugins whose version is hidden
- Abandoned plugins
- Exposed admin and login pages
- Usernames anyone can list
- Default sample content left online
- PHP versions near or past end of security fixes
Why abandoned plugins matter
Most WordPress breaches start with a plugin, not WordPress itself. A plugin whose author has stopped maintaining it will never get a fix, so the safe move is to replace it now rather than wait for a vulnerability to be published.
Everything around WordPress, in the same scan
A WordPress site is only as safe as the domain it sits on. The same scan checks SPF, DKIM and DMARC, TLS certificates, DNS, security headers and exposed services such as FTP and hosting panels.
For MSPs and agencies
Re-scan client sites on a schedule, get an alert when a new plugin issue appears, and send PDF or Word reports on Grow, Professional and Complete. Put the scanner on your own website with the white-label scanner.
Scan only domains you own or have permission to assess.
WordPress-only scans compared with a full domain scan
| Check | WordPress-only scanners | Lavawall domain scan |
|---|---|---|
| Core, plugins, themes | Yes | Yes |
| Abandoned plugins | Varies | Yes |
| Email authentication | No | Yes |
| TLS and DNS | Varies | Yes |
| Open services | No | Yes |
| Accessibility | No | Yes |
| Scheduled re-scans and reports | Varies | Grow and up |
Frequently asked questions
How do I check my WordPress site for vulnerabilities?
Run a Lavawall domain scan on the site. It lists WordPress core, the theme and every plugin it can see, flags versions that are outdated or have publicly disclosed vulnerabilities, and gives the version to update to. 2 domains are free with Scout.
Do I need to install a WordPress plugin to use the Lavawall scan?
No. The Lavawall scan looks at the site from outside, without logging in or installing anything.
What is an abandoned WordPress plugin?
An abandoned plugin is one its author no longer maintains, so it will not get security fixes. Lavawall flags abandoned plugins so you can replace them before a vulnerability is found.
Can the Lavawall scan see every WordPress plugin?
Lavawall lists every plugin it can detect from outside, including plugins whose version is hidden. A plugin that leaves no public trace cannot be seen by any outside scan.
Does the Lavawall scan check the PHP version behind WordPress?
Yes, when the site reveals it. Lavawall shows whether that PHP branch still gets security fixes and when it stops.
Does a WordPress scan replace a security plugin or backups?
No. The Lavawall scan finds what to fix from outside. Keep updates, backups and any firewall you use; the scan tells you whether they are doing their job.
Can I scan a client's WordPress site?
Scan only domains you own or have permission to assess. With permission, MSPs can scan client sites on a schedule and send PDF or Word reports on Grow and up.