Enter your website address and we'll check what anyone on the internet can see about your WordPress site: whether WordPress and your plugins look up to date, whether anything's been abandoned by its developer, and the common settings that make life easy for bots. It takes about ten seconds. We don't log in, change anything or keep your address.
This is an outside view, so it can't see everything. Version numbers come from your page code, and some plugins hide theirs. Treat it as a quick health check, not a full audit.
Want this fixed and kept fixed? Our WordPress care plans cover weekly updates, daily backups and monitoring from £95 a month, starting with a full health check. If something already looks wrong, see our fixed-price hacked site clean-up.
What we check
| Check | Why it matters |
|---|---|
| WordPress version | Compared with the latest release. Updates fix known security holes |
| Plugins | Spotted from your page code and compared with the WordPress.org directory: out of date, or not updated by the developer in over two years |
| HTTPS | Whether the secure version loads, and whether visitors are always sent to it |
| PHP version | If your server announces it. Versions before 8.2 no longer get security fixes |
| Security headers | HSTS, nosniff, frame protection and a referrer policy: quick wins most sites miss |
| XML-RPC | An old remote-access feature that password-guessing bots love |
| Public usernames | Whether your site lists the usernames of people who post on it |
| Browsable uploads | Whether anyone can list every file you've uploaded |
| Response time | How long your home page takes to come back from our server, a rough first sign of hosting or caching problems |
Why plugins get the most weight: in 2025, 91% of new WordPress vulnerabilities were in plugins, and only six were in WordPress itself (Patchstack, 2026). For what to do about it, read website security: the short list that matters, or run through the 10-minute WordPress health check from inside your dashboard.
