WordPress Vulnerability Scanner

💡 Methodology:
Scanning is 100% passive — we reproduce exactly what an attacker sees from the outside: public pages, HTTP headers, REST API and accessible files. We do not run exploit payloads; “SQLi analysis” indicates components with SQL injection CVEs that apply to the detected version, along with the method by which an attacker checks them.

Who fixes it? "Web Developer" = WordPress application level actions (theme/plugin code, wp-admin). “Hosting” = server-level aspects (nginx/Apache/WAF), immediately available by the hosting provider. “Both” = the fastest way is usually at hosting, and the background fix belongs to the developer.