A free, open-source WordPress security scanner for professionals and site maintainers to test website vulnerabilities.
WPScan is a free, open-source security scanner specifically designed for WordPress websites. It helps identify vulnerabilities in WordPress core, plugins, and themes by checking against an updated vulnerability database. The tool is used to perform security assessments, enumerate users, and detect misconfigurations that could be exploited.
Security professionals, penetration testers, and WordPress site maintainers who need to assess and improve the security posture of WordPress installations.
Developers and security teams choose WPScan because it is a dedicated, command-line tool that provides accurate, up-to-date vulnerability data through its API, supports stealthy scanning, and can be easily integrated into automated workflows via Docker or configuration files.
WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Leverages the dedicated WPScan Vulnerability Database for precise checks on core, plugins, and themes, ensuring relevance to WordPress ecosystems as stated in the README.
Offers stealth scanning options to avoid detection and supports config files for easy setup and repeatable scans, detailed in the usage section.
Can be run via Docker for isolation and integrates with an API for real-time data, though with a free tier limit of 25 requests per day, as mentioned in the API documentation.
The free API tier allows only 25 requests daily, which can be exhausted quickly when scanning sites with many plugins or themes, limiting real-time data access without payment.
Requires Ruby >= 3.0 and specific curl versions, which can complicate installation compared to standalone binaries, especially on non-Linux systems, as noted in the prerequisites.
Being command-line only, it lacks a graphical interface, making it less accessible for users unfamiliar with terminal commands or automated workflows.