TOOL · FREE · RUNS ON OUR SERVERallwpcare.com/tools/wordpress-site-check/
Free tool

WordPress site check

Type your address and see what anyone on the internet can see about your WordPress site: open logs, user lists, XML-RPC, your certificate and more. Each result says what to do, in plain words.

We visit public pages only. No login, no password guessing, no plugin scan. Nothing is saved: the report stays in your browser.

Type the address only, like example.com. We visit about 20 public pages, the same ones any browser or search engine can open. You can run 5 checks an hour.

How it works

You type your address and tick the box. Our server then opens about 20 public pages on your site, starting with the home page. If it cannot tell the site is WordPress, it stops and says so.

What it looks at

  • Private files: the debug log, a readable wp-config.php, an open installer, and folders that list their files.
  • Information leaks: XML-RPC, the REST API user list, /?author=1 and the users sitemap. It records only yes or no, and a count.
  • Setup: HTTPS and certificate dates, security headers, the PHP version if shown, and your WordPress version against the newest release.

What it does not do

  • It does not send passwords or POST requests, guess file or plugin names, check plugins, themes or backups, or scan for malware.
  • It does not keep your result. The report stays in your browser until you close the page. Our server holds the answer in memory for 10 minutes, so a second visitor does not make your site answer twice.

How to use the result

Work from the top. Fix now means something private is open to everyone. Worth fixing is a real risk that depends on your site. Good to know is information only. Each item says what we saw and one safe step. Copy report copies the result so you can send it to your developer or host.

Fixes to wp-config.php or server rules are easy to get wrong. Take a backup first, and read our tested security guide before you change anything.

FAQ

Is it safe to run this on my site?

Yes. It only opens public pages with ordinary GET requests, like a browser. It never logs in, submits a form or tries passwords. It stops after 25 requests. It never downloads your debug log, only asks if it is there.

Does a clean result mean my site is secure?

No. It only means these things are not visible from outside. Keep WordPress, plugins and themes updated and use two-factor login.

Why do you not show the usernames it found?

A list of login names would be a list of targets. The tool shows only that something is visible, and how many. It keeps no names, log text or file names.

Can I check someone else's site?

Only with their permission. You confirm that first, and each site is limited to 3 checks an hour.

How do I stop the check from visiting my site?

It sends the user agent AllWPCareSiteCheck/1.0. Block that name in your server rules or firewall and the check will say it could not reach the site.