/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ WPScan – WordPress Security Scanner

WPScan – WordPress Security Scanner

By ethicalhack3r

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

WPScan – WordPress Security Scanner Review - In-Depth Analysis

WPScan is a WordPress security scanner that checks for vulnerabilities in your site. It uses a comprehensive vulnerability database to identify risks and notify users.

Performance Overview

WPS Score

6.75/10

User Rating

3.8/5 (based on 28+ reviews)

Active Installations

8,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

WPScan is a WordPress security scanner designed to identify vulnerabilities within your WordPress site. It utilizes a manually curated vulnerability database that is updated daily by security specialists.

This plugin scans for known vulnerabilities in WordPress core, plugins, and themes, providing users with essential security checks. It also offers automated daily scans and email notifications to keep you informed about any new vulnerabilities.

With a free API plan allowing 25 requests per day, WPScan is suitable for most WordPress websites. Additional security checks include verifying debug logs, backup files, and weak passwords.

Comparing to Alternatives

WPScan is a WordPress security scanner with several direct competitors offering similar malware scanning and security hardening features.

Top alternatives

Strengths

Comprehensive vulnerability scanning for WordPress core, plugins, and themes
No known security vulnerabilities in the plugin itself
Supports professional and community-maintained vulnerability database
Offers a pro version with advanced features
Good detection of outdated or vulnerable components

Weaknesses

Requires subscription for API access, limiting free usage
Some users report false positive alerts about HTTPS issues
Customer support and communication have been criticized
Integration with Jetpack is seen as forced by some users

User Sentiment Analysis

With a 3.8 average rating from 28 reviews, most users appreciate WPScan's usefulness, but a significant minority express frustration, especially regarding subscription requirements and support.

Positive highlights

'Very useful especially if you use many plugins that are not professionally supported.' — Jan
'Good but lacking info' — Dan
Users value the detailed vulnerability reports and scanning capabilities
Appreciated for its comprehensive plugin and theme security checks

Common complaints

Subscription required for API access despite claims of free usage
Plugin pushes users towards paid plans and Jetpack integration
Lack of response from support regarding enterprise licensing
False alerts about HTTPS status causing confusion

Weaknesses

Subscription model limits free functionality
Occasional inaccurate security alerts
Customer support responsiveness issues
Perceived forced integration with Jetpack

Who Should Use This?

Best for

Security-conscious WordPress site owners and administrators who want detailed vulnerability scanning and are willing to invest in a subscription for full API access.

Not ideal for

Users seeking a completely free security scanner without subscription requirements or those who prefer plugins with more responsive support and less forced integrations.

Pricing & Value

Free version includes

The free version offers basic scanning capabilities but requires API access which is subscription-based, limiting its usefulness without payment.

Pro version

The pro version includes advanced scanning features, real-time vulnerability database updates, and enhanced reporting tools.

Final Verdict

WPScan is a capable WordPress security scanner with a strong vulnerability detection engine and no known security issues in the plugin itself. It is well-suited for users who need detailed security insights and are comfortable with a subscription model for full API access.

However, the plugin's push towards paid subscriptions and Jetpack integration, combined with some user frustrations over support and false alerts, may deter those seeking a fully free or more user-friendly solution. Alternatives exist that may better fit users prioritizing free features or customer service.

Other Notable Features

Here are a few other notable features of this free WPScan – WordPress Security Scanner plugin.

WordPress security

vulnerability scanner

WPScan

Screenshots

FAQ

There is one API call made for the WordPress version, one call for each installed plugin and one for each theme. By default there is one scan per day. The scanning interval can be changed on the WPScan Settings page.