0 
0 The latest research by SUCURI shows 90% of scanned WP sites were infected with one or more vulnerabilities.
There are plenty of online scanners to check the common web vulnerabilities, but that may not be sufficient as a security risk may arise from WordPress core, plugin, theme or misconfiguration.
For that, you need a specialized security scanner that not just detects the common but also particular to WordPress vulnerabilities.
The following scanner can help you to audit your website and let you know for security risk. So you can take necessary action to prevent being hacked.
1. SUCURI
SiteCheck by SUCURI helps to quickly find out if the site is blacklisted, infected with known malware, or using outdated software stack.
You can also install their plugin to initiate the scan from your WordPress admin dashboard.
And if you are not just looking for one time but continuous protection and performance, then I would recommend checking out SUCURI services. Their popular WAF is two-in-one. You get a global CDN and cloud-based web application firewall to protect from DDoS, OWASP top 10, and more.
2. Hacker Target
WordPress check by Hacker Target test for a vulnerable plugin (1800+), outdated WordPress version, web server configuration, and the following.
- Google safe browsing test
- Directory indexing
- Admin account status (enabled/disabled)
- iFrames
- Hosting provider reputation
- JavaScript linked
- Vulnerable themes (2600+)
- Basic level of brute force
Hacker Target downloads a few pages from the URL and examines the HTTP header and HTML code.
3. Detectify
Detectify is an enterprise-ready vulnerability scanner that tests for more than 500 vulnerabilities, including OWASP top 10 & WordPress specific.
If you are running an enterprise-level of business on WordPress and looking for a complete vulnerability scan, then Detectify would be a good choice. They offer 14-days trial, so explore their platform to see if it works for you.
4. WPSEC
WPSEC leverage WPScan vulnerability database to compare the version and report if any vulnerable core, plugin, a theme found.
WPScan covers more than 18000 vulnerabilities database. If you are looking to use WPScan on your server/PC, then you may refer to this guide about how to install and use it.
5. Security Ninja
Ninja security is a plugin, so a test is done from within your WordPress admin. It checks for more than 50 metrics with one click, and you get a detailed report including test name, status, how-to-fix & results.
It took less than 2 minutes to scan my site and got an excellent report covering the latest version, database connectivity exposure, a connection over SSL, etc.
6. Pentest-Tools
WordPress Vulnerability scan by Pentest-Tools is another tool leveraging WPScan and gives you the option to download the report in PDF format. Sample report here.
It enumerates the plugin, theme, users, and fingerprint the WordPress version.
7. WP Neuron
WP Neuron tool scan WordPress vulnerabilities in core files, plugins, libraries. It also enumerates weak passwords to test brute force attacks and scan all code to ensure none of the scripts is exposed to online threats.
8. Quttera
Quttera plugin scans your WordPress site for known and unknown malware and suspicious activity. You can initiate the scan from your WordPress admin dashboard, and it will make an HTTP call to Quttera to scan and get the results.
Along with malware lookup, it also does the following.
- Check if URL is blacklisted
- No signature or pattern detection
- Inject PHP shells detection
- External link detection
- Investigate WordPress core files
Conclusion
I hope the above WP scanner helps you to find the online threat so you can prevent it from being hacked. If you find your site is hacked or having a malicious code and not sure how to fix that, then you may try professional help from SUCURI.
