Instant plugin check · no email
Which plugins can strangers see on your WordPress site?
Paste your address. In a few seconds you'll see the plugins and versions your homepage shows to anyone who looks, and whether any of them match a known security issue.
We read your homepage and a few public readme files. Nothing to install, no login. Also: check all pages · PHP2Shell check.
How it works
The same look a bot gets.
Automated tools hunt for sites running old plugin versions. This shows you what they'd find, so you can update first.
Your homepage
Plugins load their files from folders with their names on, often with the version tacked on the end. We note each one.
Known issues
We compare each version with our own list of recent plugin problems and the open WPVulnerability database.
What to do
Anything that matches gets the fixed version and a guide where we have one. The full scan then checks speed, SEO and the rest.
Questions
What does the plugin check look at?
Your homepage, the way any visitor's browser sees it, plus up to three public readme.txt files for plugins we track. That's the same as our full scan reads. We don't log in, guess passwords or poke at anything else.
Does a clean result mean my site is safe?
No. Lots of plugins don't show a version from outside, so we can't see them all. A clean result means we didn't spot a match. Check Plugins in wp-admin for the full list.
What does "matches a known issue" mean?
The version we can see falls inside the range of a published security problem for that plugin. It doesn't mean anyone has used it on your site. Update the plugin, then check again.
Reading up on a specific plugin? We've written about LiteSpeed Cache 7.9.2, the UpdraftCentral hack, Rank Math PRO, Backuply and Everest Backup and AIOSEO and Bricksforge.