About WP-Sec
WordPress powers a huge share of the web — and it's also the most-attacked CMS on the internet. Most compromises aren't sophisticated: an outdated plugin with a public CVE, an exposed .git directory, a login page with no lockout. Attackers automate these checks; defenders deserve automation too.
WP-Sec is that automation. Point it at any WordPress site and it runs the same battery of checks a security consultant would: fingerprints your stack, matches versions against the latest CVEs, probes sensitive paths, verifies TLS and server headers, tests login hardening, checks breach exposure and blacklists — then hands you a severity-ranked fix list, in plain language.
We also audit what attackers can't see but Google does: meta, content, technical SEO, keyword rankings and backlink authority.
Our principles
- Read-only, always. Probes only — no installs, no changes, no credential testing beyond light lockout checks.
- Flat, honest pricing. $39.99 per report. No tiers, no upsell mazes.
- Evidence-first. Every finding includes evidence + exact fix steps.
- Fresh intelligence. CVE data refreshes daily from NVD + OSV.