FAQ
Short answers about ownership verification, passive CMS health and security checks, agency workflows, and scan limits.
A CMS security checker reviews public website signals from a content management system, such as CMS fingerprints, visible component versions, public exposure, headers, TLS, DNS, forms, and third-party services. Audit My CMS keeps this passive and does not log into the CMS.
Yes. You can start a free CMS security audit for a website you own or manage. After ownership verification, the scanner queues a passive public review and shows the result page when it finishes.
A website CMS audit can include CMS detection, public component evidence, vulnerability applicability, exposed files, security headers, TLS, DNS and email security, SEO and privacy indicators, third-party services, form signals, and external attack surface observations.
Audit My CMS scans WordPress, Drupal, Joomla, OpenCart, PrestaShop, and TYPO3 sites you own or manage. It checks public CMS signals, vulnerabilities, exposed files, security headers, SEO and privacy indicators, third-party scripts, accessibility issues, and remediation-focused details.
Yes. Audit My CMS supports public checks for WordPress, Drupal, Joomla, OpenCart, PrestaShop, and TYPO3. The exact findings depend on which CMS and component signals are visible from public pages and assets.
Audit My CMS is built for agencies, freelancers, maintainers, and website owners who need a practical CMS health and security report for discovery, maintenance, pre-launch review, or remediation planning.
Yes. Before a scan can be queued, you must upload a small verification token file to the target website. This prevents scanning unrelated websites without authorization.
Yes. The scanner uses public HTTP requests, public page signals, and rate-limited probes. It does not exploit vulnerabilities, brute force logins, or access private CMS areas.
No. Audit My CMS is a passive CMS security checker and website audit tool. It is useful for public exposure review, maintenance triage, and remediation planning, but it does not replace an authorized penetration test or authenticated code review.
A scan can be incomplete if a firewall, CDN, security plugin, host, or rate limit blocks scanner requests. When that happens, the result page shows scan completeness information and may recommend allowing the scanner identity header and proxy-based scanner requests or running a fresh scan.
Public result pages are available only during the configured result retention period shown on the result page.
Yes. Agencies can use the result as a discovery tool, a recurring maintenance check, a pre-launch review, or a starting point for remediation planning with clients.