Is this an authenticated WordPress penetration test?

No. The scan is a public, non-destructive security review for websites you own or manage. It does not log into the CMS, submit exploit payloads, or bypass access controls.

Can I download a WordPress security report?

After ownership verification, Audit My CMS prepares a web result and can unlock PDF and DOCX reports with evidence, remediation guidance, and owner-friendly summaries.

Free WordPress Security Scan - Audit My CMS (Content Management System)

Q: What does the WordPress security scan check?

Audit My CMS checks public WordPress fingerprints, visible component evidence, version-matched vulnerability records where available, public exposure, security headers, TLS, DNS and email posture, forms, third-party services, and report-ready findings.

Free WordPress Security Scan

Run a public WordPress security scan for CMS fingerprints, version evidence, plugin and theme signals, exposure checks, headers, TLS, DNS, forms, and report-ready findings.

Start Free Audit What We Check

Public WordPress checks

What this WordPress security scan checks

WordPress generator tags, REST API links, wp-content and wp-includes assets

Public plugin and theme fingerprints where visible in page source or assets

Version-matched vulnerability evidence when public component versions are detected

Full audit coverage

CMS fingerprinting from public page source, headers, and assets
Version-matched vulnerability evidence when reliable public versions are visible
Security headers, HTTPS/TLS, DNS, email posture, SRI, forms, and exposure checks
Known third-party services separated from unknown integrations and review-only inventory

Report-ready output

The scan separates findings, inventory-only observations, limitations, and remediation guidance so owners can act without treating every passive signal as a vulnerability.

Public, non-destructive scope

This is not an authenticated penetration test. The scanner reviews public responses, page source, assets, DNS, TLS, and passive evidence for the verified website.

Built for owner review

The result helps site owners prioritize exposed CMS evidence, outdated component signals, weak browser-side protections, and operational gaps before they become harder to clean up.

What does the WordPress security scan check?

It checks public WordPress fingerprints, visible component evidence, vulnerability matches where version evidence exists, exposure signals, headers, TLS, DNS/email posture, forms, third-party services, and report-ready findings.

Is this an authenticated penetration test?

No. It is a public, passive scan for sites you own or manage. It does not log into WordPress, submit exploit payloads, or bypass access controls.

Can I download a report?

Yes. After ownership verification, the web result can be unlocked as PDF and DOCX report outputs with evidence, remediation guidance, and owner-friendly summaries.