Is My WordPress Site Secure? How to Check

A quick way to check whether your WordPress site is secure — and the red flags to look for.

Wondering if your WordPress site is secure? Check these red flags.

Quick checks

  • Is your WordPress version publicly visible?
  • Is `/xmlrpc.php` open?
  • Does `/wp-json/wp/v2/users` leak usernames?
  • Are security headers missing?
  • Is SSL valid and HTTPS enforced?
  • Any exposed `wp-config.php.bak` or `.env` files?

    • Why it matters

    Each of these is an entry point for automated bots. Fixing them removes the easy wins attackers look for.

    Check in seconds

    WPDoctor's free security checker tests all of the above from the outside — no plugin needed.