A WordPress security check inspects your live site for the misconfigurations and exposures attackers look for first — things like an exposed XML-RPC endpoint, a leaked WordPress version, missing security headers, or user accounts that can be enumerated through the REST API.
WPDoctor's free checker scans your public pages and headers externally, so there's nothing to install and no risk to your site. In seconds you get a clear list of what's safe and what needs hardening.
Most WordPress sites aren't hacked through some clever zero-day — they're compromised through well-known, easily fixable mistakes. Attackers run automated bots that scan thousands of sites an hour looking for the same handful of weaknesses, so leaving any of them open is an open invitation.
The WPDoctor security checker looks for exactly these high-frequency issues so you can close them before a bot finds them.
Security headers are small instructions your server sends with every page telling the browser how to behave. They cost nothing to add but block entire classes of attack. HTTP Strict Transport Security (HSTS) forces HTTPS and stops downgrade attacks. Content-Security-Policy limits where scripts can load from, cutting off cross-site scripting. X-Frame-Options prevents your pages being embedded in a malicious frame (clickjacking).
Many WordPress sites ship with none of these, because the theme and host don't add them by default. The checker tells you exactly which headers are missing and the exact configuration line to add for Apache, Nginx or OpenLiteSpeed.
Every issue we report comes with a specific, copy-paste remediation in the full report — not a vague warning. Disable XML-RPC if you don't use the mobile app or Jetpack. Block anonymous access to the users REST route in your server config or a small mu-plugin. Remove version output. Add the missing security headers. Delete stray backup and config files from the web root and move them somewhere private.
After fixing, re-run the free check to confirm each issue is resolved — a quick before/after that proves your site is genuinely harder to attack.
No. It only reads publicly available responses and headers — it never logs in, changes settings, or stresses your server.
XML-RPC is a WordPress endpoint that attackers abuse for brute-force and DDoS amplification. If you don't need it, disabling it removes a common attack vector.
HTTP headers like HSTS, Content-Security-Policy and X-Frame-Options tell browsers how to protect your visitors. Missing ones leave gaps this checker flags.
After any theme/plugin update or server change, and at least monthly. Paid plans can monitor automatically and alert you.
No. Security plugins add protection, but they can be misconfigured or leave server-level gaps. An external scan shows what the outside world (and attackers) can actually see.
It's a strong first step that surfaces the most common issues. Full hardening also involves strong passwords, updates, backups, a firewall and least-privilege user roles.