WPScan — WordPress Security Plugin
WPScan – WordPress Security Scanner
by ethicalhack3r · WordPress.org page · Website
WPScan has 8,000+ active installs on WordPress.org and 273,559 downloads all time. We have tracked it since September 4, 2026; download trends appear after 30 days of data. The last update was on January 12, 2026, tested up to WordPress 6.9.7.
WPScan at a glance
Is WPScan well maintained?
Features
The feature list from the plugin's own readme on WordPress.org, trimmed to the essentials.
- Check for debug.log files
- Check for wp-config.php backup files
- Check if XML-RPC is enabled
- Check for code repository files
- Check if default secret keys are used
- Check for exported database files
- Weak passwords
- HTTPS enabled
WPScan reviews and ratings
28 reviews on WordPress.org, with the most recent ones as their authors posted them.
28 reviews
- 5★
-
18
- 4★
-
0
- 3★
-
3
- 2★
-
0
- 1★
-
7
-
Garbage now
complete garbage now, used to be amazing now they basically force you to use jetpack. No replies trying to get enterprise license, another great product (used to be) that automattic has killed and used just for leads to jetpack
tripflex -
Good but lacking info
There's an issue that keeps appearing but no information about why or what to do about it.
Dan -
Jetpack Protect is not an alternative
In the past this was a very good way to check, if you have vulnerable Plugins/Themes, but with Jetpack you didn't get notifications, only if you pay the expensive plans ;-(There are other plugins, which do it better!
wpgerd -
Don't waste time creating account...
...if you dont't intend to pay for a sub, the plugin lies saying that you need a free api to use it. Maybe the api is free but you need a subscription to access it. The plugin is useless if you don't subscribe. Use the tool's website for a rather useless partial report.
quadeg -
Apparent false flag about http versus https
I doubt that I will get me a paid subscription to this otherwise interesting plugin, because it keeps sending me email alerts with this warning: "Security check Website HTTPS The website does not seem to be using HTTPS (SSL/TLS) encryption for communications." When I check for http:/ in the database or anywhere else on the site, nothing is found. When I run WPScan manually, it says everything is fine. All my browsers also indicate that https is functioning. Why does WPSCan insist on sending me these alerts? I would like to see a log about where WPScan found this error.
Hans Konings -
Very Useful
Very useful especially if you use many plugins that are not professionally supported.
Jan
Where WPScan ranks on WordPress.org
The rankings we track that WPScan appears in, and how its position changed over 30 days.
| Ranking | WordPress.org placement | Position | 30 days |
|---|---|---|---|
| Best Security Plugins | #92 by tag, #64 in search | #38 | – |
WPScan alternatives
Plugins that solve the same problem, ranked by how closely they overlap with WPScan.
-
Security Ninja 7,000+ installs · 4.7 -
Patchstack 60,000+ installs · 4.9 -
WPVulnerability 10,000+ installs · 5.0 -
Titan Anti-spam & Security 50,000+ installs · 4.5 -
Shield Security 30,000+ installs · 4.8
Details
WPScan WordPress Security Scanner - Scans your system for security vulnerabilities listed in the WPScan Vulnerability Database.
The full description, screenshots and every review live on the WordPress.org page.
Rankings WPScan competes in
Tags
- hack
- security
- vulnerability
- wpscan
- wpvulndb
- Version
- 1.16
- Last updated
- Jan 12, 2026
- First published
- Mar 2, 2019
- Requires WordPress
- 3.4
- Tested up to
- 6.9.7
- Requires PHP
- 5.5
- Pricing
- Free on WordPress.org
WPScan FAQ
What does WPScan do?
According to its WordPress.org readme, WPScan offers Check for debug.log files, Check for wp-config.php backup files, Check if XML-RPC is enabled, Check for code repository files and Check if default secret keys are used.
How many active installs does WPScan have?
WordPress.org reports 8,000+ active installs for WPScan as of September 7, 2026.
Is WPScan still maintained?
Yes. The last release was on January 12, 2026 and it is tested up to WordPress 6.9.7.
Is WPScan free?
WPScan is free to install from WordPress.org. Many plugins also sell a paid version or add-ons.
Where does WPScan rank among Security Plugins?
WPScan is #38 in the WordPress.org Security Plugins ranking.