WordPress security checker: headers, SSL & exposed endpoints
Get an A+ to F grade for any WordPress site, with copy-paste .htaccess and Nginx fixes for every failing check.
Free tools check one site, once. SITEOPS protects all client sites, 24/7.
Connect your agency portfolio to run automated safe updates with visual regression verification, 5-minute uptime alerts, and white-label client reports.
More free WordPress tools
Speed Test & TTFB Diagnostic
Measure server response & page weight
Theme & Plugin Stack Detector
Identify themes, builders, and active plugins
Broken Link & 404 Crawler
Find dead links & missing images with CSV export
XML Sitemap Generator
Validate & build clean XML sitemaps
Salt Keys Generator
Client-side CSPRNG secret keys for wp-config.php
Frequently asked questions
What security headers should every WordPress site have?↓
At minimum: Strict-Transport-Security (HSTS), X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff, and Referrer-Policy. A Content-Security-Policy (CSP) is the strongest defense against XSS and injected scripts.
Why is exposed XML-RPC dangerous for WordPress?↓
XML-RPC was originally designed for remote apps and pingbacks, but today it is overwhelmingly abused by attackers to amplify brute-force password guessing and launch distributed denial-of-service (DDoS) reflection attacks.
Will adding security headers break my WordPress site?↓
Headers like X-Frame-Options, X-Content-Type-Options, and HSTS almost never break sites unless you intentionally iframe your site from another domain. Content-Security-Policy should be tested on staging first, as strict script origins can block third-party analytics or widgets.
Is this a complete malware scanner?↓
No. This scanner conducts outside-in diagnostic checks on HTTP transport security, server configuration, and exposed endpoints. Full internal malware scanning requires server-side file integrity checks, which SITEOPS provides automatically inside your connected WordPress dashboard.