WordPress Website Audit
Scanverra can read your WordPress core version straight off the page, then checks the plugin bloat, render-blocking assets, and exposed endpoints that come with running the web's most popular CMS.
What we check for WordPress
Six checks specific to plugin-driven sites and default WordPress configuration.
Plugin and theme asset bloat
Stacked CSS and JS files loading from /wp-content/plugins/ and /wp-content/themes/ - a lot of it render-blocking, and most of it added one plugin install at a time.
Core version disclosure
Scanverra reads your WordPress version straight off the generator meta tag. A publicly visible old version number is effectively a target list for anyone scanning for known vulnerabilities in that release.
wp-json REST API exposure
The REST API is enabled by default on every WordPress install. Endpoints like wp-json/wp/v2/users can leak usernames and content structure to anyone who requests them.
Theme image weight
Unoptimized header and hero images shipped by the theme rather than compressed or lazy-loaded, often the single biggest Largest Contentful Paint cost on a WordPress homepage.
Missing security headers
WordPress core doesn't set HSTS, X-Frame-Options, or a Content Security Policy on its own. Without a security plugin or server-level config, most installs ship without them.
XML-RPC exposure
xmlrpc.php is reachable by default and is a well-known target for brute-force and DDoS amplification attempts against WordPress sites that don't use it.
How it works
Three steps from URL to a version-aware WordPress report.
Paste your WordPress URL
Any public WordPress site - self-hosted or on managed hosting - works the same way.
We confirm it's WordPress - and which version
/wp-content/, /wp-includes/, and wp-json paths in the HTML confirm the CMS; a regex against the generator meta tag pulls the exact core version number when it's present.
Get WordPress-specific fixes
Plugin bloat, caching, and header guidance written for WordPress hosting, not a generic checklist.
Frequently asked questions
Can Scanverra detect my WordPress version?
Yes. When your theme includes the standard generator meta tag, a pattern match against WordPress X.X.X in that tag pulls the exact core version and flags it if it's out of date - this is one of the few version-specific checks in the audit.
Does the audit check individual plugins by name?
No - it doesn't enumerate which plugins you have installed. It does flag the render-blocking CSS and JS bloat that comes from /wp-content/plugins/, which is usually where plugin-heavy sites lose the most performance score.
Is having /wp-json/ open always a security problem?
It's expected, default behavior on every WordPress site, so it's not flagged as a problem on its own. Combined with an outdated core version or a user-enumeration endpoint left wide open, it's worth reviewing.
Will an outdated WordPress core version hurt my score?
Yes - version disclosure on an old release is treated as a security-relevant finding, separate from the performance and SEO categories every other page gets checked on.
Does WordPress need a security plugin to pass the audit?
Not literally, but WordPress core doesn't set headers like HSTS or X-Frame-Options by itself. Getting a clean security-header result on WordPress usually means adding them through a plugin or your server/CDN config.
Does the audit send exploit attempts at xmlrpc.php?
No - it doesn't probe for exploits. But if XML-RPC looks reachable and unused, disabling it is one of the standard fix suggestions a WordPress report includes, since it's a known brute-force and amplification target.
Other technology audits
See what your WordPress site exposes
Version disclosure, plugin bloat, and the security headers WordPress doesn't set by default - scored and explained.
Run free audit