The latest research by SUCURI shows that 90% of scanned WP sites were infected with one or more vulnerabilities. There are plenty of online scanners to check the common web vulnerabilities, but that may not be sufficient as a security risk may arise from WordPress core, plugin, theme, or misconfiguration. For that, you need a specialized security scanner that not just detects the common but also particular WordPress vulnerabilities. The following scanner can help you to audit your website and let you know about security risks. So you can take necessary action to prevent being hacked.
SUCURI
SiteCheck by SUCURI helps to quickly find out if the site is blacklisted, infected with known malware, or using outdated software stack. You can also install their plugin to initiate the scan from your WordPress admin dashboard. And if you are not just looking for one time but continuous protection and performance, then I would recommend checking out SUCURI services. Their popular WAF is two-in-one. You get a global CDN and cloud-based web application firewall to protect from DDoS, OWASP top 10, and more.
Intruder
Intruder is a powerful vulnerability scanner that runs continuous and comprehensive checks for weaknesses across your entire website and its underlying infrastructure. This includes checking for unencrypted admin services, exposed databases, web-layer security problems such as SQL injection and cross-site scripting, and other security issues. It will even alert you when SSL or TLS certificates are close to expiry to help you maintain security and avoid downtime. In addition to scanning servers, cloud systems, websites, and endpoint devices, Intruder is applicable for sites maintained by WordPress, Drupal, Joomla, and SharePoint. It comes with multiple integrations, such as Jira, Slack, GitHub, and more, to help speed up your issue detection and remediation. You can give Intruder a try for 30 days for free.
Hacker Target
WordPress check by Hacker Target test for a vulnerable plugin (1800+), outdated WordPress version, web server configuration, and the following.
Google safe browsing test Directory indexing Admin account status (enabled/disabled) iFrames Hosting provider reputation JavaScript linked Vulnerable themes (2600+) Basic level of brute force
Hacker Target downloads a few pages from the URL and examines the HTTP header and HTML code.
Detectify
Detectify is an enterprise-ready vulnerability scanner that tests for more than 500 vulnerabilities, including OWASP top 10 & WordPress specific. If you are running an enterprise-level of business on WordPress and looking for a complete vulnerability scan, then Detectify would be a good choice. They offer 14-days trial, so explore their platform to see if it works for you.
WPSEC
WPSEC leverage WPScan vulnerability database to compare the version and report if any vulnerable core, plugin, a theme found. WPScan covers more than 18000 vulnerabilities database. If you are looking to use WPScan on your server/PC, then you may refer to this guide about how to install and use it.
Security Ninja
Ninja security is a plugin, so a test is done from within your WordPress admin. It checks for more than 50 metrics with one click, and you get a detailed report including test name, status, how-to-fix & results. It took less than 2 minutes to scan my site and got an excellent report covering the latest version, database connectivity exposure, a connection over SSL, etc.
Pentest-Tools
WordPress Vulnerability scan by Pentest-Tools is another tool leveraging WPScan and gives you the option to download the report in PDF format. Sample report here. It enumerates the plugin, theme, users, and fingerprint the WordPress version.
WP Neuron
WP Neuron tool scan WordPress vulnerabilities in core files, plugins, libraries. It also enumerates weak passwords to test brute force attacks and scan all code to ensure none of the scripts is exposed to online threats.
Quttera
Quttera plugin scans your WordPress site for known and unknown malware and suspicious activity. You can initiate the scan from your WordPress admin dashboard, and it will make an HTTP call to Quttera to scan and get the results. Along with malware lookup, it also does the following.
Check if URL is blacklisted No signature or pattern detection Inject PHP shells detection External link detection Investigate WordPress core files
Conclusion I hope the above WP scanner helps you to find the online threat so you can prevent it from being hacked. If you find your site is hacked or having a malicious code and not sure how to fix that, then you may try professional help from SUCURI.
