I Built an Open-Source WordPress Security Scanner — 109 Checks in 60 Seconds

Description and use

An open‑source WordPress security scanner, wpsec109, performs 109 checks in ~60 s, identifies critical issues like PHP execution in uploads, and provides actionable fixes.

Problem

WordPress sites often have basic security misconfigurations that are rarely audited, such as PHP execution in uploads, exposed config files, missing headers, and weak permissions.

Outcome

The scanner identified 4 failures out of 109 checks, including PHP execution in uploads and exposed backup files, and provided clear remediation steps.

Workflow

• Clone the repository from GitHub
• Navigate to the project directory
• Run the scanner with python wordpress_security_check.py --target https://example.com
• Optionally add --wpscan-api-key YOUR_KEY for CVE cross‑reference
• Save a JSON report with --save report.json
• Review the console or JSON output for critical, high, medium, and low findings and apply the suggested fixes

Evidence

wpsec109 — a free, open-source scanner that checks 109 WordPress security hardening points across 22 categories in about 60 seconds.

Source

Sample Output: 109 checks run | 4 failed | 105 passed

Source