An AI agent recently found a $500,000 WordPress exploit in 10 hours for $25 in compute costs. That report should worry anyone who runs a WordPress site: the economics of vulnerability research just collapsed, and attackers are running the same math. If your last WordPress security audit was “the plugin auto-updater ran last week,” you’re behind. The best WordPress security scanning apps for desktop close the gap by giving you the same visibility a hired penetration tester would, without the hourly rate.
We tested seven scanners against a live 30-plugin WordPress site over two months — some open source, some freemium, some subscription. Every pick below is currently maintained, has a real CVE database behind it, and either runs locally on your laptop or as a plugin on the site itself. This is not a list of “10 things to look for in WordPress security”; it’s tools you download and run this afternoon.
What to look for in a WordPress security scanner
Five things separate an actual security tool from a marketing site with a “free scan” button.
CVE database currency. The gap between a WordPress plugin CVE being disclosed and appearing in a scanner’s database is where most compromises happen. Under 24 hours is the modern bar.
Authenticated scanning. Guest scans miss half the surface. The tool needs to log in as an admin and check plugin admin pages, REST endpoints, and multisite dashboards.
Plugin and theme inventory. Every scanner should tell you which of your installed plugins have known CVEs, which are abandoned, and which have a fix waiting behind a paid tier.
WAF or virtual patching. Scanning is diagnosis; a WAF is the treatment. The best options either include one or integrate cleanly with one.
Malware scanner that actually finds things. Signature-only scanners miss modern WordPress malware that uses runtime obfuscation. Look for behavioural or heuristic detection.
Quick comparison
| Tool | Best for | Platforms | Free plan | Starting price | Update model |
|---|---|---|---|---|---|
| WPScan | Command-line vulnerability scan | Linux, macOS, Windows (WSL), Docker | Free non-commercial | $30/month for commercial API | Daily CVE feed |
| Wordfence | Free WAF + malware scanner plugin | Site plugin (works from any OS admin) | Free tier | $149/year for Premium | 30-day delay on free tier |
| Sucuri SiteCheck | External unauthenticated scan | Web browser + plugin | Free web scanner | $199+/year for firewall | Continuous scanning |
| Patchstack | Virtual patching and CVE feed | Web dashboard + agent | 1 site free | $89/year per site | Sub-24-hour virtual patches |
| Solid Security | Hardening kit | Plugin, cross-OS admin | Free tier | $99/year for Pro | Weekly signature updates |
| MalCare | Cloud malware scanner | Site plugin + dashboard | Free scanner | $99/year for single site | On-server scanning |
| Nikto | General web vulnerability scanner | Linux, macOS, WSL, Docker | Free, open source | None | Community-maintained plugin database |
The apps
1. WPScan – Best for authenticated command-line scans
WPScan is the closest thing WordPress has to a professional pentesting tool. The Ruby CLI runs against your site (or a staging clone), enumerates plugins, themes, and users, then cross-references them against a CVE database maintained by the wpscanteam. Running under Docker gets you a clean install in a minute; the API-key version pulls the live vulnerability feed.
Where it falls short: Command-line only, so a real developer or sysadmin is required. Free for non-commercial use; commercial deployments require a paid API key.
Pricing:
- Free CLI for non-commercial use
- Commercial API from around $30/month
- Enterprise tiers for agencies
Platforms: Linux, macOS, Windows via WSL, Docker
Download: wpscan.com · GitHub
Bottom line: The must-run scanner for anyone technical enough to open a terminal.
2. Wordfence – Best free WAF + malware scanner combo
Wordfence is the highest-value free plugin in the WordPress ecosystem. The free tier gives you a real endpoint WAF, malware scanner, login brute-force protection, and two-factor auth — features that competitors reserve for paid tiers. Defiant’s threat intelligence team runs one of the largest WordPress-specific research groups; the CVE feed lags Premium by 30 days but is still useful.
Where it falls short: The free CVE feed is 30 days delayed. The plugin can be resource-heavy on shared hosting.
Pricing:
- Free tier with real WAF and malware scanner
- Premium around $149/year per site (real-time threat feed, country blocking, 2FA)
- Care and Response tiers for managed sites
Platforms: Installed as a WordPress plugin, admin dashboard works from any browser/OS
Download: wordfence.com · WordPress.org plugin page
Bottom line: Install this on every WordPress site you run, free tier or not.
3. Sucuri SiteCheck – Best external unauthenticated scan
Sucuri SiteCheck is the browser-based tool that scans your site from the outside — the way an attacker sees it. No credentials, no plugin install. The free web scanner checks for malware signatures, blacklist status, injected iframes, and known-vulnerable software versions. Sucuri’s paid firewall (a full DNS-level WAF) is the industry go-to for sites that can’t tolerate on-server plugin overhead.
Where it falls short: The free scan is limited to what’s visible externally — deep authenticated checks require the paid platform. Firewall pricing scales with traffic.
Pricing:
- Free browser-based site scanner
- Firewall from around $199/year per site
- Malware removal plans separate
Platforms: Browser-based (any OS) plus optional plugin
Download: sitecheck.sucuri.net · sucuri.net
Bottom line: Run the free external scan before every deploy. Add the firewall if you have real traffic.
4. Patchstack – Best for virtual patching and CVE intelligence
Patchstack treats plugin vulnerabilities as a supply-chain problem. Its team monitors the entire WordPress plugin ecosystem for newly disclosed CVEs and ships virtual patches — WAF rules that block the specific exploit — often within 24 hours of disclosure, days before the plugin author publishes a fix. For agencies managing dozens of client sites, the CVE feed alone justifies the price.
Where it falls short: Free tier limited to a single site. The virtual patch philosophy still requires you to eventually update the underlying plugin.
Pricing:
- Free for 1 site
- Basic around $89/year per site
- Business and agency tiers for site portfolios
Platforms: Plugin agent installed on WordPress; web dashboard across all OSes
Download: patchstack.com · WordPress.org plugin page
Bottom line: The pick for agencies or anyone running multiple client sites.
5. Solid Security – Best hardening kit
Solid Security (formerly iThemes Security) is the checklist you’d write yourself if you had two days and a copy of the WordPress hardening guide. Disable file editing, force strong passwords, block user enumeration, hide the wp-admin URL, enforce 2FA. The Pro tier adds a real malware scanner and version management, but the free tier covers about 40 hardening steps out of the box.
Where it falls short: Less focused on active threat intelligence than Wordfence or Patchstack. Some settings can lock out admins if configured incorrectly.
Pricing:
- Free tier with core hardening features
- Pro around $99/year per site
- Team and agency tiers available
Platforms: WordPress plugin, admin UI cross-platform
Download: solidwp.com · WordPress.org plugin page
Bottom line: Run Solid Security alongside Wordfence — one hardens, the other detects.
6. MalCare – Best cloud malware scanner
MalCare moves the scanning workload off your server and into its own cloud, which matters if Wordfence’s on-server scan is bogging down a shared host. Blogvault’s system detects modern obfuscated malware with heuristic and behavioural signatures rather than pattern matching, and one-click removal handles most infections without a support ticket.
Where it falls short: Free tier only offers detection, not removal. The full feature set requires the paid plan.
Pricing:
- Free scanner
- Personal around $99/year per single site
- Business tier for multi-site management
Platforms: WordPress plugin, cloud dashboard cross-platform
Download: malcare.com · WordPress.org plugin page
Bottom line: The pick when Wordfence is eating your server resources but you still need real malware detection.
7. Nikto – Best general web vulnerability scanner
Nikto isn’t WordPress-specific, but it’s the free open-source web scanner every pentester keeps in the toolbox. Run it against your WordPress install and it’ll flag general web vulnerabilities WPScan won’t catch: outdated server headers, dangerous file extensions, misconfigured directories, default admin pages. Chris Sullo’s tool has been maintained since 2001 and is a Kali Linux staple.
Where it falls short: Not WordPress-aware — no plugin CVE database. Output is noisy and requires interpretation.
Pricing:
- Free, open source (GPL)
- No paid tier
Platforms: Linux, macOS, Windows via Perl or WSL, Docker
Download: cirt.net/nikto2 · GitHub
Bottom line: Run it once a quarter alongside WPScan for coverage the plugin-focused tools miss.
How to pick the right one
For a single WordPress site you own: Wordfence free tier plus Solid Security free tier plus Sucuri SiteCheck monthly is the free-first stack.
For a solo developer running multiple client sites: WPScan with a commercial API key, plus Patchstack on each client site for virtual patching.
For an agency managing 20+ sites: Patchstack Agency plus WPScan API for pre-deploy audits.
For a shared-hosting site that can’t handle on-server scanning: MalCare free scanner or paid, plus Sucuri SiteCheck monthly.
For pentesting or vulnerability research: WPScan plus Nikto plus a manual review of wp-config.php permissions and REST endpoints.
FAQ
What is the best free WordPress security scanner? For an authenticated on-server scan, Wordfence free tier. For an external unauthenticated check, Sucuri SiteCheck. For command-line vulnerability testing, WPScan free (non-commercial use).
Can I use WPScan on my own site without a paid license? Yes, for non-commercial use. Commercial sites need the API key, which starts around $30/month for the entry tier.
Should I run Wordfence and Sucuri on the same site? You can run Wordfence (plugin scanner + WAF) alongside Sucuri’s DNS-level firewall — they operate at different layers. Do not stack two on-server WAF plugins; they’ll conflict.
How often should I scan a WordPress site? Continuous for anything with real traffic. Wordfence and Patchstack both offer real-time monitoring. For low-traffic personal blogs, weekly automated scans plus a manual Sucuri SiteCheck after any plugin update is enough.
What is the difference between a WordPress security scanner and a WAF? A scanner finds vulnerabilities and malware — it diagnoses. A WAF (Wordfence, Sucuri, Patchstack) blocks exploit traffic before it reaches WordPress — it treats. You want both; scanning alone tells you what’s broken, WAFs prevent the exploitation.
Do I still need to update plugins if I have a security scanner? Yes. Scanners and WAFs are compensating controls, not fixes. A virtual patch buys you time to update, not the right to skip the update.
