Free · No signup · Takes about 10 seconds
Is your WordPress site quietly exposed?
Paste any WordPress site's URL below — yours, or one you're evaluating — for a free, read-only check: exposed backup files, missing security headers, browsable upload folders, and version disclosure. The same things an attacker's automated scanner checks first, before you.
Results for
Loyal Security's firewall, hardening module, and file-integrity monitor catch exactly this class of exposure — automatically, going forward, on every scan. Free, forever, for the core protection.
What this checks (and what it doesn't)
Every check here is passive and read-only — the same requests a normal browser visit
already makes, just automated. Nothing is submitted, modified, or exploited. We check:
security response headers, whether your WordPress version leaks in the page source,
whether /wp-content/uploads/ allows directory browsing, and whether common
backup/debug files (.env, debug.log, .git/config,
wp-config.php.bak) are publicly reachable.
This is a surface-level check, not a full audit — a clean result here doesn't mean a site has no vulnerabilities, only that it doesn't have these specific, common misconfigurations. Only scan a site you own or have permission to test.