Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Use WPScan in two passes: first discover the WordPress core version, plugins and themes, then match those components against WPScan’s vulnerability database. A basic scan is wpscan --url https://example.com. Add an API token to receive associated vulnerability records, and use -e vp for vulnerable-plugin enumeration or -e vt for vulnerable-theme enumeration.
Only scan a site you own or have explicit permission to test. A WPScan finding is a lead for verification and remediation, not proof that an attacker successfully exploited the site.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What WPScan does
WPScan is a black-box WordPress security scanner intended for security professionals, site administrators and blog maintainers testing authorized sites. It can identify WordPress versions, installed plugins, installed themes, usernames, exposed backups, database exports and other WordPress-specific exposure points.
Its vulnerability information comes from the WPScan WordPress Vulnerability Database API. The API provides lookups for WordPress core, plugin and theme vulnerabilities, including lookups by component slug and version. WPScan says many records are manually verified and that it is a CVE Numbering Authority able to assign CVE numbers for WordPress core, plugin and theme vulnerabilities.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Discovery and vulnerability lookup are separate functions:
- Discovery: determine which WordPress version, plugin slugs, theme slugs and other visible components are present.
- Lookup: use the detected component and version to retrieve known vulnerability records from the API.
The scanner can still identify components without an API token, but it does not display the associated known-vulnerability records.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Prepare a safe, useful scan
Confirm authorization and scope
Scanning a third-party site without permission can violate contracts, computer-misuse laws or the site owner’s terms. Obtain written authorization that names the host, permitted dates, scan intensity and any exclusions. Keep production scans within the agreed request rate, and use a staging copy when a higher-volume test is not necessary.
Have the required values ready
- The complete site URL, including the correct
https://scheme when the site uses HTTPS. - A WPScan API token, obtained by registering with WPScan, if you need vulnerability records.
- For WPScan 4.0’s authenticated workflow, a WordPress Application Password for an authorized account.
- A place to record the exact component slug, detected version, affected-version range, fixed release and remediation date.
Protect tokens and Application Passwords like credentials. Do not paste them into public issue trackers, shell history shared with other users or scripts committed to source control. Use environment variables or a secrets store when automating.
Run the basic WPScan command
Unauthenticated discovery
wpscan --url https://example.comThis command asks WPScan to inspect the target without credentials. Depending on what the site exposes, the report can include the WordPress version, visible plugins and themes, usernames, exposed backups, database exports and other WordPress-specific findings.
Without a token, component detection still works, but WPScan omits the associated vulnerability records. That makes an unauthenticated, tokenless run useful for inventory, not for a complete vulnerability review.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Discovery plus vulnerability data
wpscan --url https://example.com --api-token YOUR_TOKENReplace YOUR_TOKEN with the token issued to your WPScan account. The token authorizes requests to the vulnerability database; it does not grant WordPress administrator access to the target.
Find vulnerable plugins
Use the vp enumeration code
wpscan --url https://example.com -e vp --api-token YOUR_TOKEN-e vp tells WPScan to enumerate vulnerable plugins. The scanner first tries to identify plugin slugs and versions, then asks the vulnerability API whether a detected version falls within an affected range.
Record the slug and version exactly as WPScan reports them. A plugin’s display name can be ambiguous, while the slug is the identifier used by vulnerability records. If the version is unknown or inferred rather than confirmed, treat the result as requiring verification before deciding that the site is vulnerable.
Choose a plugin-detection mode
WPScan’s documentation says plugin enumeration defaults to passive detection. You can change the mode when the default does not provide enough coverage.
| Mode | What it means | When to use it | Trade-off |
|---|---|---|---|
| Passive | The default discovery approach. | Routine inventory, lower-impact checks and sites where request volume must stay small. | Fewer requests and a gentler footprint, but it can miss components that are not revealed passively. |
| Mixed | Combines passive clues with additional checks. | When you need more plugin results and have authorization for the extra traffic. | Broader coverage with more requests than passive mode; WPScan recommends this when more results are needed. |
| Aggressive | The highest-request approach among the documented detection choices. | Authorized assessments where maximum discovery coverage matters more than request minimization. | More traffic and a greater chance of triggering rate limits, monitoring alerts or web-application-firewall rules. |
Use the detection-mode option documented by the version installed on your machine. Examples that use older --plugins-detection CLI syntax should be treated as CLI documentation, not as a guarantee that every current release exposes the same flags.
Find vulnerable themes
Use the vt enumeration code
wpscan --url https://example.com -e vt --api-token YOUR_TOKEN-e vt asks WPScan to enumerate vulnerable themes and check the detected theme versions against the vulnerability database. Run it separately when you want a clearly attributable theme report, or include it in a broader authorized assessment alongside plugin enumeration.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Theme detection is subject to the same visibility limits as plugin detection. A theme that is not exposed to an unauthenticated request may not appear in a passive scan, and a version that cannot be confirmed should not be treated as a certain match. Keep the exact slug and version from the report before consulting the vulnerability record.
Use WPScan 4.0’s authenticated component workflow
WPScan 4.0 documents a current workflow that uses a WordPress Application Password and queries the WordPress REST API directly. The purpose is to obtain an authoritative list of every active or inactive plugin and theme, rather than relying only on what an unauthenticated black-box scan can infer.
- Create a dedicated Application Password. Generate one for an authorized WordPress account, give it a recognizable name and store the value securely. Do not reuse a personal password.
- Use the authenticated workflow documented for your installed WPScan 4.0 build. Supply the target URL and Application Password using the current command or prompts shown by that build. Do not assume an older
--plugins-detectionexample is the syntax for this workflow. - Review the returned inventory. Pay particular attention to inactive plugins and themes, which may be absent from an unauthenticated view but still remain on disk and become risky if reactivated or reached through another weakness.
- Match the inventory to vulnerability records. Keep the API token available if the authenticated workflow requires vulnerability lookups; the Application Password and API token serve different purposes.
- Revoke credentials when the authorized test ends. Remove the temporary Application Password or rotate it according to your organization’s access policy.
This authenticated approach improves inventory completeness; it does not make every listed component exploitable. Vulnerability impact still depends on the affected version, configuration, exposure and the conditions described in the individual record.
Understand API tokens and request limits
What the token changes
The token enables WPScan to associate discovered WordPress, plugin and theme versions with records in its vulnerability database. If a tokenless scan lists a plugin but shows no vulnerability details, that is expected behavior rather than evidence that the plugin is safe.
How the documented free quota is calculated
The WordPress.org listing for WPScan documents 25 API requests per day on the free plan. It describes the request model as one request for the WordPress version, one request for each installed plugin and one request for each installed theme.
| Inventory item | Requests described by the listing |
|---|---|
| WordPress version | One request |
| Each installed plugin | One request per plugin |
| Each installed theme | One request per theme |
For perspective, the same listing reports an average of 22 installed plugins per WordPress website. A site with 22 plugins, one core-version request and more than two themes would require more than 25 requests for that scan under the stated model. Your actual count depends on the inventory and on requests made by other scans that day.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Plan the scan schedule around the quota. Do not describe the 25-request figure as permanent: it is the documented free-plan allowance accessed in 2026 and may change. If your authorized environment needs more capacity, review the current WPScan plan terms rather than guessing at a paid limit.
Scheduled scans and notifications
The WordPress.org listing also describes scheduled daily scans and email notifications. It lists checks for exposed debug logs, backup wp-config.php files, XML-RPC exposure, repository files, default secret keys, exported databases, weak passwords and HTTPS status. These checks complement plugin and theme version matching; they do not replace a manual review of the underlying exposure.
Read a vulnerability result correctly
A result normally identifies a component/version match or another known exposure for investigation. It does not, by itself, prove that exploitation succeeded, that the vulnerable code path is reachable on your site or that every deployment is affected.
Use this sequence for every material finding:
- Record the evidence. Copy the component slug, detected version, URL, scan date and any confidence or detection notes.
- Read the vulnerability record. Check the affected-version range, vulnerability type, severity information, prerequisites and any listed CVE identifier.
- Confirm the fixed release. Compare the record with the component vendor’s release information. Do not jump directly from a finding to an arbitrary newer version if compatibility constraints matter.
- Choose remediation. Update to the confirmed fixed release, remove the component if it is unnecessary or isolate the site while a compatible fix is prepared. Inactive software is still part of the attack surface until removed.
- Investigate when severity warrants it. Review web-server, WordPress and security-monitoring logs for indicators of attempted or successful abuse. A scanner finding alone is not an incident declaration.
- Rescan and verify. Run WPScan again after the change. Confirm that the detected version changed and that the vulnerability record is no longer associated with the installed component.
What to do when a scan finds nothing
“No vulnerabilities displayed” can have several explanations:
Recommended Free Tools
- The scan ran without an API token, so vulnerability records were intentionally omitted.
- The plugin or theme was not discovered because passive detection could not see it.
- The component version was not exposed or could not be matched confidently.
- The database has no record for that exact slug and version, which is not the same as a guarantee of safety.
- The API request budget was exhausted or a request failed before lookups completed.
Check the scan’s status and inventory first. If the site owner authorized more traffic, repeat plugin discovery in mixed mode. For a complete active/inactive inventory, use the authenticated REST API workflow documented for WPScan 4.0.
Compare practical WPScan approaches
| Approach | Visibility | Control | Request and setup considerations |
|---|---|---|---|
| Unauthenticated CLI scan | Components exposed to external requests. | Highest command-line control and easy automation. | No WordPress credential is needed, but hidden or inactive components may be missed; add an API token for vulnerability records. |
| Authenticated WPScan 4.0 workflow | Authoritative active and inactive plugin and theme lists through the WordPress REST API. | More complete inventory and clearer component state. | Requires a WordPress Application Password and the current 4.0 workflow; protect and revoke the credential. |
| Passive plugin detection | Lower-impact, externally visible evidence. | Quiet routine checks. | Fewer requests, but potentially less coverage. |
| Mixed or aggressive detection | More opportunities to identify plugins. | Better coverage when passive evidence is insufficient. | More requests; obtain explicit authorization and watch for rate limits or defensive controls. |
| CLI automation | Whatever the selected scan mode can discover. | Scheduling, repeatable output and integration with operations. | You must manage API quotas, secrets, error handling and result storage. |
| WordPress plugin-based scanning | Site-local checks and the features described in the WordPress.org listing. | Convenient scheduled daily scans and email notifications. | Less command-line control; keep the plugin itself updated and account for its API request usage. |
Troubleshoot common WPScan problems
“The scan lists plugins but no vulnerabilities”
Check whether --api-token was supplied and whether the token is valid. A tokenless run intentionally omits associated vulnerability data. If the token is valid, inspect the API response or scan status for quota exhaustion and failed requests.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
“The plugin list is incomplete”
Passive detection is the default and makes fewer requests. With authorization, repeat discovery in mixed mode. If you need an authoritative list of active and inactive components, use the WPScan 4.0 Application Password workflow instead of assuming that an external scan can reveal everything.
“The API quota was exceeded”
Count the core, plugin and theme requests described by the API listing, then include any other scans made that day. Avoid repeatedly rescanning the same site while troubleshooting. Schedule inventories so that the documented 25-request free allowance is not consumed by overlapping jobs, or review current account options for a larger capacity.
Free tools Windows power users keep installed
One-click scans. No signup required.
“The site blocks or throttles the scan”
Stop and confirm the authorized request rate. Move from aggressive or mixed discovery to passive mode when the assessment allows it, coordinate with the site owner and review web-application-firewall logs. Do not attempt to bypass a defensive control without written authorization.
“A finding appears to be a false positive”
Verify the exact slug and version, then read the affected-version range in the vulnerability record. Check whether a vendor backported a fix without changing the displayed version, whether the scanner inferred the version and whether the vulnerable feature is enabled in this deployment. Ask the component vendor or WPScan for clarification when the record and installed code disagree; do not silently mark the issue fixed without evidence.
“The rescan still reports the old version”
Confirm that the update completed on the scanned environment, clear any deployment or caching layer that serves old assets, and check that the site URL points to the intended instance. Record the new installed version and rerun the scan after propagation.
Build a repeatable remediation record
For each scan, retain the date, target URL, WPScan version, detection mode, API-account context, detected core version, plugin and theme slugs, versions, vulnerability identifiers, affected ranges, fixed releases, owner, remediation date and rescan result. This turns a one-time scan into an auditable process.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Separate inventory changes from security decisions. A newly discovered inactive plugin is an inventory event; deciding to remove it is a remediation decision that should have an owner and a change record. Likewise, an API record is evidence to investigate, while confirmation of exploitation requires log or incident-response evidence.
Bottom line
Start with wpscan --url for authorized discovery, add an API token for vulnerability records, and use -e vp and -e vt to focus on plugins and themes. Choose passive detection for a quieter inventory and mixed detection when broader coverage is authorized. For WPScan 4.0, use the authenticated Application Password and REST API workflow when you need the authoritative active/inactive component list. Verify every finding against its affected and fixed versions, remediate or remove the component, investigate logs when appropriate and rescan to prove the result changed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
