This page's audience our own tag's counts — open to see them

Period

–Visits

–Page views

–Clicks to vendors

–Time on page

–Reading now

Clicks to vendors, by tool

Top countries

Devices

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

WPScan

Freemium#29 of 34 in Vulnerability Scanning Software

WPScan: A specialist WordPress scanner with deep enumeration and security data APIs. Ranked #29 of 34 in Vulnerability Scanning Software by our editors (6.0/10); pricing: Freemium; best for wordPress-specific vulnerability assessment.

6.0/10Editor score

Visit WPScan

WPScan6.0 Visit WPScan

At a glance

Editor score
6.0 / 10
Pricing
Freemium
Best for
WordPress-specific vulnerability assessment
Facts checked
20 Sep 2026

Where it wins
- Scans WordPress core, plugins, themes, and exposed resources
- Supports authenticated scans using WordPress application passwords
- Provides JSON Lines results, API access, and webhook alerts
Where it doesn't
- Focused on WordPress rather than broad vulnerability scanning
- Commercial API and Enterprise pricing is custom or quoted
- CLI use is limited to non-commercial activity on the Researcher plan

Our verdict on WPScan

WPScan is a command-line, black-box security scanner built for WordPress sites and the teams responsible for assessing them. It identifies WordPress core, plugin, and theme versions, then checks them against WPScan’s vulnerability database. Its audience includes security professionals, developers, blog maintainers, and enterprise users that need WordPress-specific visibility rather than a general scanner covering many technology stacks. Supported targets include WordPress core, plugins, themes, usernames, media, configuration backups, database exports, TimThumb files, and remote WordPress applications.

The product’s strongest advantage is its depth within the WordPress ecosystem. Enumeration covers plugins, themes, usernames, media, and exposed resources, while checks include configuration backups and database exports. Password brute-force testing and authenticated scanning with WordPress application passwords extend assessment beyond passive version discovery. Real-time JSON Lines results streaming can suit command-line workflows, and the vulnerability data API provides information for WordPress, plugins, and themes. Slack and HTTP webhooks connect vulnerability events to existing notification or automation paths.

WPScan follows a freemium model with a Researcher plan offering CLI tools, non-commercial use, and API access. The Enterprise plan adds instant email alerts, the latest API endpoints, Slack and HTTP webhooks, description and proof-of-concept API data, and CVSS risk scores. Commercial API and Enterprise pricing use custom or quoted arrangements. Choose WPScan when WordPress is the primary assessment target and detailed enumeration or vulnerability data matters. Teams seeking broad, multi-technology vulnerability coverage should consider a more general-purpose alternative.

Your product? Our editors can test WPScan in depth and publish a review, labelled as paid · from $149/mo →

WPScan pricing

Plans FreemiumFreemium A usable free plan; paid tiers unlock the limits above. Prices checked 20 Sep 2026.

See plans on wpscan.com

All 2 WPScan plans and prices →

WPScan fact sheet

Free plan	Not verified
Paid from	Not verified
Deployment model	Not verified
Supported targets	WordPress core, plugins, themes, usernames, media, configuration backups, database exports, TimThumb files, and remote WordPress applications
Authenticated scanning	Yes
Continuous scanning	Not verified
Asset limit	Not verified
Compliance frameworks	Not verified
Deployment	Cloud, Self-hosted
Platforms	Linux, macOS
Support	Docs
Built for	Solo, Small business, Enterprise (editorial estimate)
Integrations	2 integrations: Slack, HTTP webhooks
Pricing	Freemium (source)
Website	wpscan.com
Facts checked	20 Sep 2026

WPScan integrations

WPScan lists 2 integrations on its own site.

Slack
HTTP webhooks

Alternatives to WPScan

See all WPScan alternatives →

Used WPScan? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used WPScan for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used WPScan myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

WPScan is listed in our Vulnerability Scanning Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/wpscan/"><img src="https://www.itechguides.com/best/badge/wpscan.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update