Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

WPScan review

Freemium#29 of 34 in Vulnerability Scanning Software

A specialist WordPress scanner with deep enumeration and security data APIs.

6.0/10Editor score
Visit WPScan
WPScan6.0 Visit WPScan

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

WPScan is a command-line, black-box security scanner built for WordPress sites and the teams responsible for assessing them. It identifies WordPress core, plugin, and theme versions, then checks them against WPScan’s vulnerability database. Its audience includes security professionals, developers, blog maintainers, and enterprise users that need WordPress-specific visibility rather than a general scanner covering many technology stacks. Supported targets include WordPress core, plugins, themes, usernames, media, configuration backups, database exports, TimThumb files, and remote WordPress applications.

The product’s strongest advantage is its depth within the WordPress ecosystem. Enumeration covers plugins, themes, usernames, media, and exposed resources, while checks include configuration backups and database exports. Password brute-force testing and authenticated scanning with WordPress application passwords extend assessment beyond passive version discovery. Real-time JSON Lines results streaming can suit command-line workflows, and the vulnerability data API provides information for WordPress, plugins, and themes. Slack and HTTP webhooks connect vulnerability events to existing notification or automation paths.

WPScan follows a freemium model with a Researcher plan offering CLI tools, non-commercial use, and API access. The Enterprise plan adds instant email alerts, the latest API endpoints, Slack and HTTP webhooks, description and proof-of-concept API data, and CVSS risk scores. Commercial API and Enterprise pricing use custom or quoted arrangements. Choose WPScan when WordPress is the primary assessment target and detailed enumeration or vulnerability data matters. Teams seeking broad, multi-technology vulnerability coverage should consider a more general-purpose alternative.

WPScan pros and cons

  • Where it wins
    • Scans WordPress core, plugins, themes, and exposed resources
    • Supports authenticated scans using WordPress application passwords
    • Provides JSON Lines results, API access, and webhook alerts
  • Where it doesn't
    • Focused on WordPress rather than broad vulnerability scanning
    • Commercial API and Enterprise pricing is custom or quoted
    • CLI use is limited to non-commercial activity on the Researcher plan

WPScan fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update