wpsecscan v2.9.1
☰
/ compare

vs Wordfence · WPScan · Sucuri

Where another tool does something WPSecScan doesn't — Wordfence's firewall, Sucuri's malware cleanup — that's marked too. Different tools, different jobs.

Updated for WPSecScan v2.9.1. A cell reading "not verified" means we could not confirm it from the pages listed under Sources. Sources at the bottom of this page.

Feature WPSecScan Wordfence (free) Wordfence (premium) WPScan CLI Sucuri (free)
License AGPL-3.0-or-later GPLv3 + EULA (per plugin changelog) not verified WPScan Public Source License (custom; fee for commercial use) not verified
Cost (single site) $0 Free tier not verified CLI free to use; commercial use needs a paid license; API free up to 25 calls/day (non-commercial) Free WordPress plugin; platform plans from $229/yr
How you run it CLI: pip, Windows .exe, or source WordPress plugin WordPress plugin (premium license) Ruby CLI: RubyGems, Docker, Homebrew tap Free WordPress plugin; paid cloud platform
Total distinct checks 294 no count on cited pages no count on cited pages no count on cited pages no count on cited pages
Read-only proof helpers 5 (--prove) not verified not verified not verified not verified
Continuous monitoring a continuous file-change monitor (companion plugin) + a new-CVE alert watcher Live Traffic view (real-time activity) Live Traffic view (real-time activity) not verified not verified
CVE data sources Up to 8 public sources (NVD, MITRE, GHSA, OSV, Wordfence, WPVulnerability, Patchstack, CIRCL); per-source counts in the feed header source not stated on cited page source not stated on cited page WPScan's own database, entries added manually (via API) not verified
Data update cadence CVE feed aggregated nightly Firewall rules and malware signatures delayed 30 days Real-time firewall rules and malware signatures API described as real-time; database dump updated daily at 6 am GMT not verified
Web application firewall — ✓ ✓ — — (in paid plans)
Login brute-force limiting — ✓ ✓ — not verified
Malware cleanup — Manual delete/repair tools Manual delete/repair tools — (information only) Paid plans: unlimited manual cleanups
Audit log ✓ (credential-vault & marketplace actions) — (Premium feature) ✓ not verified not verified
Report formats 9 native (json, html, csv, md, xlsx, sarif, burp, docx, exec-pdf) + 14 via emit not verified not verified not verified not verified
Compliance frameworks mapped 12 (PCI-DSS 4.0, NIST 800-53, ISO 27001, ISO 27001:2022, NIST CSF 2.0, CIS v8, HITRUST, CMMC 2.0, HIPAA, SOC 2, FedRAMP, GDPR) not verified not verified not verified not verified
Push destinations (one-shot) 16 providers (wpsecscan push <provider>) not verified not verified Webhooks: Slack & HTTP (Enterprise plan) not verified

Which tool should you use?

Use WPSecScan if you want…

  • A CLI you run yourself (pip, Windows .exe, or source)
  • CVE data aggregated from up to 8 public sources
  • A scanner only — no firewall, no login blocking, no malware cleanup
  • A $0 license (AGPL)

Use Wordfence if you want…

  • A firewall that runs inside WordPress
  • Login attempt limiting
  • Real-time firewall rule and malware-signature updates (premium)
  • WordPress-plugin-based install (no CLI required)

Use WPScan CLI if you want…

  • A Ruby-based command-line scanner
  • WPScan's own vulnerability database, queried through its API
  • Username enumeration and exposed-file checks (per WPScan's FAQ)

Use Sucuri if you want…

  • A managed service (you don't run anything)
  • Manual malware cleanups included in its paid plans
  • A cloud firewall with a CDN

The tools do different jobs. WPSecScan audits; Wordfence and Sucuri also block or clean. The table above shows where each one stops.

Sources for these claims