/ download · v2.9.1

Download WPSecScan v2.9.1

Windows .exe from the GitHub release, pip install wpsecscan on any OS with Python 3.10+, or install from source. Release assets are Sigstore-signed and have GitHub build-provenance attestations. → verify your download

Windows · direct .exe

wpsecscan.exe

CLI · ~22 MB

Command-line scanner. PowerShell + Bash friendly.

⬇ Download v2.9.1

wpsecscan-gui.exe

GUI · ~22 MB

Tkinter GUI. Double-click to run.

⬇ Download v2.9.1

⚠ The binaries are not Authenticode-signed, so Windows SmartScreen will warn on first run. Windows Defender may also flag the .exe — a known false-positive on offensive-pattern strings inside the scanner. See docs → Defender. Verify the download (below) before you run it.

pip, source and Docker

pip (cross-platform)

pip install wpsecscan

Requires Python 3.10 or newer. PyPI

From source

git clone https://github.com/bryanflowers/wpsecscan
cd wpsecscan
pip install -e ".[all]"

Docker

No prebuilt image is published. Build locally from a source checkout:

docker build -t wpsecscan .

Other files on the v2.9.1 release page: wheel, sdist.

WordPress companion plugin (optional)

For authenticated, server-side checks (MFA audit, DB triggers, wp-cron jobs, webhook URL inventory): install the companion plugin into your WordPress. It exposes a read-only, token-gated REST endpoint that WPSecScan reads.

View wpsecscan-companion on GitHub

Install from source: zip the wpsecscan-companion folder and use Plugins → Upload Plugin in your WP admin. It is not on wordpress.org. GPL-2.0-or-later; see the plugin header for its version.

Verify your download

SHA256SUMS.txt

Hash of every binary in this release.

sbom.cyclonedx.json

Software Bill of Materials (CycloneDX).

Each .exe has a Sigstore .sig + .pem pair on the release page, and a GitHub build-provenance attestation. Download the .exe, its .sig and .pem, and SHA256SUMS.txt into one folder, then:

# GitHub build-provenance attestation
gh attestation verify wpsecscan.exe --owner bryanflowers

# Sigstore signature
cosign verify-blob \
  --certificate wpsecscan.exe.pem \
  --signature wpsecscan.exe.sig \
  --certificate-identity-regexp 'github.com/bryanflowers/wpsecscan' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wpsecscan.exe

# SHA-256 checksum
sha256sum -c SHA256SUMS.txt

Full verification guide →

First-time use

$ wpsecscan --demo                       # walk every check with a fake site
$ wpsecscan db update                    # pull latest CVE feed
$ wpsecscan db source-stats              # per-source breakdown
$ wpsecscan https://your-site.com        # real scan
$ wpsecscan-gui                          # launch the GUI