/ features
All 189 checks
Every WPSecScan check, grouped by category, with full security-framework tags (OWASP Top 10 · MITRE ATT&CK · CWE · D3FEND) and compliance mapping (PCI-DSS 4.0 · NIST 800-53 · ISO 27001).
156 passive 33 aggressive (opt-in via --aggressive)
Discovery & enumeration
25 checks| ID | What it checks | Mode |
|---|---|---|
waf | WAF / CDN detection A05:2021 · Security Misconfiguration | passive |
core_version | WordPress core version A06:2021 · Vulnerable & Outdated Components | passive |
plugins | Plugin enumeration A06:2021 · Vulnerable & Outdated Components | passive |
themes | Theme enumeration A06:2021 · Vulnerable & Outdated Components | passive |
users | User enumeration A07:2021 · Identification & Authn Failures | passive |
users_deep | Deep user enumeration — 10 sources (#5) A07:2021 · Identification & Authn Failures | passive |
subdomains | Subdomain discovery A05:2021 · Security Misconfiguration | passive |
rest_api | WP REST API surface audit A01:2021 · Broken Access Control | passive |
wp_rest_methods | REST method enumeration A01:2021 · Broken Access Control | passive |
ajax_surface | admin-ajax action surface A01:2021 · Broken Access Control | aggressive |
admin_ajax_brute_surface | admin-ajax throttle probe A07:2021 · Identification & Authn Failures | passive |
spider_crawl | Spider — recursive link crawler (#18) A05:2021 · Security Misconfiguration | passive |
forced_browse | Forced-browse hidden-path discovery (#21) A05:2021 · Security Misconfiguration | passive |
openapi_scanner | OpenAPI / Swagger endpoint scanner (#26) A05:2021 · Security Misconfiguration | passive |
mobile_app_endpoints | Mobile-app association discovery (#38) A05:2021 · Security Misconfiguration | passive |
host_recon | Host port recon — Docker/Redis/k8s/etc. (#40) A05:2021 · Security Misconfiguration | passive |
origin_ip_discovery | Origin-IP discovery via subdomains (#23) A05:2021 · Security Misconfiguration | passive |
favicon_fingerprint | Favicon fingerprint A05:2021 · Security Misconfiguration | passive |
favicon_hash | Favicon fingerprint hash (Shodan) A05:2021 · Security Misconfiguration | passive |
server_stack_reveal | Server-stack reveal + PHP EOL detect (#B22+B29) A05:2021 · Security Misconfiguration | passive |
waf_brand_deep | WAF brand deep-detect — 11 vendors (#B23) A05:2021 · Security Misconfiguration | passive |
waf_ruleset | WAF rule-set identification A05:2021 · Security Misconfiguration | passive |
js_framework_deep | JS framework deep-detect + version pin (#B31) A06:2021 · Vulnerable & Outdated Components | passive |
rest_app_passwords_enum | REST Application Passwords auth probe (#62) A07:2021 · Identification & Authn Failures | passive |
plugin_hash_fingerprint | Plugin file-hash fingerprint (#2) A05:2021 · Security Misconfiguration | passive |
Authentication & session
17 checks| ID | What it checks | Mode |
|---|---|---|
login | Login surface A07:2021 · Identification & Authn Failures | passive |
login_throttle | Login rate-limiting test A07:2021 · Identification & Authn Failures | passive |
login_throttle_deep | Deep throttle mapping (opt-in, 20 min) A07:2021 · Identification & Authn Failures | passive |
app_passwords | Application Passwords audit A07:2021 · Identification & Authn Failures | passive |
csrf_nonce | CSRF / nonce form audit A01:2021 · Broken Access Control | passive |
csrf_entropy | CSRF nonce entropy sampler A01:2021 · Broken Access Control | passive |
nonce_freshness | WP nonce freshness audit A01:2021 · Broken Access Control | passive |
oauth_redirect | OAuth / login redirect-URI A01:2021 · Broken Access Control | passive |
oauth_oidc | OAuth2 / OIDC discovery audit A07:2021 · Identification & Authn Failures | passive |
saml_xsw | SAML / XSW endpoint discovery A07:2021 · Identification & Authn Failures | passive |
jwt_audit | JWT audit (alg=none + weak HS256) A02:2021 · Cryptographic Failures | passive |
session_fixation | Session-fixation precondition probe A07:2021 · Identification & Authn Failures | passive |
login_timing | Login timing side-channel (user enum) A07:2021 · Identification & Authn Failures | passive |
default_creds | Default credentials probe A07:2021 · Identification & Authn Failures | aggressive |
auth_modernisation | Auth modernisation — passkey/2FA/SAML/OAuth/JWT/magic-link (#40-46) A07:2021 · Identification & Authn Failures | passive |
mfa_priv_account_audit | MFA on privileged accounts (companion) (#63) A07:2021 · Identification & Authn Failures | passive |
hibp | HaveIBeenPwned lookup A07:2021 · Identification & Authn Failures | passive |
Transport & headers
23 checks| ID | What it checks | Mode |
|---|---|---|
tls_headers | TLS & security headers A05:2021 · Security Misconfiguration | passive |
csp | CSP deep analysis A05:2021 · Security Misconfiguration | passive |
cors | CORS misconfiguration A05:2021 · Security Misconfiguration | passive |
cookies | Cookie hardening A07:2021 · Identification & Authn Failures | passive |
cache_headers | Cache-header audit A04:2021 · Insecure Design | passive |
cache_poisoning | Web-cache poisoning probe A05:2021 · Security Misconfiguration | passive |
cache_poisoning_v2 | Cache poisoning chain v2 (#35) A05:2021 · Security Misconfiguration | aggressive |
mixed_content | Mixed-content (HTTP-in-HTTPS) audit A02:2021 · Cryptographic Failures | passive |
tls_deep | Deep TLS audit A02:2021 · Cryptographic Failures | passive |
tls_protocol_audit | Deep TLS protocol + cipher + cert audit A02:2021 · Cryptographic Failures | passive |
tls_reneg_dos | TLS renegotiation DoS probe (#26) A02:2021 · Cryptographic Failures | passive |
http_methods | HTTP method enumeration A05:2021 · Security Misconfiguration | passive |
http2_settings | HTTP/2 fingerprint + EOL backend A06:2021 · Vulnerable & Outdated Components | passive |
http3_fingerprint | HTTP/3 + QUIC fingerprint A05:2021 · Security Misconfiguration | passive |
smuggling_probe | HTTP request-smuggling indicators A03:2021 · Injection | passive |
http2_smuggling | HTTP/2 CRLF smuggling probe (#24) A05:2021 · Security Misconfiguration | aggressive |
header_smuggling_case | Header smuggling via case sensitivity A05:2021 · Security Misconfiguration | aggressive |
hpp | HTTP Parameter Pollution probe A03:2021 · Injection | aggressive |
server_timing | Server-Timing / debug headers A09:2021 · Logging & Monitoring Failures | passive |
sri_audit | Subresource Integrity (SRI) audit (#B24) A08:2021 · Software & Data Integrity Failures | passive |
sri_pwa_misc | SameSite/WebDAV/PWA/HTTP3/contrast (#B25+B30+B32-B34) A05:2021 · Security Misconfiguration | passive |
cookie_consent | GDPR/ePrivacy cookie-consent audit A04:2021 · Insecure Design | passive |
crypto_agility | Crypto agility — PQ/TLS 1.3 hybrid/cert inventory (#47-51) A02:2021 · Cryptographic Failures | passive |
File & directory exposure
25 checks| ID | What it checks | Mode |
|---|---|---|
exposed_files | Exposed files A05:2021 · Security Misconfiguration | passive |
directory_listing | Directory listing A05:2021 · Security Misconfiguration | passive |
debug_leaks | Debug & info leaks A09:2021 · Logging & Monitoring Failures | passive |
robots_sitemap | robots.txt / sitemap audit A05:2021 · Security Misconfiguration | passive |
backup_exposure | Backup-plugin file exposure A05:2021 · Security Misconfiguration | passive |
backup_file_fuzz | Backup-file long-tail fuzzer A05:2021 · Security Misconfiguration | passive |
source_maps | Source-map exposure A02:2021 · Cryptographic Failures | passive |
secret_leak | Accidental API-key leak scan A02:2021 · Cryptographic Failures | passive |
premium_license_leak | Premium plugin license-key leak scan (#7) A02:2021 · Cryptographic Failures | passive |
security_txt | security.txt (RFC 9116) audit A09:2021 · Logging & Monitoring Failures | passive |
dev_params | Beta/test/debug query parameters A05:2021 · Security Misconfiguration | passive |
webdav | WebDAV / OPTIONS enumeration A05:2021 · Security Misconfiguration | passive |
well_known | /.well-known/ resource enumeration A05:2021 · Security Misconfiguration | passive |
upload_path_predictable | Predictable upload paths A01:2021 · Broken Access Control | passive |
timthumb | timthumb.php CVE detection (#1) A06:2021 · Vulnerable & Outdated Components | passive |
env_file_enum | .env file exposure + secret sniffing (#67) A05:2021 · Security Misconfiguration | passive |
git_dir_deep_scan | Deep .git directory enumeration (#66) A05:2021 · Security Misconfiguration | passive |
helm_compose_leak | Helm/compose/k8s manifest exposure (#68) A05:2021 · Security Misconfiguration | passive |
tailwind_css_comment_leak | Tailwind/CSS filesystem-path leak (#69) A05:2021 · Security Misconfiguration | passive |
composer_lock_audit | composer.lock exposure + CVE check (#59) A06:2021 · Vulnerable & Outdated Components | passive |
package_lock_audit | package-lock.json exposure + CVE check (#60) A06:2021 · Vulnerable & Outdated Components | passive |
yarn_pnpm_lock_audit | yarn.lock / pnpm-lock.yaml exposure (#61) A06:2021 · Vulnerable & Outdated Components | passive |
solidity_abi_leak | Solidity contract ABI leak (#74) A05:2021 · Security Misconfiguration | passive |
wallet_seed_phrase_leak | Wallet seed phrase leak (BIP-39 scan) (#75) A02:2021 · Cryptographic Failures | passive |
payment_gateway_test_keys | Payment-gateway test/sandbox key leak (#76) A05:2021 · Security Misconfiguration | passive |
Injection & client-side
18 checks| ID | What it checks | Mode |
|---|---|---|
xss_dom_sinks | DOM-XSS source/sink scan A03:2021 · Injection | passive |
xss_reflected | Reflected XSS probes A03:2021 · Injection | aggressive |
sqli | SQL injection probes A03:2021 · Injection | aggressive |
ssti | Server-side template injection probe A03:2021 · Injection | aggressive |
nosql_injection | NoSQL operator injection probe A03:2021 · Injection | aggressive |
path_traversal | Path traversal probes A01:2021 · Broken Access Control | aggressive |
path_bypass | Path-normalisation bypass probe A01:2021 · Broken Access Control | aggressive |
sendmail_injection | Email header injection probe A03:2021 · Injection | aggressive |
prototype_pollution | Prototype-pollution reflection probe A03:2021 · Injection | aggressive |
csv_export_csp | CSV-export formula-injection probe A03:2021 · Injection | aggressive |
misc_injection_audit | LDAP/XPath/SSI/ESI/CRLF/email-header (#32-34) A03:2021 · Injection | aggressive |
wp_query_sqli | WP_Query/wpdb-specific SQLi (#4) A03:2021 · Injection | aggressive |
cryptominer_js_injection | Cryptominer JS injection (#56) A03:2021 · Injection | passive |
magecart_skimmer_patterns | Magecart / card-skimmer DOM hooks (#57) A03:2021 · Injection | passive |
postmeta_stored_xss_scan | post_meta stored-XSS scan via REST (#54) A03:2021 · Injection | passive |
wp_cli_inject | WP-CLI command-injection probe (#B28) A03:2021 · Injection | aggressive |
ai_prompt_injection_passive | AI/LLM-plugin prompt-injection surface (#51) A03:2021 · Injection | passive |
xxe_upload | XXE via SVG upload probe A05:2021 · Security Misconfiguration | aggressive |
SSRF / RCE / open access
13 checks| ID | What it checks | Mode |
|---|---|---|
ssrf | SSRF probes A10:2021 · Server-Side Request Forgery | aggressive |
open_redirect | Open-redirect probes A10:2021 · Server-Side Request Forgery | aggressive |
cloud_metadata_ssrf | Cloud-metadata SSRF chain (needs SSRF candidate) A10:2021 · Server-Side Request Forgery | aggressive |
dns_rebinding | DNS-rebinding SSRF probe A10:2021 · Server-Side Request Forgery | aggressive |
race_condition | Race-condition probe (parallel POSTs) A04:2021 · Insecure Design | aggressive |
file_upload | Upload-endpoint probes A04:2021 · Insecure Design | aggressive |
upload_bypass_deep | Upload SVG-XXE/polyglot/TOCTOU (#28-30) A03:2021 · Injection | aggressive |
wp_cron_dos | wp-cron.php DoS amplification (#2) A04:2021 · Insecure Design | passive |
wpcron_suspicious_jobs | Suspicious wp-cron callbacks (companion) (#64) A09:2021 · Security Logging & Monitoring Failures | passive |
heartbeat_abuse | Heartbeat API DoS surface (#7) A04:2021 · Insecure Design | passive |
db_trigger_audit | MySQL trigger audit via companion plugin (#53) A09:2021 · Security Logging & Monitoring Failures | passive |
core_tampering | Core file tampering check A08:2021 · Software & Data Integrity Failures | aggressive |
rest_permission_audit | REST permission_callback audit (#3) A01:2021 · Broken Access Control | passive |
GraphQL & APIs
18 checks| ID | What it checks | Mode |
|---|---|---|
wpgraphql | WPGraphQL endpoint audit A01:2021 · Broken Access Control | passive |
graphql_dos | GraphQL alias-amplification DoS A04:2021 · Insecure Design | passive |
graphql_field_dos | GraphQL query-depth DoS probe A04:2021 · Insecure Design | aggressive |
graphql_field_authz_deep | GraphQL field-level authz deep probe (#70) A01:2021 · Broken Access Control | passive |
xmlrpc_deep | XML-RPC method enumeration A07:2021 · Identification & Authn Failures | passive |
xmlrpc_method_brute | XML-RPC hidden-method brute-force (#8) A05:2021 · Security Misconfiguration | passive |
webhooks | Webhook endpoint discovery A10:2021 · Server-Side Request Forgery | passive |
webhook_url_fingerprint | Webhook URL fingerprint (Discord/Slack/Telegram) (#65) A02:2021 · Cryptographic Failures | passive |
websocket_audit | WebSocket upgrade + origin audit A01:2021 · Broken Access Control | passive |
websocket_fuzz | WebSocket frame fuzzer (#23) A03:2021 · Injection | aggressive |
headless_wp_audit | Headless/API-first WP audit (#87-91) A01:2021 · Broken Access Control | passive |
headless_templates | Headless DOM templates (Playwright) (#14) A03:2021 · Injection | aggressive |
woocommerce_audit | WooCommerce REST + legacy-API audit A01:2021 · Broken Access Control | passive |
woocommerce_deep | WC consumer-key/IDOR deep audit (#8+#9) A01:2021 · Broken Access Control | passive |
crypto_payment_callback_audit | Crypto-payment webhook auth audit (#73) A02:2021 · Cryptographic Failures | passive |
nft_mint_pubapi | NFT mint endpoint public-access probe (#72) A01:2021 · Broken Access Control | passive |
web3_wallet_connector_audit | Web3 wallet-connector plugin audit (#71) A02:2021 · Cryptographic Failures | passive |
plugin_route_fuzz | Plugin REST-route fuzzer A01:2021 · Broken Access Control | passive |
DNS, email & infra
14 checks| ID | What it checks | Mode |
|---|---|---|
dns_security | DNS security (SPF/DMARC/DKIM) A05:2021 · Security Misconfiguration | passive |
dns_deep | DNS deep — DNSSEC/CAA/TXT-secret/DoH/PTR/wildcard (#32-39) A05:2021 · Security Misconfiguration | passive |
dns_templates | DNS templates (#13) A05:2021 · Security Misconfiguration | passive |
email_security_deep | Email deep — DMARC/MTA-STS/BIMI/ARC/DKIM/SPF (#24-31) A05:2021 · Security Misconfiguration | passive |
hostname_collision | Apex vs www hostname collision A05:2021 · Security Misconfiguration | passive |
cdn_edge_audit | CDN edge audit — Workers/CF/Fastly/Bunny/KeyCDN (#52-57) A05:2021 · Security Misconfiguration | passive |
s3_bucket_discovery | S3 bucket discovery + public-ACL A05:2021 · Security Misconfiguration | passive |
abuseipdb_lookup | AbuseIPDB reputation (opt-in) A05:2021 · Security Misconfiguration | passive |
github_leak_search | GitHub leaked-token search (opt-in) A02:2021 · Cryptographic Failures | passive |
brand_monitor | Typosquat-of-your-domain brand monitor (#170) A05:2021 · Security Misconfiguration | passive |
service_exposure | Service-port exposure: Redis/Memcache/DB (#B35-B37) A05:2021 · Security Misconfiguration | passive |
osint_enrich | OSINT — ASN/geo/bug-bounty/cert TX (#36-43) A05:2021 · Security Misconfiguration | passive |
yaml_templates | YAML templates (nuclei-style) (#9) A05:2021 · Security Misconfiguration | passive |
yaml_workflows | YAML workflow chaining (#11) A05:2021 · Security Misconfiguration | passive |
WordPress core, plugins & themes
23 checks| ID | What it checks | Mode |
|---|---|---|
core_cves | Core CVE matching A06:2021 · Vulnerable & Outdated Components | passive |
plugin_cves | Plugin CVE matching A06:2021 · Vulnerable & Outdated Components | passive |
theme_cves | Theme CVE matching A06:2021 · Vulnerable & Outdated Components | passive |
gutenberg_blocks | Gutenberg block CVE scanner (#1) A06:2021 · Vulnerable & Outdated Components | passive |
wp_salts_age | WP salts age check (#5+#6) A02:2021 · Cryptographic Failures | passive |
plugin_specific_audit | ACF/MS/agent/child/WP-CLI audit (#11-15) A05:2021 · Security Misconfiguration | passive |
hosting_platform_audit | WP Engine/Kinsta/CF/Amplify audits (#16-22) A05:2021 · Security Misconfiguration | passive |
wp_engine_misconfig | WP Engine private-path leaks A05:2021 · Security Misconfiguration | passive |
wp_builder_audit | Block-theme/FSE + page-builder audit (#1-2) A06:2021 · Vulnerable & Outdated Components | passive |
wp_form_audit | Form-plugin deep audit (CF7/WPF/GF/NF/FF/Formidable) (#3) A05:2021 · Security Misconfiguration | passive |
wp_membership_lms_audit | Membership + LMS plugin audit (#4-5) A01:2021 · Broken Access Control | passive |
wp_commerce_alt_audit | Alt-commerce + booking-plugin audit (#6+8) A01:2021 · Broken Access Control | passive |
wp_plugin_ecosystem_audit | Search/SEO/Backup/SMTP/Cache/CDN/Sec/Chat plugin audit (#7,#9-15) A05:2021 · Security Misconfiguration | passive |
wp_multisite_deep | WP-Multisite per-blog deep audit (#17) A01:2021 · Broken Access Control | passive |
multisite | WordPress Multisite audit A01:2021 · Broken Access Control | passive |
vendor_backdoor_patterns | Known-bad / vendor-backdoor plugin slugs (#55) A06:2021 · Vulnerable & Outdated Components | passive |
plugin_typosquat_detection | Plugin slug typosquat detection (#58) A08:2021 · Software & Data Integrity Failures | passive |
plugin_archive_fuzz | Plugin source-archive fuzz (#6) A05:2021 · Security Misconfiguration | aggressive |
waf_bypass_probe | WAF bypass/passthrough probe A05:2021 · Security Misconfiguration | aggressive |
redirect_chain | Redirect chain analysis A10:2021 · Server-Side Request Forgery | passive |
error_pages | Error-page fingerprinting A05:2021 · Security Misconfiguration | passive |
wpconfig_hardening_audit | wp-config hardening inferred from remote signals (#52) A05:2021 · Security Misconfiguration | passive |
wp_cli_inject | WP-CLI command-injection probe (#B28) A03:2021 · Injection | aggressive |
Privacy, compliance & accessibility
12 checks| ID | What it checks | Mode |
|---|---|---|
gdpr_dsr | GDPR Data-Subject-Request audit A04:2021 · Insecure Design | passive |
privacy_inventory | Privacy/GDPR data + tracker inventory (#16-23) A09:2021 · Security Logging & Monitoring Failures | passive |
payment_commerce_deep | Payment/PCI 4.0 deep audit (#58-62) A02:2021 · Cryptographic Failures | passive |
compliance_frameworks | Compliance framework mapping — HITRUST/CMMC/NIST CSF/CIS/ISO (#63-67) A05:2021 · Security Misconfiguration | passive |
honeypot_admin | Honeypot / anti-spam detection (#19) A09:2021 · Security Logging & Monitoring Failures | passive |
a11y_lite | Accessibility smoke check A04:2021 · Insecure Design | passive |
a11y_deep | WCAG 2.2 accessibility deep audit (#24) A05:2021 · Security Misconfiguration | passive |
a11y_wcag_aaa | WCAG 2.2 AAA-level accessibility extras (#99) A05:2021 · Security Misconfiguration | passive |
perf_budget | Performance-budget audit (#25) A04:2021 · Insecure Design | passive |
dom_xss_headless | Headless DOM-XSS (Playwright, opt-in) A03:2021 · Injection | aggressive |
sitemap_cve_probe | Sitemap-driven CVE pattern probe A06:2021 · Vulnerable & Outdated Components | passive |
authenticated | Authenticated scan A01:2021 · Broken Access Control | passive |
Other
2 checks| ID | What it checks | Mode |
|---|---|---|
js_libraries | JS library version audit A06:2021 · Vulnerable & Outdated Components | passive |
js_supply_chain | External JS supply-chain audit A08:2021 · Software & Data Integrity Failures | passive |
Don't see a check you need?
The marketplace + a community-voting "request a check" board are part of the Round-65 roadmap. For now, file a Discussion or send it through the feedback form.