WordPress security checker

Free WordPress Security Checker

See what your WordPress website reveals to the outside world, check its HTTPS and security headers, and find out whether your PHP version needs attention.

No account required. No technical knowledge needed.

No account required
Passive & non-intrusive
Results in seconds

We check WordPress & PHP, HTTPS, certificates and security headers

What an outside check can and can't see

We look at your WordPress site the way any visitor (or automated scanner) can. That's useful, but it's only part of the picture, and we're upfront about which part.

What we can check

Whether your site appears to run WordPress, and how confident we are
Your WordPress version, if your site advertises it
Your PHP version, if your server reveals it
Whether HTTPS works, redirects properly and has a valid certificate
Browser security headers and software details your site gives away

What we can't see from outside

Which plugins and themes you have installed, or whether they're up to date
Your admin accounts, passwords or two-factor settings
Whether your site has been hacked or contains malware
Your backups, server configuration or file permissions
Your PHP version, if your host hides it (we show you how to check)

WordPress security basics for business owners

Most WordPress websites that run into trouble aren't targeted personally. They're found by automated tools looking for known weaknesses in out-of-date software. These habits make the biggest difference:

Keep WordPress, plugins and themes updated. Outdated plugins are one of the most common routes into WordPress sites. Delete plugins and themes you don't use rather than just deactivating them.
Run a supported PHP version. WordPress runs on PHP, which your host manages. Here's how to check yours, and read our PHP security warning about the October 2026 fixes.
Use strong, unique passwords and two-factor authentication for every administrator account, and remove accounts that are no longer needed.
Keep off-site backups that you've tested restoring. Backups turn a disaster into an inconvenience.
Use HTTPS everywhere, with a redirect from HTTP and a certificate that renews automatically.
Choose hosting that takes security seriously: up-to-date server software, isolation between accounts, malware scanning and support that answers security questions.

How we detect WordPress

We look for several public markers at once, such as file paths under /wp-content/, WordPress's REST API link, its generator tag and WordPress-specific scripts, and tell you how confident we are. Many well-run WordPress sites hide some of these, so if we don't detect WordPress, that doesn't prove your site isn't using it.

Want someone to look properly?

An outside check is a starting point. A proper WordPress health check looks inside: plugin and theme versions, user accounts, backups, PHP and server settings. After your results, you can ask Host Dada for free advice or a professional review, or look at our managed WordPress hosting, which includes backups, malware scanning and SSL.

Who's behind this tool

Built by Host Dada, a UK hosting and software development provider

We built this checker because many business owners are told to "update PHP" or "check your security" without any way to see where they stand. It's free to use, with no account and no obligation.

About Host Dada

UK hosting provider
Host Dada provides web hosting, WordPress hosting, domains, business email and SSL for UK businesses.
Developer-led
We started in 2009 supporting our own web design and development clients, and still build websites and software today.
Recognised partners
Host Dada is a Nominet Accredited Registrar and a Microsoft Partner.
Registered in England
Host Dada is a company registered in England under company number 14514477.