Skip to content

Check WordPress security

Is your WordPress app production-ready?

Free, platform-independent scan built for WordPress apps. It checks the gaps typical for WordPress — access control, visible keys, GDPR — and delivers a traceable Go/Iterate/Stop verdict with versioned rule codes.

Scan your WordPress app for free now

Typical weaknesses in WordPress apps

WordPress sites live and die by their plugins: third-party code with full database access, ongoing maintenance, and outdated plugins are the single most common way in. Trackers and cookies usually come from plugins, so they often fire before consent.

Rules the scan weights for WordPress

RSC-SEC-010

Supabase service_role key in the client

Decodes JWTs in the bundle and reports the `service_role` claim, which bypasses RLS entirely.

RSC-SEC-015

Database tables granted to the anon role

Queries the schema endpoint with the client key the app publishes itself and lists the tables granted to the anon role — without fetching a row or a row count. Granted is not the same as readable: whether rows come out depends on Row Level Security.

RSC-SEC-018

Protected area guarded only in the browser

Detects admin/account routes the client router knows while the guard lives purely as a condition in the bundle — anyone with the URL gets in.

RSC-SEC-050

Tables without Row Level Security

Collects every `create table` and every `enable row level security` across all migrations and reports tables that are never protected.

RSC-SEC-051

RLS policy allows everyone

Finds policies with `using (true)` — RLS is on but has no effect.

RSC-PRV-001

Google Fonts loaded at runtime

Finds references to fonts.googleapis.com/gstatic.com that send visitors' IP addresses to Google.

RSC-PRV-002

US tracking without visible consent

Detects analytics and pixel scripts with third-country transfer in the shipped markup.

Frequently asked

Is the scan free for WordPress apps?
Yes. The external scan is completely free and anonymous — you only enter the URL of your WordPress app.
Do you need access to my WordPress account?
No. The scan only inspects what your app serves publicly. It goes deeper optionally via read-only repo access or after a domain proof — both strictly opt-in.