WPScan – WordPress Security Scanner

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 83% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

1. ★★★★★ tripflex

   3.0y ago

   complete garbage now, used to be amazing now they basically force you to use jetpack. No replies trying to get enterprise license, another great product (used to be) that automattic has killed and used just for leads to jetpack

   Read on wp.org ↗
2. ★★★★★ Dan

   3.5y ago

   There’s an issue that keeps appearing but no information about why or what to do about it.

   Read on wp.org ↗
3. ★★★★★ wpgerd

   3.6y ago

   In the past this was a very good way to check, if you have vulnerable Plugins/Themes, but with Jetpack you didn’t get notifications, only if you pay the expensive plans ;-(There are other plugins, which do it better!

   Read on wp.org ↗
4. ★★★★★ quadeg

   4.0y ago

   …if you dont’t intend to pay for a sub, the plugin lies saying that you need a free api to use it. Maybe the api is free but you need a subscription to access it. The plugin is useless if you don’t subscribe. Use the tool’s website for a rather useless partial report.

   Read on wp.org ↗
5. ★★★★★ Hans Konings

   4.3y ago

   I doubt that I will get me a paid subscription to this otherwise interesting plugin, because it keeps sending me email alerts with this warning: “Security check Website HTTPS The website does not seem to be using HTTPS (SSL/TLS) encryption for communications.” When I check for http:/ in the database or anywhere else on the site, nothing is found. When I run WPScan manually, it says everything is fine. All my browsers also indicate that https is functioning. Why does WPSCan insist on sending me these alerts? I would like to see a log about where WPScan found this error. This topic was modified 4 years, 2 months ago by Hans Konings.

   Read on wp.org ↗
6. ★★★★★ Jan

   4.5y ago

   Very useful especially if you use many plugins that are not professionally supported.

   Read on wp.org ↗
7. ★★★★★ ckenobi1

   4.6y ago

   Effective and works!

   Read on wp.org ↗
8. ★★★★★ POSIMYTH

   4.8y ago

   One of the Must-have security plugin for WordPress Websites. Most importantly baked by Wp Scan Team, Which is in field from way too long and helping community to be safe like a pro. They have helped us with their deep knowledge of WordPress Security in one of our products. Their whole intention is to use their security experience to help WordPress Community to be safe. We highly recommended this plugin and whole team for any thing related to security. This topic was modified 4 years, 8 months ago by POSIMYTH.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.16 Allow report to be POST-ed to webhook URL or downloaded as JSON. 1.16
2. — Version 1.15.7 Fix the way the plugin handles extension versions to be more accurate. 1.15.7
3. — Version 1.15.6 Added a notice pointing regular users to Jetpack Protect 1.15.6
4. — Version 1.15.5 Update “Tested up to” Some minor text changes Fix API conflict 1.15.5
5. — Version 1.15.4 Fix images not loading on some hosted websites Update remediation links 1.15.4
6. — Version 1.15.3 Fix fatal error in security checks 1.15.3

Automated install-time checks, tested on PHP 8.1.12 · WP 6.6.1

Translated into 13 languages, 3 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-19 9K+ → 8K+ down after 343 days in tier
2. 2025-07-11 10K+ → 9K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Stop User Enumeration 50K+ installs · 4.9★ · 2 shared tags B
• Patchstack – WordPress & Plugins Security 50K+ installs · 4.7★ · 2 shared tags A
• WPVulnerability 10K+ installs · 4.6★ · 2 shared tags A
• L Lockdown WP Admin 10K+ installs · 3.9★ · 2 shared tags D
• IP Geo Block 8K+ installs · 4.1★ · 2 shared tags D
• E Exploit Scanner 8K+ installs · 3.4★ · 2 shared tags F

Embed this report card

Drop a live Pulse card for WPScan – WordPress Security Scanner into a readme, a review or a deck. It updates itself.

WPScan – WordPress Security Scanner: 8K+ active installs, 3.8★ (28 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/wpscan