Free WordPress security scan
The Silent Threads security checker is a free WordPress security scan that looks at your site from outside, the way a browser or a bot does: HTTPS, security headers, exposed files, WordPress settings, surface signs of malware and blocklists. It is read-only, takes under a minute and grades the result from A to F.
- HTTPS and certificate
- Security headers and cookies
- Exposed files and WordPress
- Malware signs and blocklists
- Summary
What the free scan checks
Each finding is marked pass, warning or fail, with a plain explanation, why it matters and what fixes it. The overall grade runs from A to F.
HTTPS / SSL
Certificate validity and expiry, the HTTP to HTTPS redirect, HSTS and insecure content on the homepage.
Security headers
Content-Security-Policy, framing protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and HSTS, with a grade for the set.
Information leaks
Server and X-Powered-By banners, the WordPress version tag, readme.html, and whether .git, .env, wp-config backups, database or zip backups or directory listings are public.
WordPress exposure
If the site runs WordPress: an open xmlrpc.php, usernames readable through ?author=1 or the REST API, the login page and an obviously old version.
Malware and defacement (surface check only)
The homepage and its own scripts, checked against a short list of known bad patterns: injected loaders, miners, card skimmers, spam and sneaky redirects.
Reputation and blocklists
Public blocklists that browsers, mail providers and search engines rely on. A source that doesn’t answer is skipped, not guessed.
Cookies
Whether cookies set by the homepage use the Secure, HttpOnly and SameSite flags.
Front-end libraries
Versions of jQuery, Bootstrap and other common libraries in the page source, compared with the first versions that fixed published security issues.
A scan makes up to 30 ordinary requests, each with a 5-second timeout, and stops after 20 seconds. Anything it can’t check in that time is marked “couldn’t check”.
What a scan from outside can’t see
This checker can’t read your site’s files or database, so a good grade isn’t proof that a site is clean. These need something running inside WordPress:
Malware in your files
Backdoors and injected PHP live in files on the server. Only something running on the site can read them.
Covered by: Malware Scanner (Quick & Standard), Core File Integrity
Your database
Spam links, rogue admin accounts and injected options sit in the database, out of sight of any outside scan.
Covered by: Database Scanner
Attacks as they happen
Blocking malicious requests in real time needs a firewall that sees every request reaching WordPress.
Covered by: Web Application Firewall (356 built-in rules)
Login protection
Limiting password guessing and adding two-factor authentication happens inside your login page.
Covered by: Brute-force protection, Two-factor authentication (2FA)
Get continuous protection — install Silent Threads
Scans your files and database, filters every request through a firewall and protects your logins, from inside WordPress.
Frequently asked questions
Is the security scan really free?
Yes. There is no sign-up and no login. You only give an email address if you ask us to email the report, and you confirm it before anything is sent.
Will the scan change anything on my site?
No. It makes a small number of ordinary read-only requests, like a browser would: it never logs in, never submits forms, never sends attack payloads and never guesses passwords.
Can it tell me if my website is hacked?
It can spot some outward signs, such as injected scripts, spam links, miners or a blocklist entry. Most malware hides in files and the database, which no outside scan can read, so a clean result is not proof that a site is clean.
Why is my grade lower than I expected?
The grade weighs each check by how much it matters. Missing security headers, an expired certificate or an exposed backup file lower it the most. Each finding says what it means and how to fix it.
What do you keep after a scan?
The domain, the findings, the grade and the time, for a limited period, so the result link keeps working. Page contents are never stored, and neither is your IP address.