Wordpress Security Scan Service

wpRecon compared with WPScan, Sucuri SiteCheck and Wordfence
wpRecon	WPScan	Sucuri SiteCheck	Wordfence
Scan position: An online service that checks what information about a site is publicly accessible, from a URL you enter. It is a third-party tool not linked to the site tested.	Scan position: A command line scanner run from your own machine against a URL. Defaults are version detection, theme detection and interesting-findings discovery, and the -e option adds plugins, usernames and backup folders.	Scan position: A remote scanner that only sees what a browser can access. Server-side threats such as backdoors, phishing pages or mailers are out of its reach.	Scan position: A plugin running inside WordPress as an endpoint firewall, so it sees details such as whether a user is signed in. Its malware scanner compares core, theme and plugin files with the WordPress.org versions.
Findings reported: It reports server type, IP address and WordPress version, plugins detectable from the front page HTML, and theme information. It also tries to list the uploads and plugins folders to show whether directory indexing is enabled.	Findings reported: Vulnerability data comes from the WPScan WordPress Vulnerability Database through an API token. Without a token the scan still runs but returns no vulnerability data.	Findings reported: It looks for known malware, blacklist status with Google and PhishTank, outdated CMS software, vulnerable plugins, and malicious links, redirects, iframes, JavaScript or spam in the page source.	Findings reported: It flags malware and backdoors and can repair changed core, theme and plugin files. It adds login security such as passkeys, TOTP two-factor authentication and brute-force protection.
Licence and cost: Presented as a free scanner in a WPMU DEV roundup, with no stated limits.	Licence and cost: Dual-licensed under the WPScan Public Source License. Penetration testing, non-commercial and self-testing use are free, while commercial use such as a managed service needs a commercial licence. The free API plan allows 25 requests per day.	Licence and cost: A free scanner. A full scan at client and server level requires contacting the Sucuri team.	Licence and cost: In the free version, firewall rule and malware signature updates are delayed by 30 days and support is by forum. Premium adds real-time feed updates, a real-time IP blocklist, country blocking, more frequent scans and paid ticket support.
	Status and notes: The WordPress.org plugin version is described as no longer actively supported for non-enterprise customers, with Jetpack Protect recommended instead.	Status and notes: The disclaimer states that remote scanners have limited access and results are not guaranteed.	Status and notes: Legacy SMS-based two-factor authentication is being discontinued around July 1, 2026, and sites using it should move to TOTP.

wpRecon compared with WPScan, Sucuri SiteCheck and Wordfence

wpRecon

WPScan

Sucuri SiteCheck

Wordfence

Scan position: An online service that checks what information about a site is publicly accessible, from a URL you enter. It is a third-party tool not linked to the site tested.

Scan position: A command line scanner run from your own machine against a URL. Defaults are version detection, theme detection and interesting-findings discovery, and the -e option adds plugins, usernames and backup folders.

Scan position: A remote scanner that only sees what a browser can access. Server-side threats such as backdoors, phishing pages or mailers are out of its reach.

Scan position: A plugin running inside WordPress as an endpoint firewall, so it sees details such as whether a user is signed in. Its malware scanner compares core, theme and plugin files with the WordPress.org versions.

Findings reported: It reports server type, IP address and WordPress version, plugins detectable from the front page HTML, and theme information. It also tries to list the uploads and plugins folders to show whether directory indexing is enabled.

Findings reported: Vulnerability data comes from the WPScan WordPress Vulnerability Database through an API token. Without a token the scan still runs but returns no vulnerability data.

Findings reported: It looks for known malware, blacklist status with Google and PhishTank, outdated CMS software, vulnerable plugins, and malicious links, redirects, iframes, JavaScript or spam in the page source.

Findings reported: It flags malware and backdoors and can repair changed core, theme and plugin files. It adds login security such as passkeys, TOTP two-factor authentication and brute-force protection.

Licence and cost: Presented as a free scanner in a WPMU DEV roundup, with no stated limits.

Licence and cost: Dual-licensed under the WPScan Public Source License. Penetration testing, non-commercial and self-testing use are free, while commercial use such as a managed service needs a commercial licence. The free API plan allows 25 requests per day.

Licence and cost: A free scanner. A full scan at client and server level requires contacting the Sucuri team.

Licence and cost: In the free version, firewall rule and malware signature updates are delayed by 30 days and support is by forum. Premium adds real-time feed updates, a real-time IP blocklist, country blocking, more frequent scans and paid ticket support.

Status and notes: The WordPress.org plugin version is described as no longer actively supported for non-enterprise customers, with Jetpack Protect recommended instead.

Status and notes: The disclaimer states that remote scanners have limited access and results are not guaranteed.

Status and notes: Legacy SMS-based two-factor authentication is being discontinued around July 1, 2026, and sites using it should move to TOTP.