Security advisorywp2shell: WordPress core vulnerability. Updated August 7, 2026.
Read the advisoryCompare WordPress security scanners and scanning tools in 2026: vulnerability checks, malware and integrity scans, external tools, and how to pick a WP security scan you will actually run.
Topics Firewalls & scanners
Updated Published
People search for a WordPress security scanner, WordPress scanning tools, or a simple WP security scan and get three different product pitches. A “scanner” is not one category. Vulnerability checks, malware and file integrity, and external URL tools answer different questions. Pick coverage for the jobs you need, then schedule them so findings do not sit unread.
When someone asks for the best WordPress security scanners or a best WordPress scanner, they usually mean one or more of these:
A homepage header grade is not a WordPress malware scanner. A CVE list that never opens a file will miss a backdoor dropped through a weak password. Good WordPress scanning tools are clear about which jobs they cover.
Marketing pages love accuracy theater. Real buying criteria are simpler:
That is what a useful WP security scan should deliver. Skip tools that only paint a green badge.
Compare installed plugins, themes, and core against known advisory data. Goal: “this version has a public issue; update or remove it.”
Security Ninja includes a free vulnerability scanner for that job. Pair it with habits from the vulnerabilities hub.
Look for malicious or suspicious code patterns in the install. Goal: “something weird is on disk.”
Security Ninja Pro malware scanner covers on-demand and scheduled runs, with review, clean, and whitelist actions.
Compare WordPress core (and sometimes plugins) to known-good copies. Goal: “official files were changed.”
Core Scanner in Security Ninja does WordPress core integrity checks. A mismatch is a signal to investigate, not always an instant “delete everything.”
Hit your public URLs from outside. Useful for headers, exposed files, and blacklists. They often miss internal PHP backdoors that never appear in HTML.
Imunify, antivirus daemons, and host panel scanners see the filesystem outside WordPress. Great companion layer. Still not a substitute for plugin CVE awareness inside wp-admin.
Skip invented accuracy-percentage tables. Ask:
Other scanners and security plugins exist, including well-known WordPress security suites and standalone online tools. Prefer one clear application stack over three partial scanners. For the wider plugin landscape, see best WordPress security plugins and free vs premium.
| Job | Free | Pro |
|---|---|---|
| Known plugin/theme/core vulns | Yes | Yes |
| Security tests / hardening checks | Yes (50+) | Yes |
| Core file integrity | Yes | Yes |
| Malware / suspicious files | Not the full Pro scanner | Full scanner + schedules |
| Alerts / scheduled reports | Events baseline | Scheduled scans, email, webhooks |
Firewall and login hardening sit beside scanning; they are not the same as a scanner. See firewall guide and login security.
| When | Run this | Why |
|---|---|---|
| After plugin/theme install or major update | Vulnerability scan | Catch known-bad versions before traffic hits them |
| Weekly (stores) / monthly (quiet sites) | Malware + core integrity | Notice file changes you did not make |
| After a vuln window you patched late | Malware + users review | Exploitation may have happened before the update |
| Odd redirects, spam, or host warnings | All scanner types + logged-out browser check | Cloaking and visitor-only malware hide in wp-admin |
| After cleanup | Full rescan before reopening | Confirm the backdoor is gone (malware removal) |
| Quarterly | External/header check + Search Console security | Second opinion outside WordPress |
Optional companions: host panel scanners and a reputable online URL scanner. They complement an in-dashboard stack; they do not replace plugin CVE checks.
Stores and membership sites should scan more often than a static brochure site. Frequency beats perfection.
If you are already in an incident, scanning alone is not recovery. Follow the cleanup path or hire help.
The best WordPress scanner for most site owners is the one that covers vulns and files on a schedule you will keep. Security Ninja is built so free gets you visibility (tests, vulns, core integrity) and Pro adds malware scanning plus the protection layer around it. See pricing when you want that full loop.
Found this useful? Share it.
A WordPress security scanner checks your site for known problems. Common jobs include comparing plugin and theme versions against vulnerability data, looking for suspicious files, and verifying WordPress core files against known-good copies. Different tools cover different jobs.
A vulnerability scanner asks whether installed software has a known public issue. A malware scanner looks for malicious or suspicious code already on disk. You usually want both. One without the other leaves a blind spot.
Free Security Ninja covers vulnerability checks, security tests, and core integrity. Pro adds the full malware scanner plus schedules and alerts. External online scanners and host-level tools can still be useful as a second opinion. Prefer one clear application stack over three overlapping plugins.
The best WordPress security scanner is the one that covers the jobs you need on a schedule you will keep. Prefer tools that clearly separate vulnerability checks, malware or file scans, and core integrity, then act on findings. Security Ninja Free covers vulns, tests, and core integrity; Pro adds the full malware scanner.
Run a vulnerability scan after plugin or theme installs and major updates. Run malware and core integrity weekly on stores, monthly on quieter sites, and immediately when something feels wrong. After cleanup, rescan before reopening the site.
An online or external scanner hits public URLs and is useful for headers, exposed files, and blacklists. A plugin scanner sees installed versions and files inside WordPress. Most sites want an in-dashboard WP security scan for vulns and files, with an occasional external check as a second opinion.