GuardingWP

GuardingWP is an external scanner. You enter a URL, it fetches your site's headers and HTML from the outside, probes a set of known WordPress endpoints, and checks your installed plugins against a CVE database. Nothing is installed on your server.

What it's good for: a quick, no-commitment health check. You can scan any WordPress site you own or manage in under 10 seconds without touching the server. It tells you what's currently exposed — version fingerprints, misconfigured headers, XML-RPC, weak login configuration, vulnerable plugins.

What it doesn't do: it can't detect malware that's already on your server, block live attacks, or monitor your site over time (unless you're on the Pro plan with weekly automated scans).

Use it when: you want to know where your site stands right now, you're auditing a client site before taking it on, or you've just made security changes and want to verify they worked.