The Hack Repair Guy's Site Inspector

Free WordPress security checkup

Find the open doors before someone else does.

A friendly, read-only security checkup for WordPress. In a few seconds it looks for the things most hacked sites had in common, then tells you in plain language what it found and what to do next.

Download Site Inspector Watch the 75-second tour

Free and open source (GPL-2.0-or-later). Needs WordPress 6.9.4 or newer and PHP 7.4 or newer.

See it work in 75 seconds

Run an inspection, read a finding, check what changed since last time, and send the report to the people who can fix it.

Download Site Inspector

Free, and updates arrive inside WordPress.

Most hacked sites weren't broken into by anything clever.

Automated tools check thousands of sites a day for the same handful of openings. Site Inspector looks for exactly those.

  • Out-of-date software

    A plugin, theme or WordPress itself with an update waiting.

  • An admin nobody remembers

    A powerful account that's new, unusual, or simply forgotten.

  • A stray PHP file in uploads

    Code sitting where only images and documents belong.

  • A backup left out

    Backups, logs and old config copies anyone could download.

What it checks

Open Tools › Site Inspector and click Inspect this site. It takes a few seconds.

  • Updates waiting for WordPress, plugins and themes
  • Administrator accounts, with recent and unusual ones flagged
  • PHP files hiding in uploads
  • Backups, error logs and leftover wp-config.php copies
  • Must-use plugins and drop-ins
  • Unused plugins and themes
  • PHP version support
  • Security keys and salts
  • The built-in code editor and PHP error display
  • Registration, HTTPS settings and wp-config.php permissions

Every finding comes with a next step

No security score and no scare tactics. Just what was found, why it matters, and where to go to fix it.

Plain-language findings

Each one says why it matters, what was observed and what to do, with a button to the right admin page. Passing checks fold away.

A history of every report

Up to 25 reports are saved on your own site, so each checkup shows what's new and what you've fixed. Pause or clear it any time.

Share it with your developer

Copy it, download it, print it with usernames masked, or email a plain-language "state of security" briefing to your site's administrators.

It looks. It never touches.

  • Read-only
  • Nothing is changed
  • No network requests
  • Reports stay on your site

An inspection reads your site's settings and file listings without opening file contents, applying fixes or contacting any outside service. Reports are stored only in your own WordPress database, and leave it only when an administrator chooses to export or email one. Emails can go only to the site's own administrators.

Plugin updates come from this project's GitHub releases, separately from inspections. Site Inspector is not a malware scanner, a firewall or a vulnerability feed. "Nothing found" means just that, for the check described. If you think your site has been hacked, The Hack Repair Guy can help.

Bonus: Site Health Controls

Under Settings › Site Health Controls you can switch off WordPress's Site Health menu, dashboard widget, background tests and weekly check, with exemptions for administrators or specific users.

Install it in a minute

  1. Download the zip from the button below.
  2. In WordPress, open Plugins › Add New › Upload Plugin and choose the zip.
  3. Activate it, open Tools › Site Inspector, and click Inspect this site.
Download Site Inspector

Later updates arrive on the normal Plugins screen, from this project's GitHub releases.