wordpress.org
Scanned Apr 27, 2026, 10:00 AM
Run a fresh audit — UpgradeSecurity Assessment
Key findings for wordpress.org
- No known vulnerabilities detected in installed plugins.
- 2 plugins have been abandoned by the developer.
- Security headers grade D — 2 important headers are missing.
- 3 sensitive paths exposed to the public.
WordPress
Active Theme
Hosting Provider
Detected Plugins
7 total| Plugin | Vulnerabilities |
|---|---|
 Gallery Carousel Without JetPack medium confidence | None found |
 Slim Jetpack medium confidence | None found |
 Jetpack – WP Security, Backup, Speed, & Growth medium confidence | None found |
 Gutenberg medium confidence | None found |
 Akismet Anti-spam: Spam Protection medium confidence | None found |
Your full security report is ready
We found 7 plugins on this site. Unlock the complete analysis:
Security Report
- Full report for this site
- Every detected plugin & CVE
- Remediation guidance
- No re-audit after fixes
Report + Re-audit
- Everything in Security Report
- One complimentary re-audit within 90 days
- Verify your fixes actually closed the findings
- Clean-record badge for your site
Guided Remediation
- Everything in Report + Re-audit
- 15–30 min expert consult to triage findings
- Prioritized action plan for your site
- Optional partner handoff for fixes
One-time payment · Instant access · No subscription required
Not ready to buy? We'll send you a one-time free alert
if we detect a new vulnerability affecting your plugins.
One free alert · Continuous monitoring available with a paid plan
Security Posture
Security Headers
42/100No Content-Security-Policy header. Your site is more vulnerable to XSS attacks.
HSTS max-age is too short. Recommended: at least 1 year (31536000).
Clickjacking protection is enabled.
TLS/SSL Certificate
Exposed Paths & Login Security
3 exposed3 security issues found — unlock to see which paths are exposed.
DNS & Email Security
SPF record with hard fail (-all) — strong email authentication.
DMARC policy is set to reject — strongest protection against email spoofing.
No DKIM record found for common selectors. Email authenticity cannot be verified (or uses a non-standard selector).
Infrastructure
Server: nginx
X-Powered-By header is not exposed.
No WAF detected. Consider adding one for additional protection.