NeoShield Scan Free

For WordPress maintenance providers

WordPress security reports your clients can read

Check the public security configuration of each WordPress site you look after, explain the findings to the client in plain language, give yourself WordPress-specific fixes, and confirm each fix with a rescan.

View the Complete Sample Report Scan One Authorized Website Free

Only for websites you own or may assess · Passive checks of public pages and DNS · No exploitation, login testing, brute force, fuzzing or load testing

What the report checks

  • HTTPS, the TLS certificate and the redirect from HTTP to HTTPS.
  • Security headers: HSTS, Content-Security-Policy, frame protection, nosniff, Referrer-Policy and Permissions-Policy.
  • Cookie flags (Secure, HttpOnly, SameSite) on the public pages.
  • Server and PHP version disclosure in response headers.
  • Commonly exposed files such as a public .git folder, .env or phpinfo.php.
  • Email domain records: SPF and DMARC. Also security.txt.

WordPress-specific fixes

The checks are the same for every website. What changes for WordPress is the fix: each finding can show a starting point for WordPress, such as a small site-specific plugin or a php.ini (.user.ini) setting, next to the server examples for Nginx, Apache HTTP Server and Cloudflare. Starting points can be incomplete or wrong for a particular theme or plugin, so test every change in staging before production.

What it does not check

  • It does not check plugins or themes against a vulnerability database. Use a dedicated WordPress security plugin or service for that.
  • It does not log in, test wp-admin, guess passwords or check file integrity.
  • It does not test application logic or anything behind a login.
  • A clean result does not prove the site has no vulnerabilities.

Sample findings (demonstration data)

The full sample report shows what a client receives: a plain summary, findings ordered by priority with evidence, fixes per platform, and verification status after a rescan. Every name and figure in it is demonstration data for a fictional client.

Plans

Free covers one website with one manual scan a month. Pro adds PDF and CSV reports, Verify Fix and weekly monitoring for up to five websites. Passes are prepaid for 30 or 365 days and do not renew automatically.

Frequently asked questions

Does it find vulnerable WordPress plugins?

No. It checks the public configuration of the website, not plugin or theme versions against a vulnerability list. Use a WordPress security plugin or service for that and NeoShield for the configuration report and fix verification.

Will the scan trigger my security plugin or slow the site?

It sends a small number of ordinary requests, similar to a visitor opening a few pages, and reads DNS records. It may appear in access logs. It sends no attack payloads and does not try to log in.

Can I scan a client's WordPress site?

Only with the client's permission. You confirm authorization before every scan and every schedule.

Next steps