WPScan – WordPress Security Scanner Guide

Update 2025

If you find this useful, please ⭐ on GitHub!

Table of Contents

1. About WPScan

2. Installation

3. Basic Scan

4. Options & Flags

5. WPScan Options Reference

6. Examples

   • Example 1: Basic Scan
   • Example 2: Enumerate Plugins & Themes
   • Example 3: Password Brute Force
   • Example 4: WPScan + Nmap
   • Example 5: WPScan + Nikto
   • Example 6: WPScan + IDS
   • Example 7: WPScan + OWASP ZAP

7. Best Practices

8. Warning

9. Contributing

10. Credits & License

---

About WPScan

WPScan is a free and open-source WordPress security scanner. It identifies vulnerabilities, plugins, themes, and users. Repo: WPScan GitHub

---

Installation

git clone https://github.com/wpscanteam/wpscan.git
cd wpscan
gem install bundler && bundle install

---

Basic Scan

wpscan --url http://example.com

• Checks WordPress version, plugins, themes.
• Displays potential security issues.

---

Options & Flags

• --enumerate → List plugins, themes, users
• -f → Force scan
• --wordlist <file> → Password list for brute force
• --random-user-agent → Random user-agent
• --threads <n> → Number of request threads
• --update → Update WPScan

---

WPScan Options Reference

Usage: wpscan [options]
  --url URL                   WordPress URL/domain
  --disable-accept-header     Disable Accept HTTP header
  --disable-referer           Disable Referer HTTP header
  --wp-content-dir DIR        Custom wp-content path
  --wp-plugins-dir DIR        Plugins directory
  --wp-themes-dir DIR         Themes directory
  --random-user-agent         Use a random user-agent
  -v, --verbose               Verbose output
  --enumerate[=OPTS]          Plugins, themes, users
  --threads THREADS            Number of threads
  --throttle DELAY             Delay in ms per request
  --output FILE                Save results
  --format FORMAT              Output format (cli, json, xml, yml)
  --update                     Update WPScan
  --proxy PROXY                Use a proxy
  --tor                        Use TOR

---

Examples

Example 1: Basic Scan

wpscan --url http://example.com

Example 2: Enumerate Plugins & Themes

wpscan --url http://example.com --enumerate p,t

Example 3: Password Brute Force

wpscan --url http://example.com --usernames admin --wordlist passwords.txt

Example 4: WPScan + Nmap

nmap -p- -sV --script=http-wordpress-enum target.com
wpscan --url http://target.com --enumerate vp --plugins-detection mixed

Example 5: WPScan + Nikto

wpscan --url target.com --enumerate p,t,u
nikto -h target.com

Example 6: WPScan + IDS

• Use IDS (Snort/Suricata) to monitor traffic while WPScan runs
• Compare alerts with scan results

Example 7: WPScan + OWASP ZAP

• Run ZAP scan in parallel with WPScan
• Combine results for a full WordPress security assessment

---

Best Practices

• Only scan your own or authorized systems
• Keep WP, plugins, and themes up-to-date
• Use strong passwords
• Document scan logs

---

Warning

Use responsibly. No unauthorized access or brute force without permission.

---

Contributing

PRs and issues welcome to keep the guide practical and up-to-date.

---

Credits & License

• Maintainer: VolkanSah
• License: MIT