WPScan WordPress ScannerStep-by-step reference: use WPScan for WordPress vulnerability scanning, plugin and theme enumeration, and defensive hardening. Educational purposes only.FAQ

What is WPScan?

WPScan is a black box WordPress security scanner. Written in Ruby, it audits WordPress websites for known security vulnerabilities in core versions, plugins, and themes, as well as configuration weaknesses and exposed user accounts.

Is using WPScan legal?

WPScan is a legitimate open-source security audit tool. However, running active vulnerability scans against WordPress sites you do not own or lack written authorization to test is strictly illegal.

Why do I need a WPScan API token?

While WPScan can detect installed plugins and themes without a token, the WPScan API token connects your scan to the official WordPress Vulnerability Database to report verified CVEs, CVSS scores, and exploit references.

How do I enumerate only vulnerable plugins in WPScan?

Run `wpscan --url example.com --enumerate vp`. The `vp` option stands for 'vulnerable plugins', which checks discovered plugins against known exploit databases.

Can WPScan enumerate WordPress usernames?

Yes. WPScan checks author archives, REST API endpoints (`/wp-json/wp/v2/users`), and login prompts using the `--enumerate u` option to identify active usernames on the WordPress installation.

How do site owners defend against WPScan auditing?

Remove inactive plugins and themes completely, apply updates and security patches weekly, disable the WordPress REST API user endpoint for unauthenticated visitors, block XML-RPC, and enforce two-factor authentication behind a Web Application Firewall (WAF).

How do I install WPScan on Linux or macOS?

On Debian/Ubuntu/Kali, install via `sudo apt install wpscan`. On macOS or generic systems with Ruby installed, run `gem install wpscan`.

All tools · Sitemap · Games