WPSec
WPSec is a cloud-based security scanner for WordPress websites, available on the web and through an API.
What WPSec is
WPSec is a cloud-based security scanner for WordPress websites, available on the web and through an API. It checks sites against a vulnerability database using WPScan and custom technology, and helps users track several installations in one dashboard. Reports explain detected issues and possible ways to address them. Scans can run monthly, weekly or daily according to the plan. WPSec also examines code from more than 118,000 plugins and assigns risk scores, including to plugins without a known vulnerability. Email and smartphone push alerts can flag security concerns such as outdated or risky plugins and themes. The Free plan costs nothing and provides one scan location, up to 10 reports and monthly scans. Premium is €19 a month per website, with per-site charges changing across higher website bands; it adds exports, API and CLI access, webhooks, AI/MCP integration, and stealth and WAF-bypass scans. White Label is €295 a month, billed €3400/year, and includes branded design and a separate isolated instance.
Good
- Dashboard tracks multiple WordPress websites.
- Reports explain findings and possible responses.
- Email and smartphone push security alerts.
- Plugin risk analysis includes unknown vulnerabilities.
- Free plan includes up to 10 scan reports.
Watch out
- Free plan allows one scan location.
- Free plan scans monthly only.
- Premium is billed per website.
- Support typically responds within three business days.
Who it suits
WPSec suits WordPress site owners or teams who need to monitor multiple installations and review security findings. Its Free plan is limited to one scan location and monthly scans.
Verdict
WPSec combines vulnerability checks, reporting and plugin risk analysis for WordPress installations. The Free plan covers limited monthly monitoring, while more frequent scans and exports require paid plans.
Plans and prices
From WPSec's own pricing page, checked 10 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free | Free | 84,900 known vulnerabilities · 1 scan location · Up to 10 scan reports · Monthly scans |
| Premium | €19 a month | Daily, weekly, or monthly scans · Attack Surface analysis and CVE matching · PDF and JSON exports · API, webhooks, CLI · AI/MCP integration · Stealth and WAF-bypass scanning · per website; €19 each for websites 1–2, then €6, €3, €2, and €1 each across higher bands |
| White Label | €295 a month | Everything in Premium · Unlimited scans and reports · Branded design, logo, and domain · Separate isolated instance · €3400/year |
The facts
Each one read from WPSec's own pages, with the date it was checked.
What it does
- Alerts
- WPSec offers email and smartphone push notifications about security issues, including outdated or risky plugins and themes.checked 10 Oct 2026
- Attack surface
- WPSec says it analyzes code behind 118,000+ plugins and scores plugin risk, including when no known vulnerability exists.checked 10 Oct 2026
- Dashboard and reports
- Users can track multiple WordPress websites in a dashboard and receive reports explaining findings and how to address them.checked 10 Oct 2026
- Exports and access
- Premium includes PDF and JSON report exports, API, webhooks, CLI access, and AI/MCP integration with Claude and Cursor.checked 10 Oct 2026
- Integrations
- A WPSec article says outgoing JSON webhooks can integrate with third-party services such as Slack and Zapier.checked 10 Oct 2026
- Product
- WPSec describes itself as an online security scanner for WordPress vulnerabilities that tracks installations and identifies outdated software.checked 10 Oct 2026
- Scan controls
- Premium includes stealth and WAF-bypass scanning.checked 10 Oct 2026
- Scanner
- Its scanner is based on WPScan and custom technology, and checks WordPress websites against a vulnerability database.checked 10 Oct 2026
- Scheduled scans
- Account scans can run daily, weekly, or monthly, depending on the selected plan.checked 10 Oct 2026
- Security disclosure
- WPSec publishes a vulnerability reporting program with safe-harbor terms and a PGP key for reporting issues.checked 10 Oct 2026
- Support
- WPSec says support typically responds within three business days.checked 10 Oct 2026
The company
- Company
- The site identifies WPSec as a service by Triop AB in Funäsdalen, Sweden.checked 10 Oct 2026
- Headquarters
- Funäsdalen, Swedenchecked 28 Sep 2026
Money
- Free plan limit
- The Free plan includes one WordPress scan location, up to 10 scan reports, and monthly scans.checked 10 Oct 2026
Alternatives to WPSec
- 1
UpGuard
Free planAndroidiOSWebAPI8.2From $1,750 a month - 2
OWASP DefectDojo
Free planOpen sourceWebAPILinuxSelf-hosted8.0$100 usage-based - 3
ManageEngine Vulnerability Manager Plus
Free planWebAPILinuxmacOS7.9From $695 a year - 4
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 5
Intruder
Free planWebAPILinuxmacOS7.4Free plan - 6
OWASP DevGuard
Free planWebAPILinuxmacOS7.0From €449.10 a month