For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
Mobile US PressList your app
Vendor dashboard

WPScan

No phone app

6.2No. 12 of 36
in Vulnerability Scanning Software
  • Recognised40% of the score20
  • Phone app26% of the score0
  • Documented20% of the score80
  • Free plan14% of the score100
Free plan
Yes
Runs on
api, Linux, Mac, self-hosted
Visit site Alternatives

Summary

WPScan is ranked #12 of 36 in vulnerability scanning software on Samsung Mobile US Press. It runs on API, Linux, macOS, Self-hosted. There is a free plan.

WPScan plans and pricing

All plans
Researcher Free Non-commercial use · 25 API calls per day · Free CLI scanner wpscan.com · 4 Oct 2026
Enterprise Not published Custom pricing by number of sites · Instant email alerts · Slack and HTTP webhooks · Description and PoC API data · CVSS risk scores wpscan.com · 4 Oct 2026

Compared on vulnerability scanning software

Supported targets
WordPress core, plugins, themes, usernames, media, configuration backups, database exports, TimThumb files, and remote WordPress applicationswpscan.com
Authenticated scanning
Yeswpscan.com

Facts

Purpose
WPScan provides a WordPress security scanner and vulnerability database covering WordPress core, plugins, and themes.wpscan.com · 4 Oct 2026
Vulnerability review
WPScan says vulnerabilities are manually checked by WordPress security professionals to reduce false positives.wpscan.com · 4 Oct 2026
CLI scanning
The free black-box CLI scanner checks WordPress version, installed plugins and themes, and other exposures including username enumeration and publicly accessible configuration files.wpscan.com · 4 Oct 2026
API
The WPScan API provides vulnerability data for WordPress core, plugins, and themes and is used by its scanner and WordPress security plugin.wpscan.com · 4 Oct 2026
Integrations
WPScan lists Slack and HTTP webhooks for enterprise users and names Kali Linux, Dradis, BackBox Linux, Pentoo, Samurai WTF, and BlackArch as integrations.wpscan.com · 4 Oct 2026
Enterprise API data
Enterprise API results include vulnerability descriptions, proof-of-concept fields, and CVSS risk scores.wpscan.com · 4 Oct 2026
Data use limits
The API terms prohibit permanent storage and caching of vulnerability data, and companies integrating WPScan data into their own services must use an Enterprise account.wpscan.com · 4 Oct 2026
Privacy
WPScan says its API stores the scanner IP or domain, WordPress version, plugin and theme slugs, request count, and timestamps.wpscan.com · 4 Oct 2026
Service limits
WPScan states that its API carries no uptime or accuracy guarantee and that it may not record every known vulnerability.wpscan.com · 4 Oct 2026
Scanning scope
WPScan says it identifies sites with software containing known vulnerabilities but does not determine whether a site has been compromised or remove malware.wpscan.com · 4 Oct 2026
Supported installation methods
The CLI scanner is distributed as a Ruby gem, Docker image, and Homebrew package for macOS.wpscan.com · 4 Oct 2026
Maker
WPScan's enterprise terms identify Automattic Inc. as the provider of the enterprise solution.wpscan.com · 4 Oct 2026

Best WPScan alternatives

See all 20
Ivanti Neurons for Zero Trust Access No. 1 7.0 iPhone + AndroidNuclei No. 2 6.4 No phone appFreePentest-Tools Port Scanner No. 3 6.4 No phone app$95/moQualys External Attack Surface Management No. 4 6.4 No phone appIntruder No. 5 6.3 No phone appFreeManageEngine Vulnerability Manager Plus No. 6 6.3 No phone app$57.92/mo

Where it ranks on Samsung Mobile US Press

Is WPScan yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote WPScan

Sources