Daniel Lasek · Last reviewed 2026-11-01
WordPress Vulnerability Checker
A WordPress vulnerability check, on this page, means reading the version the site already shows the public, then telling you to update if that version is behind. The generator tag and the version query on stylesheets and scripts are the usual places. The check does not attack the site. Hiding the version is not a substitute for the update.
Where does a WordPress site leak its version?
Many installs print a generator tag in the HTML head. It names WordPress and often the exact release. Theme and plugin assets are the other giveaway. A stylesheet or script URL ends with a query such as ?ver= followed by a version. Core files under wp-includes do this. Plugins and themes under wp-content do it too. Some plugins also leave a readme in a public folder that states the version in the first lines.
None of this requires a login. If a browser can load the homepage, it can often read the version. The entry-point guide explains why an old public version matters: once a vendor ships a fix, the old release is a known door. This page does not list those bugs, and it does not explain how to use them.
What will Laskyr's checker say?
It looks at the public HTML from a read-only fetch. If it sees a generator tag or a versioned asset URL, the finding is that the site is disclosing a version, plus the version string it actually observed. Compare that string with the current release on WordPress.org or on the vendor's site. If they differ, you are behind. If the checker cannot see a version, that does not mean you are up to date. It means the page did not print one.
The checker will not attach a proof of exploit to a version number. An exposed version is not a conviction, and a hidden version is not a defense. It also will not tell you the site is hacked. For public symptoms of a compromise, use Is my site hacked?.
Read-only scan · No install · Results in about 30 seconds
What should you do when the version is old?
Take a backup of the files and the database, stored off the server, before you update. Updates usually go well. Sometimes they do not, and you need the copy.
Update WordPress core first, from Dashboard → Updates or by replacing core with the package from WordPress.org. Then update plugins. Then themes. Delete the ones you do not use. Inactive plugins are still files on the disk. If a product is abandoned and the vendor has no fixed release, remove it and replace the feature. Do not install a nulled copy because the paid update is inconvenient. That is a separate door, described in the entry-point guide.
If the site is already full of spam or redirects, do not stop at the update button. An update does not delete an extra administrator or a PHP file in uploads. Follow How to clean a hacked WordPress site, or have that done as a job.
Should you hide the generator tag?
You may, after you are updated. Removing the tag, or asking a security plugin to remove it, reduces casual disclosure. It does not stop someone from reading ?ver= on a file, and it does not patch the file. Do the update first. Treat tag removal as optional.
Do not "check" the site by running exploit code you found next to a version number. You can take the site down, and you can commit a crime if the site is not yours. This checker does not do that, and it will not give you the steps.
What is the paid option if the site is already in trouble?
If the version check is the only issue, you do not need Emergency Cleanup. Update, and use the security checklist so the rest of the doors get the same treatment.
If the site is already hacked, cleanup is $499 once. Protection at $19 a month or $190 a year per site is monitoring after the site is clean. An already-infected site is not eligible for Protection until the cleanup is done. We would rather say that here than bill monitoring for a site we can see is compromised.
Questions
Does hiding the generator tag fix a vulnerable plugin?
No. Removing the tag only hides one public string. The old plugin is still installed. Update it from the vendor, or delete it if you do not use it. Hiding a version is optional housekeeping, not a repair.
Is an exposed version the same thing as a hack?
No. A version number means the site told the public what it is running. That is a disclosure, not evidence that someone is already in. An old version is still worth updating, because known flaws in public software get tried widely.
Will this checker exploit my site to test it?
No. It reads public HTML the site already sends, the same way a browser does. It does not log in, does not send payloads, and does not try to prove a bug is exploitable. If you want break-in steps, this is the wrong page.
What should I update first?
Take a backup you can restore. Then update WordPress core, then plugins, then themes, all from WordPress.org or the vendor. Remove anything you do not use, including inactive plugins. If the site is already hacked, updating is only one part of the cleanup.