Moatline

Free WordPress vulnerability scanner

Most hacked WordPress sites are broken into through an outdated plugin. Moatline checks every plugin and theme on your site against known vulnerabilities, warns you about the ones attackers are using right now, and emails you the moment a plugin you use becomes a target.

Get it free on WordPress.org Scan my site online

Free plugin · checks twice a day · email alerts · no account needed

What it checks

The open doors, and whether someone came in

Plugins under active attack

Every installed plugin and theme is compared with our list of plugins being exploited right now, twice a day.

Every known vulnerability (Pro)

With Pro and a free Wordfence Intelligence key, the full database: every published WordPress plugin and theme vulnerability that affects your versions.

Email alerts

The first time a plugin on your site appears on the list, you get an email with the fixed version and what to do.

Malware already planted

Because updating doesn’t remove a backdoor, the same scan looks for webshells, hidden admins, injected scripts and database malware.

Modified files

Plugin and core files are compared with the official WordPress.org copies, and any file that changes between scans is reported.

Outside view

The free online check sees the plugins your pages load and flags any on the attack list, without installing anything.

Online or plugin?

Two ways to scan

Online checkMoatline plugin
Install neededNoYes, free from WordPress.org
Sees every plugin and themeOnly those visible on your pages✓ All, with exact versions
Plugins under active attack✓✓ Checked twice a day
Full vulnerability database–With Pro (Wordfence Intelligence)
Email alerts–✓
Finds malware in files and databaseOnly what visitors see✓
Get started

Scan your site in three steps

Install Moatline

Install the free plugin from WordPress.org. No account, no API key, nothing to configure.

Run a scan

Vulnerable plugins show as a red warning on the dashboard, with the version that fixes them.

Update, then stay alerted

Update what’s flagged. Moatline keeps checking twice a day and runs a full malware scan every week.

Questions

WordPress vulnerability scanning

What is a WordPress vulnerability scanner?
It compares the plugins, themes and WordPress version on your site with a database of known security holes, and tells you which ones need updating. It is different from a malware scanner, which looks for code an attacker already added. You want both: one shows the open doors, the other shows whether someone already came in.
Is the Moatline vulnerability check free?
Yes. The free plugin checks your site twice a day against our list of plugins under active attack and emails you when one is found. Moatline Pro adds the complete Wordfence Intelligence database (you need a free Wordfence API key), so you also see every known, not-yet-exploited vulnerability.
Can an online WordPress vulnerability scanner see all my plugins?
No. From outside, a scanner can only see plugins that load files on your public pages, and often not their exact version. Our free online check flags what it can see, but a plugin running inside WordPress sees every plugin and theme with its exact version.
Does a vulnerability scan slow down my site?
No. Moatline downloads the vulnerability list in the background and compares it with your installed versions, which takes a fraction of a second. Nothing about your site is sent anywhere.
A plugin I use is vulnerable. What should I do?
Update it to the fixed version straight away. If there is no fix yet, deactivate and delete it until there is. Then run a malware scan: if the flaw was exploited before you updated, the attacker may have left a backdoor that updating does not remove.
How is this different from WPScan?
WPScan is a command-line tool and API aimed at developers and penetration testers. Moatline runs inside WordPress, checks continuously, emails you, and also scans for malware and cleans it up, so site owners don’t need a terminal.

Find vulnerable plugins before attackers do

Free, takes two minutes to set up, and alerts you the moment a plugin you use is targeted.

Get it free on WordPress.orgSee what’s under attack