No. 11 of 36 ·Vulnerability Scanning Software

WPScan

Mac · Linux · Self-hosted · API

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely2 of 6 device platforms
DocumentedPlans, terms and facts published

WPScan is ranked #11 of 36 in vulnerability scanning software on Freedom251. It runs on API, Linux, macOS, Self-hosted. There is a free plan.

WPScan plans and pricing

All plans

Researcher Free Non-commercial use · 25 API calls per day · Free CLI scanner wpscan.com · 4 Oct 2026

Enterprise Not published Custom pricing by number of sites · Instant email alerts · Slack and HTTP webhooks · Description and PoC API data · CVSS risk scores wpscan.com · 4 Oct 2026

Compared on vulnerability scanning software

Supported targets: WordPress core, plugins, themes, usernames, media, configuration backups, database exports, TimThumb files, and remote WordPress applications
Authenticated scanning: Yes

Best WPScan alternatives

See all 20

Two bars Intruder Free tier No. 1Free6.6 Two bars ManageEngine Vulnerability Manager Plus Free tier No. 2$57.92/mo6.6 Two bars Nmap Free tier No. 3$9,980/mo6.6 Two bars NSAuditor AI Free tier No. 4$3.25/mo6.6 Two bars Nuclei Free tier No. 5Free6.6 Two bars OpenVAS Free tier No. 6€210.33/mo6.6

The record

Purpose: WPScan provides a WordPress security scanner and vulnerability database covering WordPress core, plugins, and themes.
Vulnerability review: WPScan says vulnerabilities are manually checked by WordPress security professionals to reduce false positives.
CLI scanning: The free black-box CLI scanner checks WordPress version, installed plugins and themes, and other exposures including username enumeration and publicly accessible configuration files.
API: The WPScan API provides vulnerability data for WordPress core, plugins, and themes and is used by its scanner and WordPress security plugin.
Integrations: WPScan lists Slack and HTTP webhooks for enterprise users and names Kali Linux, Dradis, BackBox Linux, Pentoo, Samurai WTF, and BlackArch as integrations.
Enterprise API data: Enterprise API results include vulnerability descriptions, proof-of-concept fields, and CVSS risk scores.
Data use limits: The API terms prohibit permanent storage and caching of vulnerability data, and companies integrating WPScan data into their own services must use an Enterprise account.
Privacy: WPScan says its API stores the scanner IP or domain, WordPress version, plugin and theme slugs, request count, and timestamps.
Service limits: WPScan states that its API carries no uptime or accuracy guarantee and that it may not record every known vulnerability.
Scanning scope: WPScan says it identifies sites with software containing known vulnerabilities but does not determine whether a site has been compromised or remove malware.
Supported installation methods: The CLI scanner is distributed as a Ruby gem, Docker image, and Homebrew package for macOS.
Maker: WPScan's enterprise terms identify Automattic Inc. as the provider of the enterprise solution.
Price from: Free

Where it ranks on Freedom251

Best Vulnerability Scanning Software in 2026#11 of 36

Is WPScan yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote WPScan

Sources

wpscan.com· checked 4 Oct 2026
wpscan.com/pricing/· checked 4 Oct 2026
wpscan.com/how-to-install-wpscan/· checked 4 Oct 2026
wpscan.com/api/· checked 4 Oct 2026
wpscan.com/enterprise-customers-features/· checked 4 Oct 2026
wpscan.com/terms/· checked 4 Oct 2026