Skip to content

Free website health tool

Website Tech Stack & WordPress Health Check

See what a site is built on, and spot the WordPress and security-header gaps attackers look for first.

Only check sites you own or manage. The check is passive: it makes a few ordinary requests to public pages and never logs in, guesses passwords or tests for exploits.

What this tool checks

  • CMS and page builder: WordPress, Elementor, Bricks, Divi, Webflow, Wix, Squarespace, Shopify, Next.js, Framer and others
  • Hosting and CDN hints, analytics and tag managers
  • WordPress: exposed version, xmlrpc.php, public REST user listing, directory listing on uploads
  • HTTPS redirect, HSTS, Content-Security-Policy, clickjacking protection and other security headers

Good to know

Detection is passive: it reads the public home page, its headers and a few well-known public WordPress addresses, so anything not visible from outside (plugin versions, server settings, malware) isn't covered. Only check sites you own or manage.

No email wall: run as many checks as you like. The server-based tools only read public pages, the same way a browser or search engine does.

Frequently asked questions

Is it safe and legal to run this check?

The check only makes a handful of ordinary GET requests to public addresses, the same requests any browser can make. It doesn't log in, guess passwords, probe for hidden files or send attack payloads. Even so, only check sites you own or manage.

Should I disable xmlrpc.php?

Usually, yes. It's a legacy remote-publishing interface that most sites no longer need, and it's often targeted by password-guessing attacks. Check first whether you use the Jetpack app or another tool that relies on it.

Why does a public user list matter?

WordPress can list author accounts at /wp-json/wp/v2/users. Those slugs are often the login names, which gives attackers half of every username and password pair to try.

Will hiding my WordPress version make my site secure?

No. It removes an easy hint, but the real protection is keeping WordPress core, themes and plugins updated, using strong passwords with two-factor sign-in, and taking regular off-site backups.