Is my WordPress site up to date and secure?

Short answer: most WordPress break-ins use something visible from outside: an old WordPress version, an out-of-date plugin with a published hole, an open xmlrpc.php, or a public list of user accounts to try passwords against.

How to check it yourself

Log in and check Dashboard, then Updates, and update anything behind.
Remove plugins you don't use.
Visit /xmlrpc.php. If you don't use it, block it.
Visit /wp-json/wp/v2/users. If it lists users, restrict it.

Why it matters

WordPress runs a large share of the web, so attackers scan for its known weaknesses automatically. Out-of-date core and plugins are the most common way in, followed by guessable logins. Many of the signs are visible from outside, so if you can see them, so can the scanners.

Common causes

Plugins and themes that were installed once and never updated.
Automatic updates turned off after one update caused a problem.
Old plugins left deactivated instead of deleted.
Default settings that list users and leave xmlrpc open.

What Preventionlabs shows

For WordPress sites, every report checks, from outside: the WordPress version against the latest release, out-of-date plugins, whether xmlrpc is open, and user accounts listed publicly (display names, not login names), alongside the full set of checks every site gets. See are my WordPress plugins out of date?

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free