Trying WPScan, a black box WordPress vulnerability scanner
I just found a great tool to scan my wordpress sites for vulnerability, WPScan . WPScan is a blackbox scanner which means that you can install it on your computer and scan remote wordpress servers. To install WPScan on my Ubuntu 14.04 server, I ran these command lines: $ sudo apt-get install libcurl4-gnutls-dev libxml2 libxml2-dev libxslt1-dev ruby-dev build-essential $ git clone https://github.com/wpscanteam/wpscan.git $ cd wpscan $ sudo gem install bundler && bundle install --without test Then, tried some of these features: 1. Simple check: $ ruby wpscan.rb --url www.mywordpress.com 2. Do a wordlist password brute force on all the users: $ ruby wpscan.rb --url www.mywordpress.com --wordlist darkc0de.txt Notes: you can download the sample wordlist file here . for more scanning methods, please read the WPScan's official website .