WPScan — Install, Use, Optimise (2026)

WordPress-specific vulnerability scanner — versions, plugins, themes, user enumeration, and CVE matching.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

Ruby gem

gem install wpscan

Linux (apt)

sudo apt install wpscan

Docker

docker run -it --rm wpscanteam/wpscan --url https://target.com

Get free API token

Register at wpscan.com (free tier: 25 requests/day)

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Default scan

wpscan --url https://target.com

Enumerate plugins + themes + users

wpscan --url https://target.com -e ap,at,u --api-token YOUR_TOKEN

Brute force users via xmlrpc

wpscan --url https://target.com -P passwords.txt -U admin --max-threads 10

Aggressive enumeration

wpscan --url https://target.com -e ap,at,u --plugins-detection aggressive --api-token TOKEN

Output JSON

wpscan --url https://target.com -o report.json -f json

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• API token (free) is mandatory for vulnerability data — without it you get fingerprint only, no CVEs.
• --plugins-detection passive default — checks JS/CSS hints. aggressive brute-forces all plugin paths (slow but thorough).
• --max-threads 5 default — bump only if target tolerates. WordPress sites often choke at 20+.
• --throttle 250 adds 250ms delay between requests — useful for fragile targets.
• --random-user-agent rotates UA — sometimes bypasses naive WAF rules.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• XMLRPC brute-force is loud — Wordfence and modern WAFs detect this in seconds.
• -e ap hits every /wp-content/plugins/X/readme.txt in the dictionary — that’s thousands of requests, easy to log.
• Free API tier (25/day) runs out fast on big assessments. Pro is $59/mo for 750/day.
• Some plugins lie about version in readme.txt — fingerprint via JS file hashes for accuracy.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• Nuclei + WordPress templates — same coverage, cleaner integration.
• CMSeek — multi-CMS (Joomla, Drupal, WP).

India context and engagement notes

Most Indian SMB websites are WordPress. WPScan + Nuclei wp-* templates is the 80/20 of finding their actual exposure. The CVE database is the value here, not the scanner itself.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.