FreePassive check
Which of your plugins have known vulnerabilities?
Enter a WordPress site address. We read the same public files a browser loads, detect plugin and theme versions, and match them against the Radar database.
- No exploit requests, no login, no form submissions
- Usually done in under 30 seconds
- Full details for signed-in, verified members
What we check
- Plugin and theme slugs referenced in the page source
- readme.txt stable tags of detected plugins
- Version strings in ?ver= asset URLs and the feed generator
What we never do
- Send exploit payloads or proof-of-concept requests
- Log in, submit forms or brute-force anything
- Scan private or internal addresses
About Check my site
Does Check my site attack or scan my website?
No. It only downloads public resources that any browser could load: the home page, readme.txt files of plugins and themes, and versioned asset URLs. It sends no exploit payloads, does not log in and does not submit forms. A single check makes at most about 40 requests, with pauses between them.
Why does it miss some plugins?
Some plugins load no public files, or hide their version. Security plugins and caching layers can also strip version numbers. The result shows what could be detected from the outside, nothing more.
Can I check a site I do not own?
The check only reads public information, but please only check sites you own or manage. Limits apply: 3 checks per hour for guests, 20 per day for signed-in members.
Does a clean result mean my site was not hacked?
No. It means we found no known vulnerable versions among the plugins we could detect. If you see warning signs such as redirects, unknown admin accounts or spam pages, report an incident.