Run a WP security audit by asking
A free plugin adds a chat to your WP dashboard. Ask “Is my site secure?” It checks admins, plugins, the padlock and if a plugin saves copies. Nothing changes.
It reads your admins, plugins and padlock. It doesn't scan your files.
Needs WP 6.3 to 7.1 and PHP 8.0 or newer. What it installs
Needs WP 6.3 to 7.1, PHP 8.0 or newer, and an administrator login. One site per install.
The download is a plugin. Turning it on connects your site to cmshands.com and adds 3 small rescue files. Deleting the plugin removes them and everything it stored. What we send
Plugins are installed from a computer. Get the plugin here instead
- Nothing changes without your OK
- Undo in one click, or a warning first
- No account, no password to share
What it does here
- It lists everyone who can log in as an administrator and points out any name that doesn't look like yours.
- It lists plugins with a newer version waiting, and passes on the maker's note when it's a security release.
- It tells you whether anything on your site saves copies of it. In our run nothing did, and it said so.
More it does here (2)
- It warns you when your SSL certificate (what puts the padlock and https in front of your address) has 14 days or fewer left. It can't renew it.
- After your OK, it updates a waiting plugin, one at a time, from the WP plugin directory. If your site gets worse, the old version goes back.
How to run a security audit in WordPress yourself
Checked on WP 7.1, Oct 14, 2026
1. Open your site and click the padlock next to its address. View the SSL certificate: it shows the date it runs out.
2. In your dashboard (the screens at yoursite.com/wp-admin), go to Users › All Users and click Administrator above the list.
3. Read each name. If you don't know one, ask whoever built your site before you remove it.
4. Go to Dashboard › Updates. It lists every plugin and theme with a newer version waiting, and WP itself.
5. Go to Plugins › Installed Plugins. Under a plugin's name, click View details and look at Last Updated.
6. Go to Tools › Site Health and read any critical issues it lists first.
7. Log in to your host's control panel and find where it keeps copies of your site. Check the date of the last one.
Our test site is a WP site we run to try every task before we write about it. There, the chat confirmed https worked but couldn't see the certificate's end date, or when each plugin was last updated. It said so plainly, and steps 1 and 5 show you both.
Why it won't wreck your site
- Asking changes nothing. A question only reads your site. It looks things up and tells you. No card, no button.
- Nothing changes until you press the button. Every change comes as a card that names it. Nothing happens until you press the button or Not now.
- Updates put themselves back. After a plugin update it checks your site. If the site got worse, the old version goes back on its own.
What it won't do here
- No file scan or hacked-site clean-upIt doesn't look inside your files for harmful code, and it can't clean up a hacked site. A security plugin or your host can scan files.
- It doesn't back up your siteIt tells you whether anything on your site saves copies of it. It can't see your host's copies or make one.
- It doesn't renew your SSL certificateIt warns you when 14 days or fewer are left. Renewing it stays with your host.
- It can't update WP itselfAsk whether a WP update is safe to run and it answers. Running that update stays with you or your host.
Questions
How do I do a WordPress security check myself?
Check 4 things: who is an administrator (Users › All Users), what's waiting in Dashboard › Updates, the end date on your padlock's certificate, and when your host last saved a copy of your site. Then read Tools › Site Health. Looking inside your files for harmful code needs a security plugin or your host.
Who should have administrator access to my site?
Only the people who run the site day to day. An administrator can add plugins, add users and change anything. Someone who only writes posts can be an Editor or Author instead. Look under Users › All Users, and ask whoever built your site before you remove a name.
Does CMSHands scan my files for hacked code?
No. It reads your users, plugins and settings, and tells you what it finds. It doesn't look inside your files for harmful code, and it can't clean up a hacked site. If you think your site was hacked, ask your host first what they can check and put back.
Can it tell me if my site is backed up?
Partly. It can see whether a plugin on your site saves copies of it. In our run none did, so it said so, and that your host may. It can't see your host's copies or make one: check your host's control panel for those.
Is it free?
To start, yes: 3 changes with no account, then 10 a month once you add your email. Questions are free, up to 30 a day.
Written by CMSHands team.
Ask it about your own site
- Nothing changes without your OK
- Undo in one click, or a warning first
- No account, no password to share
Free to startNo account: 3 to try itWith your email: 10 every monthWhat's free