Description
Scan. Fix. Protect.
Your WordPress Site — Automatically.
Deep security audit with 44+ checks, one-click auto-fixes, a built-in WAF firewall, and brute-force login protection — all from one admin panel. No SaaS. No monthly fees. Your data stays on your server.
Bots Never Sleep
Automated scanners probe for exposed wp-config.php, default “admin” accounts, and outdated plugin vulnerabilities — 24/7, whether you’re watching or not.
Hidden Exposures
Debug logs, .env secrets, backup files, and Git metadata can be publicly accessible without you knowing. One exposed file = full database credentials.
Manual Hardening = Hours
HSTS headers, CSP policies, file permissions, salt regeneration, brute-force shields — implementing these manually requires deep server expertise.
THE SOLUTION
One Plugin That Scans, Fixes & Shields
Deep Security Scanner
44+ checks across exposed files, accounts, headers, SSL/TLS, and Patchstack CVE vulnerabilities. Runs locally — no data leaves your server.
35+ One-Click Fixes
Apply hardening patches instantly — every fix is 100% reversible. Consolidated into a must-use plugin so they survive updates.
Active WAF Firewall
Block SQL injection, XSS, bad bots, and brute-force attacks in real time — before WordPress even loads. Zero performance overhead.
SOCIAL PROOF
Trusted by WordPress Professionals
“Found 13 issues I had no idea about — including an exposed debug.log with my database password. Fixed everything in 10 minutes.”
WooCommerce Store Owner
“I manage 30+ client sites. Scheduled scans and email alerts save me hours monthly. When a client installs a vulnerable plugin, I know instantly.”
WordPress Agency Owner
“The firewall blocked 47 brute-force attempts in the first week. Real-time logs are eye-opening. I’ll never run WordPress without this.”
Freelance Web Developer
FEATURES
Everything You Need to Lock Down WordPress
44+ Security Checks
Filesystem, database, SSL/TLS, security headers, and Patchstack CVE lookups — all in a single automated scan with severity grading.
35+ One-Click Auto-Fixes
Salts regeneration, file permissions, XML-RPC, admin rename, and more. Every fix includes preview, warning, and full Undo button.
Web Application Firewall
Block SQL injection, XSS, bad bots, sensitive file access, and rate-limit abusers. Full event log, IP management, and CSV export.
Advanced Login Protection
Brute-force shield with CIDR safelist/denylist, blocked usernames, lockout escalation, GDPR error messages, and forensics log.
Scheduled Auto-Scans
Daily, weekly, or monthly scans via WP-Cron. Instant email alerts when critical issues are found — even while you sleep.
Patchstack CVE Database
Every installed plugin and theme checked against the Patchstack public CVE feed. Optional API key for extended vulnerability data.
Every Hidden Risk, Found & Scored
The scanner runs entirely inside your WordPress install. No external agent, no SaaS, no data leaving your server.
🛡️ Scan My Website Now
Get a complete security assessment and discover vulnerabilities before attackers do.
🔍 Find Hidden Security Risks
Uncover security weaknesses, misconfigurations, and exposed files that often go unnoticed.
🔥 Activate Firewall Protection
Block malicious requests, bots, and common attack attempts with real-time protection.
⚡ Secure My Website Today
Strengthen your WordPress security in minutes with automated scanning, hardening, and protection.
ACTIVE FIREWALL
A Firewall That Actually Stops Attacks
Five protection modules run at init priority 1 — before WordPress loads. Zero performance impact.
Query String Protection
Blocks SQLi, XSS, path traversal & shell-injection patterns in URLs.
Bad Bot Blocking
Blocks sqlmap, nikto, wpscan, curl, wget & vulnerability scanners.
Sensitive File Guard
Blocks HTTP access to wp-config, .env, .git, composer.json & backups.
Rate Limiting
Auto-blocks IPs exceeding 120 req/min with configurable threshold & duration.
Event Log & IP Management
Full event log with masked IPs, rule labels, and CSV export. Block or whitelist IPs permanently or temporarily.
FIX CENTER
35+ Hardening Fixes — Applied in Seconds
AUTO-FIX
Admin Username Rename
Randomizes the “admin” account — the #1 brute-force target. Fully reversible.
AUTO-FIX
Auth Salts Regeneration
Replaces all 8 WordPress auth salts with cryptographically strong random values.
AUTO-FIX
File Permissions Lock
Sets wp-config.php to 0600 and .htaccess to 0644 — recommended permissions.
AUTO-FIX
Directory Listing Disable
Adds Options -Indexes to .htaccess — prevents browsing your uploads folder.
GUIDED
XML-RPC Disable
Blocks amplification attacks. Shows Jetpack compatibility warning before applying.
AUTO-FIX
Inactive Plugin Cleanup
Deletes inactive plugin files — inactive code is still exploitable attack surface.
AUTO-FIX
Mixed Content Fix
MU-plugin output buffer rewrites HTTP→HTTPS. Fixes mixed content warnings site-wide.
+28 MORE
And Many More…
Force SSL, HSTS, WP-Cron access, debug logs, license files, file permissions, and more.
HOW IT WORKS
Secure Your Site in 5 Simple Steps
Install
Upload from WordPress plugin directory or ZIP file.
Scan
Run your first scan. Watch live progress across 44+ checks.
Review
See your Security Score. Issues sorted by severity — critical first.
Fix
Hit “Fix Now” or “Apply All” — each fix runs with confirmation.
Protect
Schedule weekly scans. Firewall runs 24/7 automatically.
COMPARISON
How Does It Stack Up?
| Feature | Critical Scanner Pro | Wordfence Free | iThemes Security | SaaS Tools |
|---|---|---|---|---|
| Deep Filesystem Scanner | ✓ | ✓ | ✗ | ✗ |
| One-Click Auto-Fixes (35+) | ✓ | ✗ | ✗ | ✗ |
| Reversible Fixes with Undo | ✓ | ✗ | ✗ | ✗ |
| Built-in WAF Firewall | ✓ | Premium | Partial | ✓ |
| Login Brute-Force Shield | ✓ | ✓ | ✓ | ✓ |
| Patchstack CVE Integration | ✓ | Partial | ✗ | ✓ |
| Scheduled Scans + Email Alerts | ✓ | Premium | ✓ | ✓ |
| No SaaS Dependency | ✓ | ✓ | ✓ | ✗ |
| Security Score Dashboard | ✓ | Partial | ✗ | ✓ |
| All Data on Your Server | ✓ | ✓ | ✓ | ✗ |
PRICING
Simple, Honest Pricing
Starter
Perfect for a single site.
- All 44+ Security Checks
- 35+ One-Click Auto-Fixes
- Built-in WAF Firewall
- Advanced Login Protection
- Patchstack CVE Integration
- Scheduled Scans & Alerts
- Scan History & Audit Log
- 1 Year Priority Support
Professional
For agencies & multi-site managers.
- Everything in Starter
- 5 Site Licenses
- White-label Ready
- Priority Email Support
- Lifetime Updates
- CSV Firewall Log Export
- Multi-site Compatible
- Early Access to New Features
Agency
10 sites. Full control.
- Everything in Professional
- 10 Site Licenses
- Dedicated Account Manager
- Phone & Chat Support
- Custom Branding Options
- Bulk Scan Reports
- API Access (Roadmap)
- Lifetime Updates & Support
WHO IT’S FOR
Built for Every WordPress Professional
Store Owners
Customer data and payment flows require strict security. One breach = destroyed trust.
Agencies
Deliver security as a service. Scheduled scans and audit logs for every client.
Freelancers
Harden client sites before handoff with a full security audit and high score.
Bloggers
Install, scan, click Fix All — get on with creating content while the plugin watches your back.
30-Day Money-Back Guarantee
Try Critical Security Scanner Pro completely risk-free. If you’re not fully satisfied within 30 days — for any reason — we’ll refund every cent. No questions asked.
FAQ
Frequently Asked Questions
The scanner checks your filesystem for exposed files (phpinfo.php, .env, debug.log, wp-config backups, .git metadata), validates SSL/TLS certificates, inspects security headers (HSTS, CSP, X-Frame-Options), reads WordPress options, and checks all installed plugins/themes against the Patchstack CVE database. Everything runs locally — no data leaves your server.
Yes — every fix is 100% reversible. Most consolidate into a must-use plugin at wp-content/mu-plugins/ so they survive updates. Fixes that may affect integrations (like disabling XML-RPC for Jetpack users) display clear warnings before applying. Undo any fix from Fix Center or Results page.
No. The firewall runs at init priority 1 and exits immediately for trusted IPs and logged-in administrators. The DB-version guard is served from the WordPress object cache after the first request, adding zero extra DB queries on warm page loads.
Yes. Under Settings → Scheduled Scans, enable automatic scanning and choose Daily, Weekly, or Monthly. Set the exact time of day for each scan. WordPress WP-Cron handles the schedule. You can receive instant alerts for critical findings and/or a full summary after each scheduled scan.
Patchstack provides a free public CVE feed that works without an API key — the plugin uses this by default. A Patchstack API key unlocks extended vulnerability data with more detail and faster refreshes. Leave the field empty to use the free feed.
Add define(‘CSS_DISABLE_FIREWALL’, true); to your wp-config.php. This bypasses all firewall logic instantly without deactivating the plugin. Remove the constant to re-enable protection.
The Firewall Login Protection module (under Firewall) is a lightweight brute-force defense integrated with the WAF. The Login Protection page is a full system with CIDR safelist/denylist, blocked usernames, GDPR-compliant custom error messages, lockout escalations, and a forensics log. For maximum protection, use both.
Yes. Scan results, fix logs, firewall events, and IP rules are all stored in your WordPress database (custom tables). No data is ever sent externally. When you uninstall, you can optionally delete all plugin data with one toggle in Settings.
Start Protecting Your WordPress Site Today
🚀 Get Critical Security Scanner Pro
