Every scanning tool implies a promise: "we checked, and here's what we found." The part that gets left out is just as important — what wasn't checked. We'd rather say that part out loud.
What a scan actually does
When you submit a URL, we send a handful of ordinary GET requests — the same kind your browser sends every time you visit a page. We look at:
- The PHP version, when your host exposes it in the
X-Powered-Byresponse header. - The WordPress core version, from the public generator tag or
readme.html. - Plugin versions, from the version string WordPress appends to each plugin's public CSS/JS files.
We compare whatever we find against a list of specific, publicly disclosed CVEs we've personally verified against the original advisory. If nothing matches, you get a clean result.
What "clean" does not mean
A clean result means: none of the specific, verified signatures we check for were present. It does not mean your site has no vulnerabilities. We check a curated list, not the universe of possible issues. Our full, up-to-date list — including exactly which CVEs are active right now — lives on the methodology page.
What we will never do
No exploitation. No brute-force login attempts. No form submissions. No scanning of logged-in areas. No malware or file-integrity scanning. If a signature hasn't been fully verified against its original advisory, it stays disabled in our code — it simply can't fire, even by accident.
This is a fast, honest first check — not a substitute for a full security audit. We'd rather be useful within a narrow, clearly-stated scope than vague about a broad one.