A Canadian alternative to WPSec
WPSec is a website security scanner for WordPress website owners, professionals and businesses; white-label option for companies (e.g. agencies/hosts) (source). Lavawall® is a Canadian alternative, owned and hosted in Canada. Its domain scan checks WordPress core, plugins and themes for outdated versions and known vulnerabilities, re-scans on its own, and looks at the rest of the site's exposure as well. The closest match for each WPSec capability is listed below.
On this page: WPSec at a glance, feature by feature, WPSec and Canada, and moving over.
Start a 14-day free trialTalk to a human
14-day trial of the full platform, no credit card. Then month-to-month, in Canadian dollars, with no long-term contract.
WPSec at a glance
What WPSec says about itself, with a link to the page each fact comes from.
| Made for | WordPress website owners, professionals, and businesses; white-label option for companies (e.g. agencies/hosts) (source) |
|---|---|
| Pricing model | Per website (volume-tiered, monthly, or yearly), plus free plan, and white-label plan (source) |
| Free trial or free plan | Free plan (basic, monthly scans) (source) |
| Platforms | WordPress sites (core, plugins, and themes) (source) |
| Deployment | Cloud (SaaS) (online scanner; white-label runs on a separate isolated instance) (source) |
| Integrations it lists | Claude (MCP), Cursor (MCP), API, Webhooks, and CLI (source) |
| Data export | PDF and JSON report exports (Premium) (source) |
WPSec feature by feature
WPSec lists these capabilities on its own website; each links to its source. Beside each is the closest Lavawall® feature and the article that shows how to use it.
| What WPSec says it does | Closest Lavawall® feature | How-to article |
|---|---|---|
| WordPress vulnerability scanning (source) | The domain scan finds the WordPress core version and flags it when it is outdated or has known vulnerabilities (with the CVE), checks the theme, and reports an exposed /wp-admin/, a public readme.html, and usernames anyone can list. | Domain Scan Results |
| Multi-site security dashboard (source) | Domain Summary: every monitored domain in one table | Domain Summary |
| Scheduled daily, weekly, or monthly scans (source) | Monitored domains are re-scanned automatically, and each domain keeps an issue trend across its scans so you can see whether things are getting better. | Domain Scan Results |
| Plugin attack surface analysis (source) | Each plugin the scan can see is listed with its version, whether it is outdated, the version to update to, and a risk rating. Plugins whose version a visitor cannot see are listed too. | Domain Scan Results |
| Push and email vulnerability alerts (source) | Email Reports send the results after every scan, or only when new issues are found. Alerts arrive by email, not as push notifications. | Domain Scan Results |
| Easy-to-read security reports (source) | Every domain scan opens with a plain-language business risk summary, and downloads as a PDF or Word report. Dashboards and client reports roll it up across companies. | Domain Scan Results |
| Stealth and WAF-bypass scanning (source) | No direct equivalent in Lavawall. Check whether you need it before you move. | |
| White-label branded scanning (source) | Branded domain scanner for your own website | Embed Branded Domain Scanner |
Lavawall® has a close match for 7 of these 8 WPSec capabilities. The one without an equivalent is stealth and WAF-bypass scanning; check whether you rely on it before you move.
Lavawall® scans the site from the outside, the way a visitor or attacker sees it, so it reports the plugins and versions a site exposes publicly. The same scan also checks email security (SPF, DKIM, DMARC), DNS and the domain registration, TLS, open services such as SSH, FTP, databases and hosting control panels, and security headers.
For a longer comparison, see Lavawall® compared with WPSec.
WPSec and Canada
WPSec is a service of Triop AB in Funäsdalen, Sweden. We did not find a Canadian hosting option in WPSec’s public documentation. Ask WPSec directly where your data would be stored.
| Canadian criterion | Lavawall® | WPSec |
|---|---|---|
| Headquarters and ownership | Calgary, Alberta; fully Canadian-owned | Funäsdalen, Sweden |
| Hosting in Canada | Yes, by default | See WPSec’s documentation |
| Canadian-dollar pricing | Yes, with GST, HST, PST, and QST | See WPSec’s pricing |
| Console in French | Yes: Canadian French, Canadian English and US English, chosen by each person (details) | No French option documented on its website (checked October 2026) |
Taken from WPSec’s own website and documentation in September 2026 and linked on this page. Tell us if something has changed and we will correct it.
Lavawall® is built and owned by ThreeShield Information Security Corporation in Calgary, hosted in Canada by default, billed in Canadian dollars, supported from Canada, and available in Canadian French. What makes Lavawall® Canadian.
Moving from WPSec to Lavawall®
- Export what you need from WPSec. Its documentation describes this: PDF and JSON report exports (Premium).
- Start a free Lavawall® trial and add your companies.
- Register your domains in Scout for a free external scan, then add the agent when you want endpoint and Microsoft 365 coverage.
- Set up each feature from the table above. The how-to articles to start with: Domain Scan Results, Domain Summary, Company Summary, Embed Branded Domain Scanner.
- Run both side by side and turn WPSec off one company at a time, when your team is ready.
Where WPSec may fit better
If you only need a quick check of a single WordPress site, WPSec may be all you need.
Check these before you move:
- stealth and WAF-bypass scanning: Lavawall® has no direct equivalent
- push alerts: Lavawall® sends its scan alerts by email
Frequently asked questions
- Is Lavawall a Canadian alternative to WPSec?
- Yes. Lavawall® is Canadian-owned and hosted in Canada by default. Of the 8 WPSec capabilities listed on this page, Lavawall has a close match for 7, including WordPress core, plugin and theme checks on a schedule.
- Does WPSec host data in Canada?
- We did not find a Canadian hosting option in WPSec’s public documentation. Ask WPSec directly where your data would be stored. Lavawall® hosts data in Canada by default.
- How is WPSec priced?
- Its own website describes its pricing as per website (volume-tiered, monthly, or yearly), plus free plan, and white-label plan. Lavawall® publishes its prices in Canadian dollars on its pricing page, month-to-month.
- Does WPSec offer a free trial?
- Its own website lists this: free plan (basic, monthly scans). Lavawall® offers a 14-day free trial with no credit card.
- What does Lavawall not replace in WPSec?
- Lavawall® has no direct equivalent for WPSec’s stealth and WAF-bypass scanning, and it sends alerts by email rather than as push notifications. Everything else on this page has a close match.
- Can Lavawall replace WPSec?
- For most WordPress owners and agencies, yes. Lavawall®’s domain scan finds outdated WordPress core, plugins and themes, known vulnerabilities, and exposed admin pages, re-scans automatically, and emails you when new issues appear. It also checks the rest of the site’s exposure (email security, DNS, TLS, open services), and the platform covers endpoints, Microsoft 365, and compliance.
- Can I export my data from WPSec?
- WPSec’s documentation describes this: PDF and JSON report exports (Premium).
- Is WPSec available in French?
- WPSec does not document a French option on its website (checked October 2026). Lavawall® works in Canadian French, Canadian English and US English, chosen by each person.
WPSec is a trademark of its owner. Other product names are trademarks of their respective owners. Lavawall is not affiliated with WPSec.