WPSec is a remote scanner that checks WordPress sites for vulnerable plugins, themes, outdated core, and exposed files. Lavawall®’s domain scan does that too: it finds the WordPress core version and flags known vulnerabilities, lists the plugins and theme it can see with the version to update to, and reports an exposed admin console, a public readme.html, and usernames anyone can list. The same scan checks the rest of the site’s exposure (email security, DNS and the domain registration, TLS, open services such as SSH, FTP, and databases, and security headers), explains each finding as a business risk, and re-scans on its own with an issue trend for each domain. Around it, Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams, with patching, security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance in the same agent and console. Try it with the free Scout scan, or read how to read the results.
Where Lavawall® wins
One scan covers WordPress (outdated core, plugins, and theme, known vulnerabilities, exposed admin pages, and listable usernames) and everything around it: subdomains, TLS, exposed services such as SSH, FTP, databases, and hosting control panels, and the SPF, DKIM, and DMARC records that decide whether attackers can spoof you. It works on any stack, WordPress or otherwise.
Monitored domains are re-scanned automatically. Each domain keeps an issue trend across its scans, and email reports go out after every scan or only when new issues appear.
Microsoft 365, Entra ID, Azure, and Google Workspace breach detection with endpoint correlation, well beyond a single site's CMS.
GRC compliance evidence across over 75 frameworks, so your posture becomes auditable control coverage.
Multi-tenant and white-label, so an MSP can run branded scans for every client from one console.
Where WPSec wins
Stealth and WAF-bypass scanning, which Lavawall® does not offer.
Push notifications for vulnerability alerts; Lavawall® alerts by email.
A WordPress-only tool, if WordPress is the only thing you need checked.
Lavawall vs WPSec: feature comparison
| Feature | Lavawall® (Scout + platform) | WPSec |
|---|---|---|
| WordPress core, plugin, and theme checks (outdated versions, known vulnerabilities) | Yes, from the outside | Yes, this is its focus |
| Exposed WordPress admin, readme.html, and listable usernames | Yes | Check WPSec’s documentation |
| Stealth and WAF-bypass scanning | No | Yes |
| Domain and subdomain discovery | Yes | Check WPSec’s documentation |
| SPF / DKIM / DMARC assessment | Yes | Check WPSec’s documentation |
| TLS and exposed-service checks | Yes | Check WPSec’s documentation |
| Scheduled scans and alerts | Yes: automatic re-scans, an issue trend per domain, and email when new issues appear | Scheduled site scans, push and email alerts |
| Microsoft 365 / Google Workspace breach detection | Yes | Check WPSec’s documentation |
| GRC framework evidence (CMMC, NIST, SOC 2, PCI, HIPAA) | Over 75 frameworks | Check WPSec’s documentation |
| Endpoint patching and configuration monitoring | Yes | Check WPSec’s documentation |
| Multi-tenant, white-label MSP console | Yes | Agency reporting |
| Free tier | Yes, two domains free forever | Yes, limited free scan |
| Console in French | Yes: Canadian French, Canadian English and US English, chosen by each person | No French option documented on its website (checked October 2026) |
Who should pick which?
Pick Lavawall® if…
You are an MSP or lean IT team and want WordPress checked along with the rest of each site’s exposure, across every stack, on a schedule.
You need the outside view joined to endpoint and Microsoft 365 security and to compliance evidence, from one console.
You want a free, white-label scan to show prospects their own exposure.
Pick WPSec if…
You need stealth or WAF-bypass scanning, or push notifications for alerts.
WordPress is the only thing you want checked, and a WordPress-only tool suits you.
Frequently asked
- Does Lavawall® replace WPSec?
- For most WordPress owners and agencies, yes. Lavawall®’s domain scan finds the WordPress core version and flags it when it is outdated or has known vulnerabilities, lists the plugins and theme it can see with their versions and what to update to, and reports an exposed
/wp-admin/, a publicreadme.html, and usernames anyone can list. Monitored domains are re-scanned automatically, and email reports go out after every scan or only when new issues appear. WPSec’s stealth and WAF-bypass scanning has no direct equivalent. - Does Lavawall® check WordPress plugins?
- Yes, from the outside, the way a visitor or attacker sees the site. Each plugin it can see is listed with its version, whether it is outdated, the version to update to, and a risk rating. Plugins whose version is hidden are listed too.
- Is Scout free like WPSec's basic scan?
- Yes. Two domains scan free, forever, with Scout. Paid tiers add continuous monitoring, more domains, and the full endpoint, Microsoft 365, and GRC platform.
- Is WPSec available in French?
- WPSec does not document a French option on its website (checked October 2026). Lavawall® works in Canadian French, Canadian English and US English, chosen by each person.