WPSec is a well-regarded online WordPress security scanner. It is built on the WPScan engine and the WPScan vulnerability database — one of the largest dedicated catalogues of WordPress plugin, theme, and core vulnerabilities — and it enumerates the plugins and themes installed on a WordPress site, reports the known CVEs affecting their versions, flags configuration issues, and offers a dashboard with scheduled scans and email or webhook alerts. If your world is WordPress and you want the deepest possible plugin-vulnerability coverage, WPSec is a focused, capable tool.
Lavawall® Scout is a broader external scanner. It does WordPress plugin, theme, and version detection with known-CVE matching too — but a website is more than its CMS. Scout also checks email authentication (SPF, DKIM, DMARC with policy and mode), TLS and certificates, DNS hygiene (DNSSEC, CAA), security headers and WAF presence, open ports and exposed admin panels, blacklist reputation, exposed files and backups, and content-change / defacement monitoring — on any site, WordPress or not. And it is multi-tenant: a module of the Lavawall® platform built for MSPs managing many client domains.
The honest answer: for a WordPress-only audit where plugin CVE depth is the whole job, WPSec/WPScan is excellent. For an MSP or IT team that needs to understand a client’s whole external exposure — email spoofability, certificate and DNS posture, open services, reputation, and defacement, with WordPress as one part — Scout covers more ground in a single scan.
Where Lavawall® Scout wins
Whole attack surface, not just WordPress. WPSec only looks at WordPress. Scout checks email authentication, TLS, DNS, headers, ports, and reputation regardless of the CMS — the exposures that cause real-world incidents even when the CMS is fully patched. A perfectly-updated WordPress site can still be wide open to email spoofing or have an admin database panel exposed; Scout catches that, WPSec does not look.
Email spoofability built in. Scout reports SPF, DKIM, and DMARC with the enforcement mode in plain English, detects the mail provider, and lists exposed email addresses harvested from public pages. WordPress scanners do not touch email authentication at all.
Reputation and defacement monitoring. Scout checks the domain against commercial-safe phishing/malware blocklists (PhishDestroy, URLhaus and other feeds) and fingerprints page content to catch defacement, newly-injected external scripts, and new outbound links — the early signals of compromise. WPSec is vulnerability-enumeration focused, not compromise-detection.
Quiet and WordPress-gated. Scout’s WordPress-specific probes (user enumeration, sensitive-file discovery) only run when the site is actually WordPress, use a single REST request rather than noisy author-ID brute forcing, and stop the moment a WAF block is detected — so scanning a client site does not light up their firewall.
Multi-tenant for MSPs, with white-label. Scout is part of the Lavawall® platform: one console across every client domain, scheduled scans, trend history, native email reports with charts, and the ability to embed Scout on your own marketing site to capture leads.
One platform, not a point tool. The same vendor and console that scan a client’s perimeter also handle 7,500+ application patching, M365 / Entra / Azure breach detection, GRC compliance, helpdesk, and remote support — with native CAD billing.
Where WPSec wins
WordPress plugin vulnerability depth. WPSec runs on the WPScan engine and its large dedicated WordPress vulnerability database. For an organisation that lives entirely in WordPress and wants the deepest possible plugin- and theme-level CVE enumeration, WPSec’s WordPress-specific catalogue is its core strength.
WordPress-specialist workflow. WPSec’s dashboard, scheduled scans, and alerting are designed specifically around managing lists of WordPress sites, which some WordPress-only agencies will find a tighter fit than a broader platform.
WPScan lineage. The underlying WPScan project is a long-standing, widely-trusted name in WordPress security testing, with a vulnerability feed maintained specifically for the WordPress ecosystem.
Feature comparison
| Feature | Lavawall® Scout | WPSec (WPScan-based) |
|---|---|---|
| Works on any site, not just WordPress | Yes | No — WordPress only |
| WordPress plugin / theme / core detection | Yes — with versions | Yes — flagship strength |
| Known-CVE matching on detected versions | Yes — NVD-backed | Yes — WPScan WordPress DB |
| Dedicated WordPress vulnerability database depth | Good | Deepest (WordPress-specific) |
| WordPress user enumeration (quiet, gated) | Yes — single REST request | Yes |
| Exposed file / backup / config discovery | Yes | Partial (config issues) |
| SPF / DKIM / DMARC email authentication | Yes — mode in plain English | No |
| TLS / certificate analysis | Yes | No |
| DNSSEC / CAA / WHOIS hygiene | Yes | No |
| Security headers & WAF detection | Yes | No |
| Open-port & exposed-admin-panel scan | Yes | No |
| Blacklist / phishing reputation | Yes — commercial-safe feeds | No |
| Content-change / defacement monitoring | Yes — with alerts | No |
| Exposed-email harvesting check | Yes | No |
| Scheduled scans & alerts | Yes | Yes (paid) |
| Trend history & native email reports | Yes — with charts | Reports / notifications |
| Multi-tenant MSP console | Yes — design point | Limited — WordPress site lists |
| White-label embed on your own site | Yes | No |
| Part of a broader platform (patching, GRC, breach detection) | Yes | No |
| Free tier | Two domains free forever | Limited free basic scan |
Who should pick which?
Pick Lavawall® Scout if…
You are an MSP or IT team that needs to understand a client’s whole external exposure — email spoofability, TLS and DNS posture, open services, reputation, and defacement — with WordPress as one part of the picture.
You manage many domains and want one multi-tenant console, scheduled scans, trend history, and email reports, with the option to white-label the scanner on your own site.
You want the scanner bundled with the rest of your security stack at MSP pricing rather than as a standalone WordPress tool.
Pick WPSec if…
Your work is exclusively WordPress and the single most important thing is the deepest possible plugin- and theme-level vulnerability enumeration from a dedicated WordPress vulnerability database.
You want a WordPress-specialist dashboard and workflow built around lists of WordPress sites, and you do not need the email, DNS, TLS, port, reputation, or defacement coverage.
Frequently asked
- Is WPSec the same product category as Lavawall® Scout?
- Partly. WPSec is a WordPress-only vulnerability scanner built on the WPScan engine and vulnerability database — it enumerates plugins, themes, and core and reports their known CVEs. Scout does WordPress plugin/theme/version detection with CVE matching too, but also covers email authentication, TLS, DNS, security headers, open ports, WAF, blacklist reputation, exposed files, and defacement — on any site. WPSec is the better fit for WordPress-only plugin CVE depth; Scout is the better fit when you need the whole external picture.
- Does WPSec go deeper on WordPress plugins than Scout?
- On raw WordPress plugin vulnerability coverage, WPSec/WPScan maintain one of the largest dedicated WordPress vulnerability databases. Scout detects plugin and theme versions and matches them against an NVD-backed CVE database, and adds everything outside WordPress that WPSec does not examine. A WordPress-only shop wanting maximum plugin CVE depth may prefer WPSec; most MSPs need the broader coverage.
- What about WPScan itself?
- WPScan is the open-source engine and vulnerability database that WPSec is built on. The comparison points on this page apply to WPScan-based scanning generally: deep WordPress plugin/theme/core vulnerability enumeration, but no coverage of email authentication, TLS, DNS, ports, reputation, or defacement, and no multi-tenant MSP console.
- Is Scout multi-tenant for MSPs?
- Yes. Scout is a module of the Lavawall® platform, which is multi-tenant by design: one console across every client domain, scheduled scans, trend history, native email reports with charts, and white-label embedding on your own marketing site.
- How much does each cost?
- WPSec offers a limited free basic scan and paid plans for scheduled scanning. Scout is free for two domains forever, and the same engine is bundled into the Lavawall® platform with published CAD and USD pricing on the pricing page — no separate per-scanner licence.