Free WordPress health checker · no signup
Free WordPress Health Checker
Paste a site URL. Instantly see HTTPS, security headers, XML-RPC, sitemap, SEO basics, and WooCommerce cart/checkout if a store is detected.
Works best on WordPress and WooCommerce sites. Public scan only, not a penetration test. Limit 12 checks per hour. Also: speed test · schema checker · social preview.
Want a senior engineer to fix what’s failing?
Get a free written rescue audit and a fixed quote (usually same day), hire at $25-$60/hr, or put the site on a care plan from $39/mo.
WP Care health checker · hello@wpcare.io · Results are advisory and based on publicly reachable signals only.
What this WordPress health checker looks at
Built for site owners and agencies who need a fast second opinion before hiring help. This is a public WordPress security and SEO scan, not wp-admin Site Health.
Security and hardening
HTTPS, security headers, XML-RPC exposure, default readme.html, mixed content clues.
WordPress signals
WP fingerprints, REST API, version meta leak. WooCommerce cart, checkout, Store API, and cache headers when a store is detected.
SEO basics
Title and meta description, robots.txt, XML sitemap discovery, server response time.
WordPress health checker vs Site Health in wp-admin
WordPress Site Health inside wp-admin needs a login. This free WordPress health checker scans what a stranger can see: HTTPS, headers, XML-RPC, sitemap, version leaks, and public WooCommerce cart/checkout. Use it on any URL, including a client site you do not yet have access to. For PageSpeed and Core Web Vitals, run the WordPress speed test.
WordPress health checker FAQ
Is this WordPress health checker free?
Yes. Paste a URL. No account. Limit 12 checks per hour per IP. Results are advisory and based on public signals only.
Is this a WordPress security scanner or a pentest?
It is a passive public scan. We do not log in, brute-force, or send exploit payloads. We flag HTTPS, headers, XML-RPC, readme.html, mixed content, and similar exposure. For malware cleanup, use a free audit or bug fixing.
Why does XML-RPC matter?
xmlrpc.php is a common brute-force and pingback amplification target. If you do not need the Jetpack or mobile-app remote API, disable it. This checker tells you if it is still reachable.
What is a good WordPress health score?
Treat the score as a triage list, not a grade for Google ranking. Red items (open XML-RPC, no HTTPS, missing sitemap) are the ones to fix first. Then run a speed test for Core Web Vitals.
Do you check WooCommerce checkout health?
We check public store signals only: Store API, cart and checkout URLs, and whether those pages look full-page cached. We cannot read orders, PHP, or payment gateway settings without a login. For a full store audit, claim a free audit.
Can you harden the site for me?
Yes. Claim a free site rescue audit, hire a WordPress developer at $25-$60/hr, or put the site on a care plan from $39/mo.
Also free: schema checker · social preview · speed test. Or claim a free audit.