TheScan

Universal Security Scanner

Find the holes
before attackers do.

Vulnerabilities, payment-page scripts, TLS grade, blocklists, and mail authentication — in a single scan.

Known CVEs

Matches WordPress core, plugins, and themes against known vulnerability advisories.

Updates needed

Flags outdated core, WooCommerce, plugins, and themes against the latest stable releases.

Access breach paths

Brute-force exposure, user enumeration, and session cookies that lack HttpOnly, Secure, or SameSite, including values leaked into debug output.

Exposed files and keys

Config backups, .env, .git, dumps, public shell pages, and API keys or private keys found in the page, same-origin scripts, or a public debug log.

WooCommerce risks

Card-testing, Store API exposure, order IDOR, PCI-DSS checkout headers, and skimmer signatures.

Downloadable reports

Signed-up users export HTML/PDF, JSON, and CSV reports from their saved scan history.

Commercial checks

Included in every scan

The same measurements agencies bill as a separate external review. The next scan of a URL alerts when payment scripts, components, the certificate, or a blocklist change.

  • Payment scripts

    Hosts and integrity on the checkout page

  • Plugin advisories

    Public version matched to a known CVE

  • Core checksum

    Public WordPress files against the release

  • TLS grade

    Expiry, TLS 1.0, and CAA

  • Blocklists

    Google Web Risk, Spamhaus, SURBL, Quad9, and Cloudflare

  • Checkout supply chain

    Hosts that appear only on payment

  • Mail authentication

    SPF, DKIM, and DMARC

  • Plugin inventory

    Names and versions from the public site

  • JavaScript libraries

    jQuery, Lodash, and other dated libraries

  • Change monitor

    Alerts when the next scan drifts

  • Open API records

    Orders, customers, or settings without a login

  • Dependency manifests

    Public package, Composer, or requirements files

  • Cloud buckets

    Public listing on a linked storage URL

  • API schema

    Public Swagger, OpenAPI, or GraphQL

  • Public shell pages

    Known shell filenames that answer with a shell page

  • Admin reach

    phpMyAdmin, a hosting panel, or SSH accepts a connection

Enterprise automation

How a protected scan runs

One queue, the same order every time. The scan collects the store, then checks it against the reputation sources below.

  1. 01

    Submit the store

    Paste the homepage. The queue treats the site as a production target and starts the same pass every time.

  2. 02

    Map the surface

    Core, plugins, checkout scripts, TLS, blocklists, mail records, and public files are collected before any finding is scored.

  3. 03

    Check reputation

    The scan asks Google Web Risk, Wordfence Intelligence, AbuseIPDB, Spamhaus, SURBL, and public security DNS. A clear result means no listing was found in those sources.

  4. 04

    Deliver the report

    Findings land in the account. Signed-up users export HTML, PDF, JSON, and CSV from the same run.

Reputation sources

Checked on every security scan

Checked against Google Web Risk, Wordfence Intelligence, AbuseIPDB, Spamhaus, SURBL, and public security DNS (Quad9, Cloudflare). A listing is a hint. No listing found in these sources is not proof the site is safe.

  • Google Web Risk

    Malware and phishing lists

  • Wordfence Intelligence

    Plugin, theme, and core advisories

  • AbuseIPDB

    Address reputation

  • Quad9

    Malware-blocking DNS

  • Cloudflare

    Malware-blocking DNS

  • Spamhaus

    Domain blocklist

  • SURBL

    Spam domain list

  • Mozilla Observatory

    HTTP header grade