WordPress can do anything, which is exactly the problem. Scan your site for the plugin bloat, known vulnerabilities and exposed endpoints that accumulate over time.
Server-rendered PHP — fast or slow entirely depending on your stack. WordPress serves real HTML, so indexability is rarely the issue. Everything that matters here is what has accumulated around it: plugins, themes, revisions, and the endpoints WordPress exposes by default and most owners never review.
WordPress is the only genuinely old platform on this list, and its failure mode is accumulation. A site that was fast and secure at launch becomes slow and vulnerable without anyone changing anything, because the plugins stood still while the vulnerability disclosures kept coming.
That makes the WordPress scan the most security-weighted of the nine. An outdated plugin with a published CVE is a materially different risk from a missing meta description, and it is the finding we most often see on sites that have been live more than a year.
The second cluster is structural SEO that WordPress creates on your behalf: author archives, date archives, tag pages and paginated loops, all generating thin URLs that compete with the content you actually wrote.
These are the launch-blockers we actually find on WordPress builds, roughly in order of how often they come back positive — each with the specific change that clears it.
Plugin vulnerabilities are disclosed publicly and then scanned for automatically, at scale, within days. An unpatched plugin is not a theoretical risk — it is the single most common way a WordPress site is compromised.
The fix: We identify the front-end libraries and versions your pages expose and cross-reference them against the OSV vulnerability database, reporting each known CVE with its severity.
WordPress generates author, date, tag and category archives by default. On a small site these are near-empty pages that duplicate your post titles and dilute which URL Google should rank.
The fix: Noindex the archive types you do not actively use, in your SEO plugin's settings. We report which archive URLs are currently indexable.
/wp-json/wp/v2/users enumerates your usernames, xmlrpc.php is a standing brute-force and amplification target, and readme.html publishes your exact WordPress version. All three are on by default and rarely needed.
The fix: We request these paths directly and report which return content, so you can restrict or remove them.
Without a cache, every visit runs PHP and queries the database to rebuild a page that has not changed. It is the difference between a sub-100ms response and a multi-second one, and it is the highest-leverage performance fix on the platform.
The fix: Add a page cache — a plugin, or better, at your host or CDN. We report your server response time so you can see the before and after.
WordPress generates resized variants but keeps serving whichever size the theme requests, and a 5MB original dropped into a post body is frequently served as-is. Old posts are where these hide.
The fix: We report your Largest Contentful Paint element with its transfer size, plus any oversized images we find on the pages we scan.
Paste your WordPress link and get a free Launch Score with your top problems.
Unlock the report for $12 (₹299 in India) — we scan every page and write the fixes for WordPress.
Paste the fixes into WordPress, say "repair it", and re-scan to confirm. Done.
The short version, if you would rather do it by hand. Everything here is something you can verify yourself in a few minutes.
Version, not vendor, is what matters. We identify the front-end libraries and versions your pages expose and cross-reference them against the OSV vulnerability database, so you get named CVEs with severities rather than a general warning to keep things updated.
Usually yes, unless something you run depends on them. /wp-json/wp/v2/users enumerates usernames, which is the first half of a brute-force attempt, and xmlrpc.php is a standing target for both brute-force and amplification. Most sites use neither.
Most often there is no page cache, so every request rebuilds the page in PHP against the database. After that it is plugin count — each one adds queries and front-end assets to every page load. We report your server response time so you can measure the difference a cache makes.
They can. On a small site they are thin pages that duplicate your post titles and split the signal about which URL should rank. Noindexing the archive types you do not actively use is a standard cleanup, done in your SEO plugin.
The free Launch Score covers your home page with no signup. The full vulnerability cross-reference, exposed-endpoint probes and all-pages crawl are in the paid report, from $12 (₹299 in India).