WordPress Penetration Testing: What It Covers and How It Works

WordPress penetration testing is a controlled, authorised attack on your WordPress site, run by a skilled tester who tries to break in the way a real criminal would. The aim is to find the weak plugins, settings and logins before someone else does, and to show you how to fix them. Most sites are not hacked through WordPress itself. They are hacked through what has been added on top.

Why does WordPress penetration testing matter?

WordPress powers a huge share of business websites, so attackers build tools for it and test them on thousands of sites at once. Patchstack, a WordPress security vendor, reported 11,334 new vulnerabilities across the ecosystem in 2025. Its report puts 91% of them in plugins and 9% in themes, with only six in WordPress core, all low priority.

That split matters. Your core install is probably fine if you update it. Your risk sits in the 20 or 30 plugins, the theme, the custom code and the people with admin accounts. The same report says the median time to first mass exploitation of the most targeted flaws was about five hours. Waiting for your monthly maintenance slot is too slow for that.

WordPress penetration testing also gives you evidence. Customers, insurers and auditors increasingly ask for it, and a clean report is easier to hand over than a promise.

What is the difference between a scan and a test?

A vulnerability scan is automated. It checks your site against a database of known issues and gives you a list. That is useful and cheap. However, it cannot tell you which findings really let an attacker in. If you want to know more about the automated side, our vulnerability scanning services page explains where it fits.

A penetration test goes further. A person chains small weaknesses together, tries to bypass logins, and checks whether a flaw can be turned into real access. The NCSC, the UK’s national cyber security body, describes the method as gaining assurance in the security of an IT system by trying to breach it with the same tools and techniques an adversary might. It also notes that a test only shows you were not vulnerable to known issues on the day of testing, so it supports your own routine patching rather than replacing it.

What does a tester look at on a WordPress site?

The scope of WordPress penetration testing varies, but a thorough engagement usually covers these areas:

• Plugins and themes: versions, known flaws, abandoned code and anything that accepts file uploads or user input.
• Authentication: login forms, password rules, two-step sign-in, password reset and user enumeration.
• Access control: whether a low-privilege user, or no user at all, can reach things they should not. Patchstack ranks broken access control as the most exploited category it tracked.
• Configuration: file permissions, exposed backups, debug files, admin paths and the wp-config file.
• Custom code: bespoke plugins, forms and integrations, which no scanner has seen before.
• Hosting and server: outdated PHP, open services and weak separation between sites on shared hosting.
• Business logic: shop checkouts, membership levels and anything that handles money or personal data.

Much of this overlaps with the WordPress weaknesses attackers check first, which is a good place to start if you want a quick self-check.

How does WordPress penetration testing work, step by step?

1. Scoping

You agree what is in and out of bounds: which domains, which environments, and whether testing happens on live or a staging copy. The NCSC advises involving risk owners, technical staff and a representative of the test team at this stage, and sharing any existing vulnerability assessment so the tester can check its accuracy.

2. Reconnaissance

The tester maps your site from the outside, then identifies the WordPress version, the theme, the plugins and their versions, and any user names that leak through the site.

3. Testing and exploitation

Now the hands-on work starts. They probe each weakness and tries to turn it into access, such as reading data, taking over an account or uploading a file that runs code. Good testers stop short of damage and agree safe limits first.

4. Reporting

You get a written report with each finding rated by risk, proof of how it works and clear fix advice. Also expect a summary for managers should sit alongside the technical detail.

5. Retesting

After you fix the issues, the tester checks that the fixes hold. Ask whether this is included in the price.

Black box, grey box or white box: which should you choose?

Every WordPress penetration testing engagement has a depth level. In a black box test the tester starts with only your web address, like an outsider. In a grey box test they get a normal user login, which shows what a customer or member could do wrong. A white box test adds admin access and often source code. For most business sites, grey box gives the best value, because it covers both the outside view and the logged-in view where many access control flaws hide.

How can you prepare your site before testing?

Good preparation makes WordPress penetration testing cheaper and more useful. You can fix the obvious problems first, which lets the tester spend their time on the harder ones. The official WordPress hardening guide is a sensible checklist:

• Keep WordPress, plugins and themes up to date. The guide warns that older versions are not maintained with security updates.
• Remove plugins and themes you do not use.
• Use strong, unique passwords and turn on two-step authentication.
• Avoid obvious user names like admin.
• Set directories to 755 and files to 644, and restrict wp-config.php to around 400 or 440.
• Switch off the built-in file editor with DISALLOW_FILE_EDIT in wp-config.php.
• Use SFTP rather than FTP, and HTTPS for logins.

Also take a full backup and tell your host about the test dates, so nobody mistakes it for an attack. If you run a shop or hold personal data, mention that up front so the tester handles it carefully.

Is a test worth it if you already use a security plugin?

A security plugin helps, but it is not a substitute for WordPress penetration testing. It blocks known patterns and cannot judge your own configuration or custom code. Patchstack’s own pentest work found that hosting defences blocked only 26% of the vulnerability attacks it tried. That is one data point from one vendor, but it fits what testers see: protective layers reduce risk without removing the need to check.

If a serious flaw lands in a plugin you use, a test cannot stop that. What it does is show how exposed you would be, and how quickly you could recover. Our write-up on the Click2Shell flaw shows the kind of checks that matter on the day.

How often should you test, and what does it cost?

Plan WordPress penetration testing at least once a year, and again after a major redesign, a new payment feature or a big plugin change. Cost depends on size and depth: a small brochure site needs far less time than a membership platform with custom code. Ask each provider how many days of testing you are buying and what the report includes. If you want a fixed quote based on your actual site, you can book a scoped test with Aardwolf Security, or get in touch to talk it through first.

Frequently asked questions

Will a test take my site down?

It should not. Careful testers avoid destructive actions and agree limits in advance. Running against a staging copy removes most of the risk.

Can I test my own WordPress site?

You can scan it and review your settings, and you should. WordPress penetration testing proper is different. It needs the skills and, if your host or any third party is involved, permission. Never test sites you do not own or have written approval to test.

Does my host already do this?

Almost never. Hosts protect their servers. They do not usually test your plugins, logins and custom code.

What happens if the tester finds something serious?

A good provider tells you straight away rather than waiting for the final report, so you can fix critical issues quickly.

Do I need to test if I only run a small blog?

A small blog with few plugins and no customer data carries less risk. A hardening checklist and prompt updates may be enough. A site that takes payments, stores personal details or sits behind a brand customers trust is a different matter.