Why start with public posture on WordPress?
WordPress sites get hit constantly. Plugin drama matters, but strangers check the public stuff first: certificates, headers, DNS, email auth, exposed services.
Most site owners jump straight to plugin lists. That is backwards. Fix what the internet can already see in about 60 seconds, then worry about wp-admin hardening.
What is on the WordPress security scan checklist?
- TLS and certificate health on your primary domain.
- Security headers like HSTS, CSP, and clickjacking protections where visible.
- DNS hygiene, including dangling records and sloppy delegation.
- Email authentication with SPF, DKIM, and DMARC posture.
- Public exposure signals that should not be internet-facing.
- Reputation checks for blocklist or unsafe listings.
RedScore rolls these into one score and tells you what to fix first.
What does this checklist skip?
wp-admin reviews, plugin vulnerability databases, and authenticated penetration testing. Those are separate jobs.
This checklist is the free outside-in pass. Do it before you pay for heavier tooling.
How do I run it?
Go to /lookup, enter your live domain, and work the report top to bottom. The WordPress security scanner page explains what the outside-in pass covers.