Comparison
WordPress security plugin vs external vulnerability scanner: what each one catches
Most WordPress agencies already run a security plugin such as Wordfence, Sucuri Security or Solid Security on client sites. A common question is whether an external vulnerability scanner adds anything. It does, because the two look at a site from opposite sides. This guide explains what each one sees, what each one misses, and how to use them together on a client retainer.
Inside versus outside
A security plugin runs inside WordPress. It can read files on the server, compare core and plugin files against known-good versions, see logins and failed logins, block requests with an application firewall, and check installed plugin versions against vulnerability databases.
An external scanner runs on the internet and sees what any visitor sees: the response headers, the TLS configuration, the HTML and scripts the site serves, the files and panels that are publicly reachable, and the versions those files reveal. It needs no access to the server and works the same whether the site runs WordPress, Shopify, a static generator or a custom application.
What each one catches
| Issue | Security plugin | External scanner |
|---|---|---|
| Modified core or plugin files, malware on disk | Yes | No (only if it changes what visitors are served) |
| Brute-force logins, suspicious requests in real time | Yes (firewall, login protection) | No |
| Vulnerable plugin versions installed | Yes, from the installed list | Partly, when the version is visible from outside |
| Missing or weak security headers (HSTS, CSP, framing) | Some plugins can set headers; few report on what visitors actually receive | Yes, as delivered after the CDN and every proxy |
| TLS versions, certificate chain and expiry | No; TLS is usually terminated by the host or CDN | Yes |
Exposed backups, .git, debug logs, admin panels | Sometimes | Yes, if publicly reachable |
| Outdated JavaScript libraries served to visitors | Rarely | Yes |
| Issues outside WordPress (another app on the domain, a CDN misconfiguration) | No | Yes |
| A client-ready report of the site's external posture | Plugin dashboards and emails | Yes, the report is the deliverable |
Why the outside view matters for agencies
- The CDN and host change things. A header set by a plugin can be stripped or duplicated by Cloudflare or the host's proxy. Only an external check sees what visitors actually receive.
- A compromised site cannot vouch for itself. If an attacker has code running inside WordPress, a plugin's view can be tampered with. An external scan does not depend on the site's own code.
- Not every client site is WordPress. One scanner and one report format across the portfolio is easier to sell and to deliver.
- Clients want evidence. A dated PDF with findings, evidence and fixes is easier to put in front of a client than a plugin dashboard. See the sample report.
A routine that uses both
- Keep a reputable security plugin on each WordPress site for file integrity, login protection and the installed-plugin vulnerability check. Keep plugins and core updated; that remains the single most effective control.
- Run an external scan of each client site monthly and after significant changes: headers, TLS, exposed files, outdated front-end libraries, misconfigurations.
- Fix what the external scan finds at the right layer, usually the server or CDN rather than another plugin. The security headers cheat sheet has copy-paste configuration.
- Send the client the report and the before-and-after. The WordPress agency security assessment checklist has the full routine.
Frequently asked
Do I need an external scanner if I already use a WordPress security plugin?
Usually, yes. A plugin sees the site from inside: files, logins, installed versions. An external scanner sees what visitors receive after the host and CDN: TLS, security headers, exposed files and outdated front-end libraries. Each catches issues the other cannot.
Does ScanBastion replace Wordfence or Sucuri?
No. It does not run inside WordPress, does not scan files on the server and does not block attacks. It complements a plugin with the outside view and a client report.
Will an external scan trigger the plugin's firewall?
ScanBastion's checks are passive or non-intrusive and rate-limited, so they look like ordinary traffic. Some firewalls block requests for sensitive paths such as /wp-admin/ or /xmlrpc.php; the report lists URLs that returned 403 to the scanner rather than silently treating them as clean.
Can I check a WordPress site right now?
Yes: the free headers and TLS checker grades any site in seconds.