Features
WordPress security audit software
CrawlXray is a web app. Every scan, report, cleanup and alert is run by the software, so results come in minutes and every plan is self-serve.
Outside scan
Runs from your URL in about 20 seconds. No access needed.
- WordPress and plugin versions against wordpress.org
- Installed security plugins and firewall
- Hidden links, spam links and injected scripts
- Exposed .git, .env, config backups and debug logs
- HTTPS, certificate expiry and security headers
- SPF and DMARC email records
Deep in-server scan
Connects over SSH or SFTP with a read-only key and reads every file and table.
- Plugins hidden from the WordPress dashboard
- Obfuscated PHP and JavaScript, decoded
- Card skimmers in checkout pages and the database
- Back doors, droppers and unknown admin users
- Spam posts and injected options in the database
- Tables left behind by plugins removed years ago
Developer Report
Everything a developer needs to fix the site, generated automatically.
- Exact file paths and table names
- Decoded evidence for each finding
- Step-by-step fix instructions
- PDF and Markdown export
Auto-Clean
The CrawlXray agent applies the fixes you approve, then re-scans.
- One-click quarantine, never deletion
- Injected code reverted from clean copies
- Every change logged and restorable
- Automatic re-scan to confirm
Watch
Scheduled re-scans with alerts.
- Monthly deep re-scan per site
- Email alert when anything new appears
- Report history for every site
Agency tools
For agencies that look after many WordPress sites.
- Scan every site on a hosting account at once
- One dashboard for all client sites
- Reports with your agency logo