WP-ScanTool

A fast, async WordPress plugin scanner that uses the WordPress.org API to detect installed plugins — ranked by popularity for maximum efficiency.

Features

• Popularity-ranked scanning — Checks most common plugins first for faster results
• Async concurrent requests — Blazing fast scanning with configurable concurrency
• Smart caching — Caches plugin list for 1 week to avoid repeated API calls
• CLI & programmatic usage — Use from command line or import as a Python module
• Zero configuration — Works out of the box with sensible defaults

Installation

From PyPI (when published)

pip install wp-scantool

From GitHub

pip install git+https://github.com/aminhakem/wp-scantool.git

From source

git clone https://github.com/aminhakem/wp-scantool.git
cd wp-scantool
pip install -e .

Manual (no install)

pip install aiohttp requests
python wpscan.py <target_url>

Usage

Command Line

# Scan top 1000 popular plugins (default)
wpscan http://example.com

# Scan top 5000 popular plugins
wpscan http://example.com 5000

# Scan top 10000 popular plugins (deep scan)
wpscan http://example.com 10000

As a Python Module

import asyncio
from wpscan import quick_scan, deep_scan, scan_plugins, fetch_popular_plugins

# Quick scan (top 1000 plugins)
results = asyncio.run(quick_scan("http://example.com", limit=1000))

# Deep scan (top 10000 plugins)
results = asyncio.run(deep_scan("http://example.com"))

# Custom scan with specific plugins
plugins = ["akismet", "contact-form-7", "woocommerce", "elementor"]
results = asyncio.run(scan_plugins("http://example.com", plugins))

# Just fetch the popular plugins list
plugins = fetch_popular_plugins(count=5000)

API Reference

Function	Description
quick_scan(base_url, limit=1000, concurrency=50, verbose=True)	Scan using top N popular plugins
deep_scan(base_url, limit=10000, concurrency=100, verbose=True)	Deep scan with 10K plugins
scan_plugins(base_url, plugins, concurrency=50, verbose=False)	Scan for given plugin list
fetch_popular_plugins(count=1000, verbose=True, force_refresh=False)	Fetch top N plugins from WordPress.org API
check_plugin(session, base_url, plugin, timeout=5)	Check single plugin existence

How It Works

1. Fetches popular plugins from WordPress.org API (/plugins/info/1.2/) sorted by active installs
2. Caches the list locally (refreshes after 1 week)
3. Scans target site by checking /wp-content/plugins/{plugin}/readme.txt for each plugin
4. Returns found plugins — any that return HTTP 200

Configuration

Setting	Default	Description
limit	1000	Number of plugins to check
concurrency	50	Concurrent HTTP requests
timeout	5s	Per-request timeout
cache_max_age	7 days	How long to cache plugin list

Performance

Plugins Checked	Estimated Time
1,000	~20 seconds
5,000	~1-2 minutes
10,000	~3-4 minutes

Times vary based on network conditions and target server response.

Example Output

$ wpscan http://example.com 1000

[*] Loaded 1000 plugins from cache (2.3 days old)
[*] Scanning http://example.com for 1000 popular plugins...
[*] Scan complete. Found 3 plugins.

[+] Installed plugins:
    - akismet
    - contact-form-7
    - woocommerce

Cache

The plugin list is cached to minimize WordPress.org API calls:

• Location: Same directory as wpscan.py
• Max age: 7 days (auto-refreshes after)
• Force refresh: fetch_popular_plugins(force_refresh=True)

Requirements

• Python 3.8+
• aiohttp
• requests

Legal Disclaimer

This tool is intended for authorized security testing and educational purposes only. Always ensure you have permission before scanning any website. The authors are not responsible for any misuse of this tool.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

1. Fork the repository
2. Create your feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

License

This project is licensed under the MIT License - see the LICENSE file for details.