Free tool · no signup

WordPress version checker: is your site insecure?

Check a website address, or type the WordPress version you run. You see whether wordpress.org marks that version as the latest, outdated or insecure, how far behind it is, and what to update to.

By the Bug Circuit security team · Last updated November 5, 2026

Which WordPress version is a site running, and is it safe? Enter the address or the version. The tool reads the version the site announces and checks it against wordpress.org’s live list, where every release is marked latest, outdated or insecure.

How it works

How the check works

In address mode the tool loads your home page once, like a browser. WordPress prints its version in a generator tag, and core scripts and styles carry it in their links (for example style.min.css?ver=7.1.4). If the home page hides both, the tool tries the RSS feed, which names the generator, and then readme.html, which stock installs leave public. It makes no other requests and changes nothing.

The version is then compared with wordpress.org. Its stable-check list marks every release ever published as latest, outdated (behind but with no known security hole) or insecure (a security release came after it). The version-check feed gives the current release and the PHP and MySQL it needs. Both are read live and cached for an hour.

Reading the result

Insecure is the one that matters. It means a security fix shipped after your version, and attackers scan for sites that have not taken it. Minor updates inside a branch (7.1.3 to 7.1.4) are designed to be safe, so take them straight away. Outdated means you are behind the current release without a known hole: update at the next maintenance window and turn on automatic minor updates.

The tool only judges WordPress core. Most WordPress break-ins come through plugins, themes and weak passwords, which this check cannot see. A current core with an abandoned plugin is still exposed. Only check sites you own or manage.

Worked examples

An insecure release

Type 7.1.3

WordPress 7.1.3 is insecure: update now.
Current release 7.1.4. 1 release behind on the 7.1 branch.

Result on 5 Nov 2026. A security release (7.1.4, 28 Oct 2026) came after 7.1.3, so wordpress.org marks it insecure.

An old branch

Type 6.4.2

WordPress 6.4.2 is insecure: update now.
Current release 7.1.4. Several security releases on the 6.4 branch came after it.

Back up, then update. A jump across major versions is normally fine for core, but test plugins and the theme on a staging copy first.

A site that hides its version

Enter an address with the generator tag removed

WordPress is in use, but its version is not visible.
Find it under Dashboard, Updates, then use the version box.

Hiding the version is a reasonable hardening step. It does not replace updating.

Frequently asked questions

How do I find out what WordPress version my site uses?

Enter the address above. If the site announces its version, you get it at once. Otherwise log in and look under Dashboard, Updates, or at the bottom right of any admin page.

What does insecure mean on wordpress.org?

A later release on your branch fixed at least one security issue. wordpress.org marks every older release insecure from then on. The fix is the next minor update, which is quick and designed to be safe.

What is the latest WordPress version?

The tool shows the live current release from wordpress.org. As of 5 Nov 2026 it is 7.1.4, released on 28 Oct 2026, and the 7.0 branch has 7.0.8 from the same day.

Is it safe to update WordPress core?

Minor updates inside a branch are designed to be safe and can install automatically. Major updates can change behaviour, so back up first and test plugins and your theme. The security fix is usually in the minor update you can take today.

My version is current. Am I safe?

Core is one part. Plugins, themes, admin passwords, file permissions and your host matter as much. The WordPress security checklist on this site covers the rest.

Is it safe to run this on my site?

Yes. In address mode it loads your home page once, and at most the feed and readme.html. In version mode no site is contacted at all.

Keep reading

WordPress Security ChecklistThe checks that matter for a WordPress site.wp-config Hardening GeneratorSafer constants for wp-config.php.PHP Version CheckerIs the PHP under WordPress still supported?Security Headers CheckerGrade your site A to F.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing