WPSec is a remote scanner that checks WordPress sites for vulnerable plugins, themes, outdated core, and exposed files. It answers a narrow, useful question: is this WordPress install exposed? Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams, with patching, security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance built into the same agent and console. It is not a WordPress scanner. Its free Scout scanner maps your whole external attack surface, and the Lavawall® platform adds endpoint, Microsoft 365, and compliance coverage a CMS scan cannot see.
Where Lavawall® wins
Scout scans the whole external footprint of a domain (subdomains, TLS, exposed services, and the SPF, DKIM, and DMARC records that decide whether attackers can spoof you) on any stack, WordPress or otherwise.
Continuous monitoring re-checks your posture on a schedule and alerts when a new asset appears or a setting regresses.
Microsoft 365, Entra ID, Azure, and Google Workspace breach detection with endpoint correlation, well beyond a single site's CMS.
GRC compliance evidence across 70+ frameworks, so your posture becomes auditable control coverage.
Multi-tenant and white-label, so an MSP can run branded scans for every client from one console.
Where WPSec wins
Deep, WordPress-specific vulnerability detection: plugin, theme, and core CVEs, and common WordPress misconfigurations.
Purpose-built reporting for agencies and site owners who manage many WordPress installs.
Fast, focused answer when the site in question is WordPress and CMS-level vulnerabilities are the concern.
Lavawall vs WPSec: feature comparison
| Feature | Lavawall® (Scout + platform) | WPSec |
|---|---|---|
| WordPress plugin / theme / core CVE scan | No, not a WordPress scanner | Yes, this is its focus |
| Domain and subdomain discovery | Yes | Check WPSec’s documentation |
| SPF / DKIM / DMARC assessment | Yes | Check WPSec’s documentation |
| TLS and exposed-service checks | Yes | Check WPSec’s documentation |
| Continuous monitoring and alerting | Yes | Scheduled site scans |
| Microsoft 365 / Google Workspace breach detection | Yes | Check WPSec’s documentation |
| GRC framework evidence (CMMC, NIST, SOC 2, PCI, HIPAA) | 70+ frameworks | Check WPSec’s documentation |
| Endpoint patching and configuration monitoring | Yes | Check WPSec’s documentation |
| Multi-tenant, white-label MSP console | Yes | Agency reporting |
| Free tier | Yes, two domains free forever | Yes, limited free scan |
Who should pick which?
Pick Lavawall® if…
You are an MSP or lean IT team and want your whole external attack surface watched across every stack, not one WordPress site scanned.
You need the outside view joined to endpoint and Microsoft 365 security and to compliance evidence, from one console.
You want a free, white-label scan to show prospects their own exposure.
Pick WPSec if…
Your concern is specifically WordPress: plugin, theme, and core vulnerabilities on the sites you manage.
You want a focused CMS scanner and agency-style reporting for many WordPress installs.
Frequently asked
- Does Lavawall® replace WPSec?
- No, not for WordPress scanning. If your need is scanning a WordPress site for vulnerable plugins, themes, and core files, WPSec is purpose-built for that and Lavawall® is not a WordPress scanner. Scout maps the wider attack surface, and the platform covers endpoints, Microsoft 365, and compliance that a CMS scan never touches.
- Does Lavawall® scan websites at all?
- Yes, from the outside. Scout assesses your internet-facing exposure (domains, subdomains, TLS, open services, and email authentication) rather than crawling a WordPress install for plugin-level CVEs. The two answer different questions and can be used together.
- Is Scout free like WPSec's basic scan?
- Yes. Two domains scan free, forever, with Scout. Paid tiers add continuous monitoring, more domains, and the full endpoint, Microsoft 365, and GRC platform.