---
prompt: run-a-security-check
title: Run a security check
description: Check four things at once: Jetpack Scan results, new administrators, recent changes and account protection.
category: Security
products: Scan, Activity log
mode: reads only
tools: scan.status, activity.get, users.list, account-protection.status
url: https://jetpack.com/prompts/run-a-security-check/
updated: 2026-10-25
---

# Run a security check

Check four things at once: Jetpack Scan results, new administrators, recent changes and account protection.

## Prompt

> Run a security check on my site. Look at my Jetpack Scan results, recent changes in my activity log, who has administrator access, and if account protection is on. Tell me what looks wrong, most serious first.

## Steps for your agent

1. Call scan.status with action "status". If the state is "unavailable", say the malware check needs Jetpack Scan, then go on.
2. Call activity.get for the last 7 days. Look for new administrators, plugins or themes added or removed, settings changes and failed logins.
3. Call users.list. List the administrators and point out any the user may not know.
4. Call account-protection.status with action "status".
5. Sum up what looks wrong, most serious first, with one next step each. Don’t change anything.

## Tools

- `scan.status` (reads only, through `wpcom-mcp-site`): Read Jetpack Scan results, if your plan has Scan.
- `activity.get` (reads only, through `wpcom-mcp-site`): Read recent changes from your activity log.
- `users.list` (reads only, through `wpcom-mcp-site`): List who can log in, and their roles.
- `account-protection.status` (reads only, through `wpcom-mcp-site`): Check if account protection is on.

Run each tool through the WordPress.com MCP server tool named next to it, with `action: "execute"`, `operation` set to the tool name, `wpcom_site` and `params`. Set `user_confirmed: true` only after the user approves a change.

## Before you start

- Free to run. The malware check needs a Jetpack plan with Scan, like Security or Complete.
- The free activity log shows the latest 20 events.
- You need to be an administrator.

## Safety

Reads only. Nothing on your site changes.