trgomez

<p>Pura Vida Vulnerability Scanner checks everything installed on your site, including plugins, themes and WordPress core, against the <strong>Wordfence Intelligence</strong> vulnerability database, audits your site’s security posture, and shows you exactly what is at risk and how to fix it.</p>
<p>It does not invent findings. It correlates your installed software and configuration against authoritative public sources (Wordfence Intelligence, CVE/MITRE, the WordPress.org update channel) and live checks of your own server.</p>
<p><strong>Security overview</strong></p>
<p>The dashboard opens with an at-a-glance status table covering:</p>
<ul>
<li>WordPress Version: OK / Warning</li>
<li>Vulnerable Plugins: OK / Critical / High / Medium</li>
<li>Missing Headers: Present / Missing / N/A (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy)</li>
<li>SSL: Valid / Expiring soon / Expired / N/A (certificate expiry)</li>
<li>DNS: OK / Issues / N/A</li>
<li>Email Security: SPF and DMARC (DKIM is selector-specific)</li>
<li>CDN/WAF: Detected / Not detected / N/A</li>
</ul>
<p><strong>What it does</strong></p>
<ul>
<li>Inventories every installed plugin, theme and the WordPress core version.</li>
<li>Matches each item and version against a continuously updated vulnerability feed.</li>
<li>Shows severity (CVSS), the CVE identifier, a description and the recommended fix for every finding.</li>
<li>Audits your configuration and lists prioritized hardening recommendations (2FA, updates, HTTPS, file editor, and more).</li>
<li>Optional scheduled scans with email alerts when new critical/high issues appear.</li>
</ul>
<p><strong>Data sources</strong></p>
<ul>
<li>Wordfence Intelligence Vulnerability Data Feed: free for personal and commercial use; includes CVE (MITRE) and CVSS information.</li>
<li>CVE (MITRE Corporation): the canonical vulnerability identifiers.</li>
<li>WordPress.org update channel: available core, plugin and theme updates.</li>
<li>Live site checks performed by the plugin: HTTP headers, SSL, DNS, SPF/DMARC and CDN/WAF.</li>
</ul>
<p>This product includes data that may be copyrighted by Defiant Inc. (Wordfence Intelligence) and by the MITRE Corporation (CVE®); their notices are displayed alongside the relevant findings.</p>
<p>Developed by Pura Vida Design Studio, Open Source Security & Website Tools (https://puravidadesignstudio.com/).</p>
<h3>External services</h3>
<p>This plugin connects to one external service to function: the Wordfence Intelligence Vulnerability Data Feed.</p>
<p><strong>Wordfence Intelligence Vulnerability Data Feed (Defiant Inc.)</strong><br />
This plugin downloads the public WordPress vulnerability database from Wordfence in order to match it against the plugins, themes and core version installed on your site.</p>
<ul>
<li>What is sent: your Wordfence Intelligence API key (in the request Authorization header) and your site’s URL (in the request User-Agent header), sent to https://www.wordfence.com/. The list of plugins and themes installed on your site is NOT transmitted; matching is performed locally on your own server.</li>
<li>When it is sent: when you run a manual scan, and when a scheduled scan runs (about once per day). The downloaded database is cached locally for 24 hours so the service is contacted at most about once per day.</li>
<li>Service terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/</li>
<li>Privacy policy: https://www.wordfence.com/privacy-policy/</li>
</ul>
<p>The plugin also performs read-only checks against your own site for the Security Overview: a loopback HTTP request to your own home URL (to inspect response headers and detect a CDN/WAF) and DNS lookups for your own domain (to check DNS resolution and SPF/DMARC records). These query your own domain and public DNS only; no data is sent to any third party.</p>


Pura Vida Vulnerability Scanner

Scan your plugins, themes and WordPress core against trusted vulnerability databases and get a clear, prioritized security overview.

Amrit Anandh

Kuppuraj

revmakx

<h3>Instant protection against disclosed vulnerabilities</h3>
<p><a href="https://defendwp.org/" rel="nofollow ugc">DefendWP.org</a> is a WordPress plugin that protects your website from hackers exploiting vulnerable code on your website. Security research companies discover vulnerabilities and notify plugin developers to patch them. After some time, they disclose the vulnerability to the public, allowing you to update your plugins. However, this system has flaws. Once vulnerabilities are publicly disclosed, hackers rush to exploit the sites in which you haven’t yet applied the patch.</p>
<h4>A Better Approach: Immediate Protection for All Users</h4>
<p>To solve this, our plugin pushes firewall rules and patches as soon as vulnerabilities are disclosed, ensuring websites are protected without waiting for an official patch. This protection is silent and automatic, ensuring that you are not affected even if you don’t take any immediate action.</p>
<ol>
<li>Immediate Patches Upon Disclosure: When vulnerabilities are disclosed, our plugin pushes patches or firewall rules that prevent exploitation.</li>
<li>Silent Protection: We operate in the background, allowing plugin developers to roll out patches at their own pace without compromising user security.</li>
<li>Free and Accessible: Security should not be a privilege. Our plugin is free and accessible and ensures that all WordPress users are protected from newly disclosed vulnerabilities.</li>
</ol>
<h3>Protecting Everyone, Not Just the Privileged Few</h3>
<p>Security should not be reserved for those who can afford premium services. The spirit of WordPress is inclusivity, and this should extend to security as well. When vulnerabilities are disclosed, they pose a risk to every website, regardless of its owner’s resources. Every WordPress user should have access to immediate protection.</p>
<p>Security researchers play a vital role in identifying vulnerabilities, but the current system leaves too many users exposed. Our approach aims to create a safer WordPress ecosystem for all, by closing the gap between vulnerability disclosure and patching.</p>
<p>This isn’t about taking credit—it’s about prioritizing the safety of small business owners, bloggers, and entrepreneurs who rely on WordPress. By silently closing the vulnerability gap, we aim for a future where WordPress security is accessible to everyone.</p>
<p>Let’s build a safer WordPress ecosystem together—one that protects all users, not just the privileged few.</p>
<h4>For plugin authors: Report a Vulnerability</h4>
<p>Do you have an active vulnerability in your plugin you want to safeguard users from? Report it <a href="https://defendwp.org/submit-a-vulnerability/" rel="nofollow ugc">here</a></p>
<h4>Support</h4>
<p>Need help with your website’s security? Just send us an email at <a href="mailto:help@defendwp.org" rel="nofollow ugc">help@defendwp.org</a>.</p>
<h4>Note</h4>
<p>This plugin utilizes the <a href="https://api.ipify.org?format=json" rel="nofollow ugc">Ipify.org</a> to provide enhanced functionality. The API allows the plugin to retrieve the exact IP of the current user, which will be used to determine whether the user can access the WordPress site.<a href="https://ipify.org" rel="nofollow ugc">Privacy policy</a></p>
<p>Vulnerabilities, IPs, Plugins and Themes data will be sent between <a href="https://defendwp.org" rel="nofollow ugc">DefendWP.org</a> and the WP site to instantly patch from vulnerabilities.</p>


DefendWP Firewall

Get instant protection against vulnerabilities disclosed by security companies.

Pura Vida Vulnerability Scanner vs DefendWP Firewall