trgomez

Pura Vida Vulnerability Scanner checks everything installed on your site, including plugins, themes and WordPress core, against the Wordfence Intelligence vulnerability database, audits your site’s security posture, and shows you exactly what is at risk and how to fix it.
It does not invent findings. It correlates your installed software and configuration against authoritative public sources (Wordfence Intelligence, CVE/MITRE, the WordPress.org update channel) and live checks of your own server.
Security overview
The dashboard opens with an at-a-glance status table covering:
<ul>
<li>WordPress Version: OK / Warning</li>
<li>Vulnerable Plugins: OK / Critical / High / Medium</li>
<li>Missing Headers: Present / Missing / N/A (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy)</li>
<li>SSL: Valid / Expiring soon / Expired / N/A (certificate expiry)</li>
<li>DNS: OK / Issues / N/A</li>
<li>Email Security: SPF and DMARC (DKIM is selector-specific)</li>
<li>CDN/WAF: Detected / Not detected / N/A</li>
</ul>
What it does
<ul>
<li>Inventories every installed plugin, theme and the WordPress core version.</li>
<li>Matches each item and version against a continuously updated vulnerability feed.</li>
<li>Shows severity (CVSS), the CVE identifier, a description and the recommended fix for every finding.</li>
<li>Audits your configuration and lists prioritized hardening recommendations (2FA, updates, HTTPS, file editor, and more).</li>
<li>Optional scheduled scans with email alerts when new critical/high issues appear.</li>
</ul>
Data sources
<ul>
<li>Wordfence Intelligence Vulnerability Data Feed: free for personal and commercial use; includes CVE (MITRE) and CVSS information.</li>
<li>CVE (MITRE Corporation): the canonical vulnerability identifiers.</li>
<li>WordPress.org update channel: available core, plugin and theme updates.</li>
<li>Live site checks performed by the plugin: HTTP headers, SSL, DNS, SPF/DMARC and CDN/WAF.</li>
</ul>
This product includes data that may be copyrighted by Defiant Inc. (Wordfence Intelligence) and by the MITRE Corporation (CVE®); their notices are displayed alongside the relevant findings.
Developed by Pura Vida Design Studio, Open Source Security & Website Tools (https://puravidadesignstudio.com/).
<h3>External services</h3>
This plugin connects to one external service to function: the Wordfence Intelligence Vulnerability Data Feed.
Wordfence Intelligence Vulnerability Data Feed (Defiant Inc.) 
This plugin downloads the public WordPress vulnerability database from Wordfence in order to match it against the plugins, themes and core version installed on your site.
<ul>
<li>What is sent: your Wordfence Intelligence API key (in the request Authorization header) and your site’s URL (in the request User-Agent header), sent to https://www.wordfence.com/. The list of plugins and themes installed on your site is NOT transmitted; matching is performed locally on your own server.</li>
<li>When it is sent: when you run a manual scan, and when a scheduled scan runs (about once per day). The downloaded database is cached locally for 24 hours so the service is contacted at most about once per day.</li>
<li>Service terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/</li>
<li>Privacy policy: https://www.wordfence.com/privacy-policy/</li>
</ul>
The plugin also performs read-only checks against your own site for the Security Overview: a loopback HTTP request to your own home URL (to inspect response headers and detect a CDN/WAF) and DNS lookups for your own domain (to check DNS resolution and SPF/DMARC records). These query your own domain and public DNS only; no data is sent to any third party.

Pura Vida Vulnerability Scanner

Scan your plugins, themes and WordPress core against trusted vulnerability databases and get a clear, prioritized security overview.

Freemius

Lars Koudal

cleverplugins

Security Ninja helps you identify vulnerabilities and harden the security of your WordPress websites. Paired with MainWP, you can now manage and monitor all your connected sites from one central location.
This MainWP extension brings Security Ninja into your MainWP dashboard so you can manage and monitor all connected sites from one place.
Free version: Run Security Ninja’s Security Tests and Core Scanner remotely on one or more child sites. View results for all connected sites: vulnerabilities (plugins and themes), Security Tests table, Core Scanner summary, and Malware Scanner summary (last run and count when scans are available on the child site). The Security Ninja column in the MainWP Sites table shows test score and vulnerability count. The extension main page is the All Events overview (with a Pro upsell message for free users).
Pro version: Everything in Free, plus: remote Malware Scanner (included when you use “Run all security scans” or dedicated malware scan actions, on Pro child sites); unified events log with filters and search; full malware scan file list on the per-site tab; White Label bulk action to manage child site settings; Update database tables (bulk and per-site); Pro Reports tokens for Security Ninja data. Event logs and full malware details require Security Ninja Pro on child sites.
Note: 
To view event logs and scan data, your child sites must have Security Ninja Pro installed. You can still monitor free sites from the MainWP dashboard, but features like event logging only work if those sites also have premium features enabled. The “Update database tables” action requires Security Ninja 5.271 or newer on the child site. Remote IP management and enriched event details require Security Ninja 5.285+ on child sites and Security Ninja for MainWP 2.1.0+ on the dashboard.
This extension helps you save time, stay in control, and manage security across all your sites—whether you’re handling a handful or hundreds.
MainWP is an invaluable tool for those who manage multiple WordPress websites.
To combine the two, you need to install this extension on your master MainWP website.
<h3>Links and Documentation</h3>
<ul>
<li>
<a href="https://wpsecurityninja.com/mainwp/?utm_source=wordpress.org&utm_medium=referral&utm_campaign=SecNin&utm_content=plugin+repo" rel="nofollow ugc">Security Ninja for MainWP Extension Page</a>
</li>
<li>
<a href="https://wpsecurityninja.com/docs/mainwp/get-started-mainwp/?utm_source=wordpress.org&utm_medium=referral&utm_campaign=SecNin&utm_content=plugin+repo" rel="nofollow ugc">Get Started with MainWP and Security Ninja</a>
</li>
</ul>
<h3>Install the Security Ninja MainWP extension from within the MainWP dashboard</h3>
<ol>
<li>Login to your MainWP dashboard</li>
<li>Navigate to WP > Plugins</li>
<li>Search for ‘Security Ninja MainWP’</li>
<li>Install and activate the plugin</li>
</ol>
<h3>Install the Security Ninja MainWP extension manually</h3>
<ol>
<li>Download the plugin</li>
<li>Login to your MainWP dashboard</li>
<li>Navigate to WP > Plugins</li>
<li>Click Add New and then Upload Plugin</li>
<li>Browse to the file, select it and click Install Now</li>
<li>Click Activate Plugin once prompted.</li>
</ol>

Security Ninja For MainWP

See Security Ninja vulnerabilities and security test results in your MainWP dashboard.

Pura Vida Vulnerability Scanner vs Security Ninja For MainWP