trgomez

<p>Pura Vida Vulnerability Scanner checks everything installed on your site, including plugins, themes and WordPress core, against the <strong>Wordfence Intelligence</strong> vulnerability database, audits your site’s security posture, and shows you exactly what is at risk and how to fix it.</p>
<p>It does not invent findings. It correlates your installed software and configuration against authoritative public sources (Wordfence Intelligence, CVE/MITRE, the WordPress.org update channel) and live checks of your own server.</p>
<p><strong>Security overview</strong></p>
<p>The dashboard opens with an at-a-glance status table covering:</p>
<ul>
<li>WordPress Version: OK / Warning</li>
<li>Vulnerable Plugins: OK / Critical / High / Medium</li>
<li>Missing Headers: Present / Missing / N/A (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy)</li>
<li>SSL: Valid / Expiring soon / Expired / N/A (certificate expiry)</li>
<li>DNS: OK / Issues / N/A</li>
<li>Email Security: SPF and DMARC (DKIM is selector-specific)</li>
<li>CDN/WAF: Detected / Not detected / N/A</li>
</ul>
<p><strong>What it does</strong></p>
<ul>
<li>Inventories every installed plugin, theme and the WordPress core version.</li>
<li>Matches each item and version against a continuously updated vulnerability feed.</li>
<li>Shows severity (CVSS), the CVE identifier, a description and the recommended fix for every finding.</li>
<li>Audits your configuration and lists prioritized hardening recommendations (2FA, updates, HTTPS, file editor, and more).</li>
<li>Optional scheduled scans with email alerts when new critical/high issues appear.</li>
</ul>
<p><strong>Data sources</strong></p>
<ul>
<li>Wordfence Intelligence Vulnerability Data Feed: free for personal and commercial use; includes CVE (MITRE) and CVSS information.</li>
<li>CVE (MITRE Corporation): the canonical vulnerability identifiers.</li>
<li>WordPress.org update channel: available core, plugin and theme updates.</li>
<li>Live site checks performed by the plugin: HTTP headers, SSL, DNS, SPF/DMARC and CDN/WAF.</li>
</ul>
<p>This product includes data that may be copyrighted by Defiant Inc. (Wordfence Intelligence) and by the MITRE Corporation (CVE®); their notices are displayed alongside the relevant findings.</p>
<p>Developed by Pura Vida Design Studio, Open Source Security & Website Tools (https://puravidadesignstudio.com/).</p>
<h3>External services</h3>
<p>This plugin connects to one external service to function: the Wordfence Intelligence Vulnerability Data Feed.</p>
<p><strong>Wordfence Intelligence Vulnerability Data Feed (Defiant Inc.)</strong><br />
This plugin downloads the public WordPress vulnerability database from Wordfence in order to match it against the plugins, themes and core version installed on your site.</p>
<ul>
<li>What is sent: your Wordfence Intelligence API key (in the request Authorization header) and your site’s URL (in the request User-Agent header), sent to https://www.wordfence.com/. The list of plugins and themes installed on your site is NOT transmitted; matching is performed locally on your own server.</li>
<li>When it is sent: when you run a manual scan, and when a scheduled scan runs (about once per day). The downloaded database is cached locally for 24 hours so the service is contacted at most about once per day.</li>
<li>Service terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/</li>
<li>Privacy policy: https://www.wordfence.com/privacy-policy/</li>
</ul>
<p>The plugin also performs read-only checks against your own site for the Security Overview: a loopback HTTP request to your own home URL (to inspect response headers and detect a CDN/WAF) and DNS lookups for your own domain (to check DNS resolution and SPF/DMARC records). These query your own domain and public DNS only; no data is sent to any third party.</p>


Pura Vida Vulnerability Scanner

Scan your plugins, themes and WordPress core against trusted vulnerability databases and get a clear, prioritized security overview.

FireFart

ethicalhack3r

Erwan Le Rousseau

<p><strong>Please note:</strong> This plugin is no longer actively supported for non-enterprise customers. <strong>We recommend using <a href="https://wordpress.org/plugins/jetpack-protect/" rel="ugc">Jetpack Protect</a></strong> – a free security plugin for WordPress that leverages the extensive database of WPScan. Jetpack Protect scans your site and warns you about vulnerabilities, keeping your site one step ahead of security threats and malware.</p>
<p>The WPScan WordPress security plugin is unique in that it uses its own manually curated <a href="https://wpscan.com/" rel="nofollow ugc">WPScan WordPress Vulnerability Database</a>. The vulnerability database has been around since 2014 and is updated on a daily basis by dedicated WordPress security specialists and the community at large. The database includes more than 21,000 known security vulnerabilities. The plugin uses this database to scan for <a href="https://wpscan.com/wordpresses" rel="nofollow ugc">WordPress vulnerabilities</a>, <a href="https://wpscan.com/plugins" rel="nofollow ugc">plugin vulnerabilities</a> and <a href="https://wpscan.com/themes" rel="nofollow ugc">theme vulnerabilities</a>, and has the options to schedule automated daily scans and to send email notifications.</p>
<p>WPScan has a Free API plan that should be suitable for most WordPress websites, however, also has paid plans for users who may need more API calls. To use the WPScan WordPress Security Plugin you will need to use a free API token by <a href="https://wpscan.com/" rel="nofollow ugc">registering here</a>.</p>
<p><strong>The Free plan allows 25 API requests per day. View the different available <a href="https://wpscan.com/api" rel="nofollow ugc">API plans</a>.</strong></p>
<h4>How many API requests do you need?</h4>
<ul>
<li>Our WordPress scanner makes one API request for the WordPress version, one request per installed plugin and one request per installed theme.</li>
<li>On average, a WordPress website has 22 installed plugins.</li>
<li>The Free plan should cover around 50% of all WordPress websites.</li>
</ul>
<h4>Security Checks</h4>
<p>The WPScan WordPress Security Plugin will also check for other security issues, which do not require an API token, such as:</p>
<ul>
<li>Check for debug.log files</li>
<li>Check for wp-config.php backup files</li>
<li>Check if XML-RPC is enabled</li>
<li>Check for code repository files</li>
<li>Check if default secret keys are used</li>
<li>Check for exported database files</li>
<li>Weak passwords</li>
<li>HTTPS enabled</li>
</ul>
<h4>What does the plugin do?</h4>
<ul>
<li>Scans for known WordPress vulnerabilities, plugin vulnerabilities and theme vulnerabilities;</li>
<li>Does additional security checks;</li>
<li>Shows an icon on the Admin Toolbar with the total number of security vulnerabilities found;</li>
<li>Notifies you by mail when new security vulnerabilities are found.</li>
</ul>
<h4>Further Reading</h4>
<ul>
<li><a href="https://wpscan.com/" rel="nofollow ugc">WPScan WordPress Vulnerability Database</a></li>
<li><a href="https://wpscan.com/wordpress-security-scanner" rel="nofollow ugc">WPScan WordPress Security Scanner</a></li>
<li><a href="https://twitter.com/_wpscan_" rel="nofollow ugc">WPScan Twitter</a></li>
</ul>


WPScan – WordPress Security Scanner

One of the Must-have security plugin for WordPress Websites. Most importantly baked by Wp Scan Team, Which is in field from way too long and helping community to be safe like a pro. 

They have helped us with their deep knowledge of WordPress Security in one of our products. Their whole intention is to use their security experience to help WordPress Community to be safe. We highly recommended this plugin and whole team for any thing related to security.

Great Minds Made Great Plugin


complete garbage now, used to be amazing now they basically force you to use jetpack.  No replies trying to get enterprise license, another great product (used to be) that automattic has killed and used just for leads to jetpack


Garbage now

WPScan WordPress Security Scanner - Scans your system for security vulnerabilities listed in the WPScan Vulnerability Database.

Pura Vida Vulnerability Scanner vs WPScan – WordPress Security Scanner