bean1352

<p>If you sell a WordPress plugin or theme to anyone in the EU, the EU Cyber Resilience Act (Regulation 2024/2847) applies to you. It does not matter where you are based or whether your product is free. Agencies distributing custom plugins or themes to EU clients are also in scope.</p>
<p>From September 11, 2026, you need a documented vulnerability reporting process, the required security documents, and a way to monitor your products for known vulnerabilities. ResilienceWP is built for WordPress developers — plugin developers, theme developers, and agencies — to cover all of that in one place.</p>
<p>Non-compliance carries fines up to EUR 15 million or 2.5% of global annual turnover. Authorities can also force non-compliant products off the EU market.</p>
<p>The free plan covers the paperwork side of compliance: checklist, five document templates, and the CRA education guide. Paid plans add automated vulnerability scanning, email alerts, the Incident Center for ENISA notification management, and downloadable compliance reports, all directly inside your WordPress admin. Pro plans also include webhook integrations for CI/CD pipelines and external tools — get real-time notifications when scans complete or vulnerabilities are found.</p>
<p>For pricing, documentation, and more details visit <a href="https://www.resiliencewp.com" rel="nofollow ugc">resiliencewp.com</a>.</p>
<h4>Compliance Checklist (Free)</h4>
<p>26 actionable items, each mapped to a specific CRA article. Five categories cover everything the regulation requires:</p>
<ul>
<li>Risk Assessment: documenting threats, attack surfaces, and mitigations</li>
<li>Secure Development: secure defaults, no known exploitable vulnerabilities at release</li>
<li>Vulnerability Handling: disclosure policy, coordinated reporting, user notification</li>
<li>Required Documentation: SBOM, Declaration of Conformity, technical file</li>
<li>Post-Market Obligations: ongoing monitoring, security updates, end-of-life policy</li>
</ul>
<p>Every item has a plain-English explanation of what it means and why it matters. Check items off as you complete them. Progress saves automatically.</p>
<h4>Document Generator (Free)</h4>
<p>Generate the five documents the CRA requires before you can legally place a product on the EU market:</p>
<ul>
<li>Vulnerability Disclosure Policy (Article 13(6)): your public process for receiving and handling security reports from researchers</li>
<li>Incident Response Plan: your internal procedure when a vulnerability is discovered or actively exploited</li>
<li>EU Declaration of Conformity: the formal self-declaration that your product meets CRA essential requirements</li>
<li>Software Bill of Materials (SBOM) (Article 13): a structured inventory of your plugin’s components, dependencies, and third-party libraries</li>
<li>security.txt: the machine-readable contact file security researchers use to reach you, placed at /.well-known/security.txt</li>
</ul>
<p>Fill in your plugin name, contact details, and a few specifics. Download in text or markdown format. No starting from scratch, no lawyer needed for the first draft.</p>
<h4>CRA Education Centre (Free)</h4>
<p>An article-by-article breakdown of Regulation (EU) 2024/2847, written for developers rather than legal teams. Understand what each obligation actually requires: what counts as “active exploitation,” what an SBOM needs to contain, what the 24-hour reporting window really means.</p>
<h4>Vulnerability Scanner (Basic and Pro)</h4>
<p>Connect your account to ResilienceWP and it monitors your plugins against the WPScan vulnerability database on a regular schedule. Weekly on Basic, daily on Pro.</p>
<p>You can monitor any plugin by its WordPress.org slug, not just the plugins currently installed on your site. If your plugin depends on WooCommerce, ACF, or any other third-party plugin, you can add those slugs directly and track vulnerabilities in your dependencies. Plugins can also be added directly from your installed plugins list.</p>
<p>The moment a new vulnerability is found, you get an email with the severity rating, CVE ID, affected version range, and fix version if one is available. Back in your WordPress admin, vulnerabilities are grouped by plugin and sorted by date discovered, so you can see at a glance which plugins have open issues and how old they are.</p>
<p>Each vulnerability card shows:</p>
<ul>
<li>Severity (Critical / High / Medium / Low / Info) with colour coding</li>
<li>CVE identifier linked directly to the NVD entry</li>
<li>The fix version (or “no fix available yet”)</li>
<li>An action hint: whether to update, acknowledge, or open an incident</li>
<li>A button to report the incident directly to the Incident Center</li>
</ul>
<p>Status tracking lets you mark vulnerabilities as Open, Acknowledged, In Progress, Resolved, or False Positive. Export the full vulnerability list as CSV for your compliance records.</p>
<h4>Incident Center (Basic and Pro)</h4>
<p>When a vulnerability in your plugin is being actively exploited, the CRA requires you to notify ENISA within 24 hours. The Incident Center tracks that deadline from the moment you log first awareness and guides you through the complete regulatory workflow.</p>
<p>Creating a new incident logs the discovery timestamp and starts all three countdown timers simultaneously:</p>
<ol>
<li>Early Warning: due within 24 hours of first awareness</li>
<li>Vulnerability Notification: due within 72 hours, with full technical details</li>
<li>Final Report: due within 14 days, including root cause and remediation steps</li>
</ol>
<p>The case view shows:</p>
<ul>
<li>Live countdown timers for each notification deadline, turning amber at 6 hours and red when overdue</li>
<li>A completeness score on your incident report so you know exactly what information is still missing</li>
<li>A “Where to Submit” section with direct links to ENISA’s reporting portal, the EU CSIRT network directory, and the CVE Programme at MITRE</li>
<li>A full audit log recording every action taken, every field updated, and every notification submitted</li>
</ul>
<p>On Pro, you can export the full incident case including all notifications and the complete audit log, formatted for submission to regulators or for your compliance archive.</p>
<h4>Dashboard and Compliance Score</h4>
<p>The dashboard gives you a live compliance score (0-100) with a transparent breakdown:</p>
<ul>
<li>-15 points per open critical vulnerability</li>
<li>-7 points per open high vulnerability</li>
<li>-3 points per open medium vulnerability</li>
<li>-20 points per overdue incident (past the 24-hour ENISA deadline)</li>
<li>-5 points per active open incident</li>
</ul>
<p>It is not a vanity metric. It is a working indicator of where you stand against your CRA obligations at any point in time, with the exact deductions shown so you know what to fix first.</p>
<h4>Compliance Reports and SBOM Export (Basic and Pro)</h4>
<p>Generate a PDF compliance report for auditors or regulators covering your vulnerability history, resolution timeline, and document status. Export your Software Bill of Materials in standard format, as required by CRA Article 13.</p>
<h4>Webhook Integrations (Pro)</h4>
<p>Connect ResilienceWP to your CI/CD pipeline, Slack, or any external tool with webhook callbacks. Configure webhook endpoints in Settings and receive real-time HTTP POST notifications with HMAC-SHA256 signed payloads when:</p>
<ul>
<li>A scheduled or manual scan completes</li>
<li>A new vulnerability is found in one of your monitored plugins</li>
</ul>
<p>Each webhook delivery is logged with status codes and response data, so you can debug integration issues directly from your WordPress admin. Manage up to 5 webhook endpoints per account, toggle them on and off, and filter by event type.</p>
<h4>Who needs to comply</h4>
<ul>
<li>Commercial plugin developers: selling to EU customers through any channel (your site, Envato, direct) makes you the manufacturer under the CRA</li>
<li>WordPress agencies: distributing custom-built plugins to EU clients, even for a single client, counts as placing a product on the market</li>
<li>Freemium developers: having a free version does not exempt you; any commercial activity tied to the product brings you in scope</li>
<li>Theme developers: themes with shortcodes, API integrations, or custom post types may qualify as “products with digital elements”</li>
</ul>
<h4>Key dates</h4>
<ul>
<li>10 December 2024: CRA entered into force. Transition period began.</li>
<li>11 September 2026: Vulnerability and incident reporting obligations apply.</li>
<li>11 December 2027: Full CRA application. All requirements in effect.</li>
</ul>
<h4>Source Code</h4>
<p>The admin dashboard is built with React and compiled using Vite. The uncompiled source is included in the plugin ZIP under admin/src/. To rebuild from source:</p>
<ol>
<li>Install Node.js 20+ and pnpm 10+</li>
<li>Run <code>pnpm install</code> in the plugin directory</li>
<li>Run <code>pnpm build</code> to recompile the admin dashboard</li>
</ol>
<h4>External Services</h4>
<p><strong>ResilienceWP API</strong> (https://api.resiliencewp.com)<br />
Used for API key verification, vulnerability scanning, incident management, and report generation. Data sent: API key, WordPress site URL, plugin slugs and versions.<br />
<a href="https://www.resiliencewp.com/terms" rel="nofollow ugc">Terms of Service</a> | <a href="https://www.resiliencewp.com/privacy" rel="nofollow ugc">Privacy Policy</a></p>
<p><strong>WPScan</strong> (via ResilienceWP API)<br />
Plugin vulnerability data is sourced from the WPScan database. Plugin slugs are sent through the ResilienceWP API. No personal data is sent from your WordPress installation directly to WPScan.<br />
<a href="https://wpscan.com/terms" rel="nofollow ugc">WPScan Terms</a> | <a href="https://wpscan.com/privacy" rel="nofollow ugc">WPScan Privacy Policy</a></p>
<p><strong>Paddle</strong> (payments)<br />
Subscription payments are processed by Paddle as merchant of record. Payment data is handled entirely by Paddle and never passes through our servers.<br />
<a href="https://www.paddle.com/legal/terms" rel="nofollow ugc">Paddle Terms</a> | <a href="https://www.paddle.com/legal/privacy" rel="nofollow ugc">Paddle Privacy</a></p>


Resilience Compliance Manager

CRA compliance for WordPress developers. Checklist, document generator, vulnerability scanner, and incident reporting for the 2026 EU deadline.

Adam W. Warner

Logan Kipp

SiteLock

tlow

<blockquote>
<p><strong>🌟 Completely redesigned in Version 5.0 — now even stronger with 2FA in 5.1 🌟</strong></p>
<p>The SiteLock WordPress plugin was recently rebuilt with three goals: make it faster, make it clearer and move the heavy work to the cloud. We built a cloudfirst architecture, modernized UI, expanded security controls and stripped out everything that didn’t need to be there. Our latest 5.1 release builds on that foundation with TwoFactor Authentication (2FA) to strengthen login security and give you tighter control over access.</p>
<p><strong>The big changes:</strong><br />
  – 🔒 Enhanced WordPress-specific hardening and login security controls<br />
  – ☁️ Cloud-powered scanning architecture for zero performance impact<br />
  – 🩺 New Site Health interface that shows you what matters in one view<br />
  – ⚡ Streamlined controls (fewer clicks to get protected)<br />
  – ✨ Modern codebase built for the WordPress you’re actually using today<br />
  – 🔢 Two-Factor Authentication (2FA) now available for stronger login protection</p>
<p>If you used the old plugin: this is a different tool. If you’re new: you’re starting with the cleanest, fastest version of the plugin.</p>
</blockquote>
<p>Your website deserves protection that’s simple, fast and built for WordPress. SiteLock WordPress Security focuses on the everyday controls that matter most and helps you establish a secure baseline in minutes — WordPress-specific hardening, login protection with Two-Factor Authentication (2FA) and a clear Site Health dashboard that keeps you in control without slowing your site down. It’s lightweight, action-first protection that complements your host defenses: essential safeguards run inside WordPress while deeper checks happen securely in the SiteLock cloud. Skip heavy on-server scans and alert fatigue — run on-demand checks when you need extra assurance, so you can ship updates with confidence.</p>
<h4>Security that grows with you</h4>
<p>Our goal is straightforward: maintain a strong baseline with minimal overhead while giving you clear visibility and room to grow as your needs evolve.<br />
And because security is never static, this plugin keeps pace. Two-Factor Authentication (2FA) is now available to strengthen login security with an extra layer of protection.</p>
<h4>Commercial plugin</h4>
<p>This plugin is free but offers additional paid commercial upgrades or support.</p>
<h3>What’s included</h3>
<h4>WordPress Hardening: Cut common attack paths in just a few clicks</h4>
<ul>
<li>Disable directory listing</li>
<li>Restrict PHP execution in upload folders</li>
<li>Limit unsafe script types</li>
<li>Force strong configuration defaults to close risky gaps</li>
</ul>
<p><em>All options are toggle-based and reversible — safe to enable, easy to test and lightweight on performance.</em></p>
<h4>Login Security: Protect what matters most — your access</h4>
<ul>
<li><strong>Two-Factor Authentication (2FA)</strong>: Add a second layer of verification to protect admin access</li>
<li><strong>Brute-force defense</strong>: Blocks repeated failed logins and temporarily locks abusive IPs</li>
<li><strong>Password policy prompts</strong>: Encourage stronger credentials without breaking workflows</li>
<li><strong>Session timeouts</strong>: Automatically end idle sessions to prevent account hijacks</li>
<li><strong>Activity awareness</strong>: View recent logins and admin changes in the <strong>Activity Log</strong></li>
</ul>
<h4>Site Health & Cloud Checks: Clarity without noise</h4>
<ul>
<li><strong>Site Health Dashboard</strong>: Surface key signals in one view — WordPress hardening status, last scan timestamp and actionable indicators</li>
<li><strong>Cloud Checks</strong>: Connect your free SiteLock account to enable recurring off-server checks (Webpage Scan, SSL Verification, Email Reputation and more)</li>
<li><strong>Scan Now</strong>: Run on-demand checks after updates or changes for instant assurance — no heavy, always-on local scanners</li>
<li><strong>Activity Log</strong>: Track what’s happening across your WordPress admin. See admin/login events at a glance making it easy to spot anomalies early and keep accountability clear</li>
</ul>
<h4>Why Choose SiteLock WordPress Security?</h4>
<ul>
<li><strong>Lightweight by design</strong>: All high-impact protections, no unnecessary load</li>
<li><strong>Real visibility</strong>: Know your security posture in seconds with Site Health</li>
<li><strong>Cloud-powered assurance</strong>: Checks run off-server, protecting performance</li>
<li><strong>Flexible setup</strong>: Use standalone or connect a SiteLock account for added layers</li>
<li><strong>Strong login protection</strong>: Two-Factor Authentication (2FA) alongside brute-force defense and session controls</li>
<li><strong>Trusted heritage</strong>: From the global leader in SMB website security backed by continuous innovation and research</li>
<li><strong>Aligned to WordPress</strong>: Designed to stay out of your way and keep performance priorities intact</li>
</ul>
<h4>Who It’s For</h4>
<ul>
<li>Small businesses & startups</li>
<li>Portfolio & personal brand sites</li>
<li>WooCommerce shops & small e-commerce</li>
<li>Agencies & website maintenance services</li>
<li>Freelance developers & web designers</li>
<li>Bloggers, creators & publishers</li>
<li>Community & membership sites</li>
<li>Nonprofits & educational sites</li>
</ul>
<p><em>If you manage a WordPress website, SiteLock gives you confidence and control whether you run one site or hundreds.</em></p>
<h4>Can I Fix an Already-Infected Site with This Plugin?</h4>
<p>The plugin focuses on prevention, posture and visibility — not full malware removal. It isn’t designed to fully clean up sites that were infected before it was active.<br />
If your site is already compromised, act quickly, we recommend:</p>
<ul>
<li>Restoring from a clean backup if available</li>
<li>Remove malicious files manually or with professional help</li>
<li>For urgent assistance, consider <a href="https://www.sitelock.com/products/fix-hacked-site/" rel="nofollow ugc">SiteLock 911 – Emergency Malware Removal</a> for rapid cleanup</li>
<li>For ongoing defense, consider <a href="https://www.sitelock.com/pricing/" rel="nofollow ugc">choosing a comprehensive SiteLock plan</a></li>
</ul>
<h4>Don’t Know Where To Start? Try This</h4>
<p>Here are common first moves teams take with SiteLock. Order isn’t enforced — choose what fits your site and workflow:</p>
<ul>
<li>Enable WordPress hardening that matches your hosting and theme setup</li>
<li>Turn on Login Security controls: brute-force lockouts, session timeouts, and password-hygiene prompts</li>
<li>Connect a free SiteLock account, then use Scan Now to run an on-demand check after plugin/theme updates</li>
<li>Review the Activity Log after major changes to spot unexpected admin/login events quickly<br />
Make one change at a time, validate and roll back any toggle that conflicts with your stack.</li>
</ul>
<h4>Need Help with Setup or Fixes?</h4>
<ul>
<li>Visit <a href="https://www.sitelock.com/help-center/?topics=wordpress-plugin" rel="nofollow ugc">Help Center – WordPress</a> for plugin specific help</li>
<li>For broader topics explore the <a href="https://www.sitelock.com/help-center/" rel="nofollow ugc">SiteLock Help Center</a></li>
</ul>
<h4>Security</h4>
<p>Protecting our customers and systems is a top priority, and we take security very seriously. If you believe you’ve found a security vulnerability in the SiteLock WordPress plugin, please let us know at vuln-reporting@sitelock.com before sharing any details publicly.</p>


SiteLock Security – WP Hardening, Login Security & Malware Scans

Free, lightweight WordPress security. Harden your site with login protection & 2FA, see Site Health clearly and run on-demand checks—setup in minutes.

Resilience Compliance Manager vs SiteLock Security – WP Hardening, Login Security & Malware Scans