Description
CYRN watches your WordPress site for known security vulnerabilities in WordPress core, your plugins and your themes. When one is found, you see what it is, how severe it is and which version fixes it, here in your WordPress admin, on your CYRN dashboard and by e-mail. When WordPress offers the fixed version, you can install it in one click, or let WordPress install security fixes automatically.
This plugin connects your site to the CYRN service. A free plan covers one site; paid plans add more sites, daily scans and PDF reports.
What the plugin does
- Connects your site to your CYRN account in a few clicks, and proves you control the site automatically (no file to upload).
- Once a day, and a few minutes after you install, update or remove a plugin or theme, sends CYRN the list of software versions on the site.
- Shows the vulnerabilities found on its admin page and in a dashboard widget.
- Updates a vulnerable plugin or theme in one click, with WordPress’s own updater, when WordPress offers the version that fixes it.
- Optional, off by default: automatic security updates. WordPress then installs, in the background, the updates that fix a known vulnerability, and only those.
What the plugin does not do
- It sends no personal data, content, settings, file paths or user accounts.
- It adds nothing to your public pages.
- CYRN cannot change, install or run anything on your site: there is no remote command. Updates only happen when an administrator clicks “Update” or turns on automatic security updates on this site, and they always come from WordPress’s usual update source, never from CYRN.
- Nothing is sent to CYRN until an administrator clicks “Connect”.
External service
This plugin relies on the CYRN service, operated by CYRN (France), at https://intel.cyrn.fr. It is only contacted after an administrator connects the site.
- When you connect, your browser is sent to
https://intel.cyrn.fr/connectwith the site’s address, where you sign in with your CYRN account (CYRN Auth) and choose the organisation. The plugin then receives a site key, and CYRN loads your home page once with a?cyrn_verify=parameter to confirm the plugin is installed on this site. - Once a day and after software changes, the plugin sends: the WordPress version, the PHP version, whether the site is a multisite, and for each installed plugin and theme its folder name (slug), version and whether it is active. The site address is sent in the request’s User-Agent.
- On the plugin page, it reads the site’s status (verification, scan dates, vulnerabilities found).
- When you disconnect or uninstall, it asks CYRN to revoke the site key.
CYRN also scans the public pages of verified sites, like any visitor would, to confirm the versions in use.
- Terms: https://cyrn.fr/conditions-generales.html
- Privacy policy: https://cyrn.fr/confidentialite.html
Screenshots
Installation
- Install “CYRN Vulnerability Monitor” from Plugins › Add New, or upload the .zip from Plugins › Add New › Upload Plugin, then activate it.
- Open CYRN Vulnerability Monitor in the admin menu and click Connect to CYRN.
- Sign in to your CYRN account (or create one, free), choose the organisation, and confirm.
- You are sent back to WordPress: the site is verified and a first scan is queued.
Your site must be served over HTTPS and be reachable from the internet.
FAQ
-
Is it free?
-
The plugin is free. The CYRN service has a free plan for one site with a weekly scan. Paid plans add more sites, daily scans, PDF reports and an API.
-
Are any features of the plugin locked behind a paid plan?
-
No. Every feature in the plugin works the same on every plan, with no trial period, quota or licence key. Plans only differ in what the CYRN service does on its side: how many sites it monitors, how often it scans them, and its PDF reports and API.
-
Can CYRN change my site?
-
No. The plugin only sends version numbers and reads your status. There is no way for CYRN to run code, change settings or install anything.
-
How do updates work?
-
Each vulnerability that has a fix gets an “Update” button when WordPress offers the fixed version. It runs the same updater as the WordPress updates screen, with the same package. If you turn on automatic security updates, WordPress installs those updates in the background (usually within 12 hours) and lists them on the plugin page. Only vulnerable components are updated, your other auto-update settings are unchanged, and nothing is downloaded from CYRN. As with any update, keep regular backups.
-
The fix is not available through WordPress yet (premium plugins usually update through their vendor), no fixed version exists yet, or the vulnerability is in WordPress itself: update WordPress from its updates screen.
-
Verification fails. What can I do?
-
The plugin page explains the reason. Most often a firewall, security plugin or page cache answers instead of WordPress. Allow requests with the
?cyrn_verify=parameter and exclude it from your cache, then click “Check again”. -
Does it slow down my site?
-
No. Nothing runs for visitors. Reports are sent in the background by WP-Cron, once a day.
-
How do I stop it?
-
Click Disconnect on the plugin page, or deactivate and delete the plugin: the site key is revoked and every setting is removed.
-
Where is the source code?
-
The plugin’s source is fully included; nothing is minified or built.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“CYRN Vulnerability Monitor” is open source software. The following people have contributed to this plugin.
Contributors
Translate “CYRN Vulnerability Monitor” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.0
- New: update a vulnerable plugin or theme in one click, from the plugin page or the dashboard widget.
- New: optional automatic security updates (off by default) that let WordPress install fixes for known vulnerabilities in the background.
- New: list of recent security updates.
1.0.0
- First release: connection with automatic ownership proof, daily inventory, vulnerabilities page and dashboard widget.