Title: Aardwolf Security Scanner Author: aardwolfsec Published: July 22, 2026 Last modified: July 25, 2026 --- Search plugins ![](https://ps.w.org/aardwolf-security-scanner/assets/banner-772x250.png?rev=3619131) ![](https://ps.w.org/aardwolf-security-scanner/assets/icon-256x256.png?rev=3619131) # Aardwolf Security Scanner By [aardwolfsec](https://profiles.wordpress.org/aardwolfsec/) [Download](https://downloads.wordpress.org/plugin/aardwolf-security-scanner.1.2.6.zip) * [Details](https://wordpress.org/plugins/aardwolf-security-scanner/#description) * [Reviews](https://wordpress.org/plugins/aardwolf-security-scanner/#reviews) * [Installation](https://wordpress.org/plugins/aardwolf-security-scanner/#installation) * [Development](https://wordpress.org/plugins/aardwolf-security-scanner/#developers) [Support](https://wordpress.org/support/plugin/aardwolf-security-scanner/) ## Description Aardwolf Security Scanner checks your WordPress site for the security problems attackers look for first. It runs a set of read-only checks, gives each finding a severity rating, and tells you how to fix it in clear language. You can run a scan on demand or on a schedule. The plugin does not attack your server or change any files, and it does not send your data anywhere. Every check runs on your own install. #### What it checks * Software updates. Outdated WordPress core, plugins and themes, plus inactive plugins and themes that still sit on disk. * Accounts and authentication. The default “admin” username, username enumeration through author archives and the REST API, risky registration defaults, and missing brute-force protection on the login form. * Configuration. The dashboard file editor, exposed debug output, missing or placeholder security keys and salts, the default “wp_” table prefix, and whether the admin area is forced over HTTPS. * Information exposure. A reachable XML-RPC endpoint, the version-leaking readme. html, the generator meta tag, directory browsing, and sensitive files such as debug logs, .git, .env and config backups left in the web root. * HTTP security headers. Missing X-Frame-Options, X-Content-Type-Options, Referrer- Policy, Content-Security-Policy and HSTS. * Transport and environment. Sites still on plain HTTP, and end-of-life PHP versions. * File permissions. World-readable or world-writable wp-config.php and site root. * Known vulnerabilities. Installed plugins that have been removed from the WordPress. org directory, which often means a plugin was pulled for an unresolved security issue. Each finding comes with a severity rating and clear steps to fix it. Every scan produces a security score out of 100 so you can track progress over time. #### Scheduled scans and email alerts Run a scan automatically once a day or once a week. The plugin can email you when the score drops, when the number of problems goes up, or when a high-risk issue appears. You can also choose to get an email after every scan. #### Export reports Save the latest scan as a CSV file, or open a clean printable report and save it as a PDF from your browser. #### About Aardwolf Security This plugin is made by [Aardwolf Security](https://aardwolfsecurity.com/). Automated checks are a good first line of defence, but they are not a replacement for a manual penetration test by a qualified tester. ### External services This plugin connects to one external service, the official WordPress.org Plugin API (https://api.wordpress.org/plugins/info/1.0/). * What it is used for: the Known Vulnerabilities check asks this API whether any of your installed plugins have been removed from the WordPress.org directory. * What data is sent, and when: the directory slug of each installed plugin (for example “akismet”) is sent when a scan runs. No personal data, site content or credentials are sent. Responses are cached for 24 hours. * Terms and privacy: this is a WordPress.org service, covered by the [WordPress.org Terms](https://wordpress.org/about/) and [Privacy Policy](https://wordpress.org/about/privacy/). The plugin also sends requests to your own site (its own URL) to inspect response headers and look for exposed files. These stay on your own server. ## Installation 1. Upload the aardwolf-security-scanner folder to /wp-content/plugins/, or install the ZIP from Plugins, Add New, Upload Plugin. 2. Activate the plugin from the Plugins screen. 3. Open Security Scanner in the admin menu and click Run Security Scan. ## FAQ ### Is it safe to run on a production site? Yes. All checks are read-only. The plugin sends a few requests to your own site to inspect headers and look for exposed files, which is harmless. Keep a current backup before you change any settings, as good practice. ### Does it fix things automatically? No. The scanner reports each problem and tells you how to fix it. You make the changes yourself, such as editing wp-config.php, adjusting file permissions, or updating settings. ### Why does a check say it could not complete? Some checks send a request to your own site. If your host blocks these requests, those checks are skipped instead of failed, and the result explains what to check by hand. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Aardwolf Security Scanner” is open source software. The following people have contributed to this plugin. Contributors * [ aardwolfsec ](https://profiles.wordpress.org/aardwolfsec/) [Translate “Aardwolf Security Scanner” into your language.](https://translate.wordpress.org/projects/wp-plugins/aardwolf-security-scanner) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/aardwolf-security-scanner/), check out the [SVN repository](https://plugins.svn.wordpress.org/aardwolf-security-scanner/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/aardwolf-security-scanner/) by [RSS](https://plugins.trac.wordpress.org/log/aardwolf-security-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.6 * Rewrote the readme in plainer language and updated the tags for the plugin directory. No functional changes. #### 1.2.5 * Printable report stylesheet is now registered and enqueued via wp_enqueue_style()/ wp_print_styles() instead of a hard-coded link tag. #### 1.2.4 * Moved the printable report’s CSS to a bundled stylesheet (no inline style tag) and removed the inline print-button script. * Removed an unnecessary wp-admin/includes/plugin.php include in the login-protection check. * Corrected the Contributors username. #### 1.2.3 * Removed the duplicate Plugin URI header (it matched the Author URI); kept the Author URI. #### 1.2.2 * Output all logos via escaped image tags for cleaner markup. * Documented the WordPress.org Plugin API usage under a new “External services” readme section. #### 1.2.1 * Resolved WordPress.org Plugin Check findings: removed the unused Domain Path header and the discouraged load_plugin_textdomain() call, rewrote the CSV export without direct filesystem functions, scoped template variables, tidied the uninstall routine, and updated “Tested up to”. #### 1.2.0 * Removed the optional WPScan API integration and the one-click hardening feature. These are planned for a future Pro add-on. The free directory-removal check, which needs no API key, remains. #### 1.1.1 * Scheduled scans now let you choose the time of day, and the day of the week for weekly scans, in your site timezone. * Fixed the oversized admin menu icon. * Failed checks now show a problem-worded title (for example “Usernames are publicly enumerable”) instead of the healthy-state wording. * The user-enumeration check now tests the live vectors (REST users endpoint and the ?author= redirect) rather than stored user data. #### 1.1.0 * Added scheduled scans (daily or weekly) with email alerts on regression. * Added CSV and printable PDF report export. * Added a Known Vulnerabilities check. * Bumped “Tested up to” and refreshed the settings screen. #### 1.0.0 * Initial release: security checks across six categories, a security score, and optional one-click hardening. ## Meta * Version **1.2.6** * Last updated **2 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.6 or higher ** * Tested up to **7.0.2** * PHP version ** 7.2 or higher ** * Tags * [hardening](https://wordpress.org/plugins/tags/hardening/)[security](https://wordpress.org/plugins/tags/security/) [security audit](https://wordpress.org/plugins/tags/security-audit/)[security scanner](https://wordpress.org/plugins/tags/security-scanner/) [vulnerability](https://wordpress.org/plugins/tags/vulnerability/) * [Advanced View](https://wordpress.org/plugins/aardwolf-security-scanner/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/aardwolf-security-scanner/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/aardwolf-security-scanner/reviews/) ## Contributors * [ aardwolfsec ](https://profiles.wordpress.org/aardwolfsec/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/aardwolf-security-scanner/)