Adds scheduled scans with email alerts, CSV\/PDF export, and a known-vulnerability check.<\/p>","1.0.0":"
Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3619131,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3619131,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3619131,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3619131,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.5"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[31093,272860,6464,600,6460],"plugin_category":[54],"plugin_contributors":[272861],"plugin_business_model":[],"class_list":["post-343921","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-penetration-testing","plugin_tags-scanner","plugin_tags-security","plugin_tags-vulnerability","plugin_category-security-and-spam-protection","plugin_contributors-aardwolfsec","plugin_committers-aardwolfsec"],"banners":{"banner":"https:\/\/ps.w.org\/aardwolf-security-scanner\/assets\/banner-772x250.png?rev=3619131","banner_2x":"https:\/\/ps.w.org\/aardwolf-security-scanner\/assets\/banner-1544x500.png?rev=3619131","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/aardwolf-security-scanner\/assets\/icon-128x128.png?rev=3619131","icon_2x":"https:\/\/ps.w.org\/aardwolf-security-scanner\/assets\/icon-256x256.png?rev=3619131","generated":false},"screenshots":[],"raw_content":"\n
Aardwolf Security Scanner<\/strong> runs a battery of passive, read-only checks against\nyour own WordPress site \u2014 the same low-hanging fruit a penetration tester looks\nfor first \u2014 and gives you a prioritised, plain-English list of what to fix and\nhow.<\/p>\n\n It does not<\/strong> attack your server, exploit anything, or send any data off-site.\nEvery check runs locally on your own install.<\/p>\n\n Each finding comes with a severity rating and a specific, actionable remediation.<\/p>\n\n Run scans automatically in the background (daily or weekly via WP-Cron) and get\nan email when your security posture regresses \u2014 the score drops, problems\nincrease, or a high-risk issue appears. You can also choose to be emailed after\nevery scheduled scan.<\/p>\n\n Export the latest scan as a CSV<\/strong> file, or open a clean, print-styled PDF\nreport<\/strong> that you can save or share (uses your browser's \"Save as PDF\").<\/p>\n\n This plugin is provided by Aardwolf Security<\/a>.\nAutomated checks are a great first line of defence, but they are not a\nsubstitute for a manual penetration test by a qualified assessor.<\/p>\n\n This plugin connects to one external service, the official WordPress.org Plugin API<\/strong> ( The plugin also makes loopback HTTP requests to your own site<\/em> (its own URL) to inspect response headers and check for publicly exposed files. These stay on your own server and are not sent to any third party.<\/p>\n\n\n Yes. All checks are passive and read-only. The plugin makes a few loopback HTTP\nrequests to your own site to inspect headers and exposed files, which is\nharmless. Always keep a current backup before changing configuration, as a\nmatter of good practice.<\/p><\/dd>\n No. The scanner reports findings and gives you clear, specific remediation\nsteps for each one, but the changes themselves (editing Some checks make a loopback request to your own site. If your host blocks\nloopback connections, those checks are skipped rather than failed. The result\nwill explain what to verify manually.<\/p><\/dd>\n\n<\/dl>\n\n\nWhat it checks<\/h4>\n\n
\n
admin<\/code> username, username enumeration via author archives and the REST API, insecure registration defaults, and missing login brute-force protection.<\/li>\nwp_<\/code> table prefix, and forcing HTTPS on the admin area.<\/li>\nreadme.html<\/code>, the generator meta tag, directory browsing, and sensitive files (debug logs, .git<\/code>, .env<\/code>, config backups) left in the web root.<\/li>\nX-Frame-Options<\/code>, X-Content-Type-Options<\/code>, Referrer-Policy<\/code>, Content-Security-Policy<\/code> and HSTS.<\/li>\nwp-config.php<\/code> and root directory.<\/li>\nScheduled scans & email alerts<\/h4>\n\n
Export reports<\/h4>\n\n
About Aardwolf Security<\/h4>\n\n
External services<\/h3>\n\n
https:\/\/api.wordpress.org\/plugins\/info\/1.0\/<\/code>).<\/p>\n\n\n
akismet<\/code>) is sent when a scan runs. No personal data, site content, or credentials are transmitted. Responses are cached for 24 hours to minimise requests.<\/li>\n\n
aardwolf-security-scanner<\/code> folder to \/wp-content\/plugins\/<\/code>, or install the ZIP via Plugins \u2192 Add New \u2192 Upload Plugin.<\/li>\n\n
Is it safe to run on a production site?<\/h3><\/dt>\n
Does it fix things automatically?<\/h3><\/dt>\n
wp-config.php<\/code>,\npermissions, web-server rules, settings) are yours to make.<\/p><\/dd>\nWhy does a check say \"could not complete\"?<\/h3><\/dt>\n
1.2.5<\/h4>\n\n
\n
1.2.4<\/h4>\n\n
\n
1.2.3<\/h4>\n\n
\n
1.2.2<\/h4>\n\n
\n
1.2.1<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n
1.1.1<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n