{"id":396113,"date":"2026-11-06T08:45:01","date_gmt":"2026-11-06T08:45:01","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/shieldome-security-scanner\/"},"modified":"2026-11-06T10:50:25","modified_gmt":"2026-11-06T10:50:25","slug":"shieldome-scanner","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/shieldome-scanner\/","author":23596165,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.3.0","stable_tag":"1.3.0","tested":"7.1.4","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Shieldome Security Scanner","header_author":"Shieldome","header_description":"Scan your WordPress site for vulnerabilities from the WP admin dashboard.","assets_banners_color":"2b2c30","last_updated":"2026-11-06 10:50:25","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/app.shieldome.com\/wordpress-plugin","header_author_uri":"https:\/\/shieldome.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":224,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.2.1":{"tag":"1.2.1","author":"nemanjashieldome","date":"2026-11-06 08:44:30","revision":3787488},"1.3.0":{"tag":"1.3.0","author":"nemanjashieldome","date":"2026-11-06 10:50:25","revision":3787713}},"upgrade_notice":{"1.3.0":"<p>Verify your site in one click to unlock Shieldome&#039;s active checks.<\/p>","1.2.0":"<p>Alerts for newly published vulnerabilities in your installed plugins, between scans.<\/p>","1.1.0":"<p>Every installed plugin and theme is now checked against known vulnerabilities, not only those visible from outside.<\/p>","1.0.1":"<p>Fixes scans not starting or completing. Update required for the plugin to function.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3787488,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3787488,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3787488,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3787488,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.1","1.3.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3787713,"resolution":"1","location":"assets","locale":"","width":1280,"height":760},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3787713,"resolution":"2","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"The Shieldome page in wp-admin: security grade, risk score, last scan and a one-click scan","2":"Settings: API key, target URL, the plugin list option and one-click site verification"}},"plugin_section":[],"plugin_tags":[287560,600,8642,139069],"plugin_category":[54],"plugin_contributors":[291107],"plugin_business_model":[],"class_list":["post-396113","plugin","type-plugin","status-publish","hentry","plugin_tags-owasp","plugin_tags-security","plugin_tags-security-audit","plugin_tags-vulnerability-scanner","plugin_category-security-and-spam-protection","plugin_contributors-nemanjashieldome","plugin_committers-nemanjashieldome"],"banners":{"banner":"https:\/\/ps.w.org\/shieldome-scanner\/assets\/banner-772x250.png?rev=3787488","banner_2x":"https:\/\/ps.w.org\/shieldome-scanner\/assets\/banner-1544x500.png?rev=3787488","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/shieldome-scanner\/assets\/icon-128x128.png?rev=3787488","icon_2x":"https:\/\/ps.w.org\/shieldome-scanner\/assets\/icon-256x256.png?rev=3787488","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/shieldome-scanner\/assets\/screenshot-1.png?rev=3787713","caption":"The Shieldome page in wp-admin: security grade, risk score, last scan and a one-click scan"},{"src":"https:\/\/ps.w.org\/shieldome-scanner\/assets\/screenshot-2.png?rev=3787713","caption":"Settings: API key, target URL, the plugin list option and one-click site verification"}],"raw_content":"<!--section=description-->\n<p>Shieldome Security Scanner brings automated vulnerability scanning into your WordPress dashboard. Instead of leaving wp-admin to run a security check, trigger an OWASP Top 10:2025 scan of your site and see the result - security grade, risk score, and findings - right where you already work.<\/p>\n\n<h4>What it checks<\/h4>\n\n<ul>\n<li>Exposed configuration and backup files<\/li>\n<li>Outdated WordPress core, themes, and plugins with known vulnerabilities<\/li>\n<li>XML-RPC exposure and brute-force attack surface<\/li>\n<li>Missing or misconfigured security headers<\/li>\n<li>SSL\/TLS certificate validity and configuration<\/li>\n<li>Debug information and verbose error disclosure<\/li>\n<li>User enumeration via author archives<\/li>\n<li>OWASP Top 10:2025 checks - the same engine used by the Shieldome SaaS platform<\/li>\n<\/ul>\n\n<h4>How it works<\/h4>\n\n<p>This plugin does not scan your site locally - it calls the Shieldome API (app.shieldome.com) to run the scan and reports the result back to your dashboard. <strong>Using it requires a Shieldome account and an active plan<\/strong> (a free trial is available at signup); the plugin itself is free, but the scanning service it connects to is a paid SaaS product beyond the trial period. See <a href=\"https:\/\/shieldome.com\">shieldome.com<\/a> for current plans.<\/p>\n\n<h4>Data sent to Shieldome<\/h4>\n\n<p>When you trigger a scan, this plugin sends your configured target URL to the Shieldome API (app.shieldome.com) for scanning, authenticated with the API key you provide in Settings. Unless you turn it off in Settings, it also sends the list of installed plugins and themes (slug, version, active or not) and the WordPress version, with each scan and once a day (see External services below). When you click \"Verify this site\" in Settings, it sends this site's home URL to Shieldome and publishes a one-time verification token (see External services). No posts, pages, users, comments or settings are transmitted; the scan metadata (status, grade, risk score) is sent back. See the <a href=\"https:\/\/shieldome.com\/privacy\">Shieldome Privacy Policy<\/a> for details on how scan data is handled.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin is the dashboard for the Shieldome scanning service (https:\/\/shieldome.com) and does nothing without it. It connects to the Shieldome API at https:\/\/app.shieldome.com\/api:<\/p>\n\n<ul>\n<li>When you click \"Start Security Scan\": it sends the target URL and your Shieldome API key, and, unless you turn it off in Shieldome &gt; Settings, the list of installed plugins and themes (slug, version, active or not) and the WordPress version. While the scan runs it asks the API for the scan status.<\/li>\n<li>Once a day (WP cron), when an API key is set and the plugin list option is on: the site URL and the same list of plugins, themes and WordPress version, so Shieldome can alert you to newly published vulnerabilities in them.<\/li>\n<li>When you click \"Verify this site\" in Shieldome &gt; Settings: this site's home URL and your API key. Shieldome replies with a one-time token, which the plugin publishes at the public REST route <code>\/?rest_route=\/shieldome\/v1\/verify<\/code> (it returns only that token, and 404 when no verification is pending). Shieldome then requests that route from your site once to confirm you control it, and the plugin deletes the token when the site is verified.<\/li>\n<\/ul>\n\n<p>No posts, pages, users, comments or settings are sent. Shieldome then scans the target URL from its own servers, as an outside visitor would.<\/p>\n\n<p>Shieldome terms of service: https:\/\/shieldome.com\/terms\nShieldome privacy policy: https:\/\/shieldome.com\/privacy<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to <code>\/wp-content\/plugins\/shieldome-scanner<\/code>, or install directly through the WordPress plugins screen.<\/li>\n<li>Activate the plugin through the 'Plugins' screen in WordPress.<\/li>\n<li>Go to <strong>Shieldome \u2192 Settings<\/strong> and enter your Shieldome API key (get one at <a href=\"https:\/\/app.shieldome.com\/account\">app.shieldome.com\/account<\/a> - sign up for a free trial if you don't have an account yet).<\/li>\n<li>Go to <strong>Shieldome<\/strong> in the admin menu and click <strong>Scan Now<\/strong>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20a%20shieldome%20account%3F\"><h3>Do I need a Shieldome account?<\/h3><\/dt>\n<dd><p>Yes. The plugin is a dashboard interface to the Shieldome scanning service - it needs an API key from a Shieldome account to run scans. Create one at <a href=\"https:\/\/app.shieldome.com\">app.shieldome.com<\/a>; new accounts include a free trial.<\/p><\/dd>\n<dt id=\"is%20this%20plugin%20free%3F\"><h3>Is this plugin free?<\/h3><\/dt>\n<dd><p>The plugin itself is free and open source (GPLv2). Running scans through it uses your Shieldome account's plan the same way the Shieldome web dashboard does - there is no separate charge for using the plugin versus the website.<\/p><\/dd>\n<dt id=\"does%20this%20scan%20run%20on%20my%20server%3F\"><h3>Does this scan run on my server?<\/h3><\/dt>\n<dd><p>No. Scans run on Shieldome's infrastructure against your site's public URL, the same as an external visitor would see it. This plugin only triggers the scan and displays the result - it adds no scanning load to your own server.<\/p><\/dd>\n<dt id=\"what%20data%20does%20the%20plugin%20store%20on%20my%20site%3F\"><h3>What data does the plugin store on my site?<\/h3><\/dt>\n<dd><p>Only your API key, target URL, and the summary of your most recent scan (grade, risk score, date) - stored as standard WordPress options. Full scan details and history live in your Shieldome account, not on your WordPress site.<\/p><\/dd>\n<dt id=\"what%20does%20the%20plugin%20send%20to%20shieldome%3F\"><h3>What does the plugin send to Shieldome?<\/h3><\/dt>\n<dd><p>With each scan of this site, and once a day: the target URL and, unless you turn it off in Shieldome \u2192 Settings, the list of installed plugins and themes (slug, version, active or not) and the WordPress version. The daily list lets Shieldome alert you when a newly published vulnerability affects an installed plugin, without waiting for the next scan. Shieldome checks that list against the Wordfence Intelligence vulnerability database, so inactive plugins and plugins that load nothing on public pages are covered too. No content, users or settings are sent. The list is not sent when the target URL is another site.<\/p><\/dd>\n<dt id=\"why%20verify%20my%20site%3F\"><h3>Why verify my site?<\/h3><\/dt>\n<dd><p>Shieldome runs its active checks (injection and access-control tests that send crafted requests to your site) only on sites whose owner has been verified, so nobody can run them against a site they do not control. Unverified sites still get the full passive assessment. The plugin verifies its own site in one click from Shieldome \u2192 Settings; you can also verify with a DNS TXT record from your Shieldome account.<\/p><\/dd>\n<dt id=\"can%20i%20scan%20a%20site%20other%20than%20the%20one%20the%20plugin%20is%20installed%20on%3F\"><h3>Can I scan a site other than the one the plugin is installed on?<\/h3><\/dt>\n<dd><p>Yes. Set a different <strong>Target URL<\/strong> in Shieldome \u2192 Settings.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>New: one-click site ownership verification in Shieldome \u2192 Settings, so scans of this site include Shieldome's active checks without setting up a DNS record<\/li>\n<\/ul>\n\n<h4>1.2.1<\/h4>\n\n<ul>\n<li>Fixed: a finished scan always showed grade \"F\" in the admin page; it now shows the real grade<\/li>\n<li>Ready for translation (text domain shieldome-scanner); input sanitising and output escaping tightened<\/li>\n<li>New: uninstalling removes the plugin's options and its daily event<\/li>\n<li>Readme: an \"External services\" section describing exactly what is sent to Shieldome and when<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>New: the inventory is also sent once a day (WP cron), so scheduled scans use it and you are alerted when a newly published vulnerability affects an installed plugin; the settings page shows the last daily send<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>New: scans of this site include the list of installed plugins, themes and the WordPress version (names and versions only; can be turned off in Settings), so every installed component, active or inactive, is checked against known vulnerabilities<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Fixed: scan requests were rejected due to an incorrect authentication header (the plugin previously could not successfully start a scan under any configuration)<\/li>\n<li>Fixed: the target URL was not being sent correctly to the scan API<\/li>\n<li>Fixed: scan results (grade, risk score) were read from the wrong response field and never displayed after a completed scan<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<\/ul>","raw_excerpt":"Scan your WordPress site for OWASP Top 10 vulnerabilities directly from the wp-admin dashboard, powered by Shieldome.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/396113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=396113"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/nemanjashieldome"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=396113"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=396113"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=396113"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=396113"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=396113"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=396113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}