=== Aardwolf Security Scanner === Contributors: aardwolfsec Tags: security, security scanner, vulnerability, hardening, security audit Requires at least: 5.6 Tested up to: 7.0 Requires PHP: 7.2 Stable tag: 1.2.6 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Free WordPress security scanner. Audit your site for vulnerabilities, weak settings and exposed files, with a clear fix for every issue found. == Description == Aardwolf Security Scanner checks your WordPress site for the security problems attackers look for first. It runs a set of read-only checks, gives each finding a severity rating, and tells you how to fix it in clear language. You can run a scan on demand or on a schedule. The plugin does not attack your server or change any files, and it does not send your data anywhere. Every check runs on your own install. = What it checks = * Software updates. Outdated WordPress core, plugins and themes, plus inactive plugins and themes that still sit on disk. * Accounts and authentication. The default "admin" username, username enumeration through author archives and the REST API, risky registration defaults, and missing brute-force protection on the login form. * Configuration. The dashboard file editor, exposed debug output, missing or placeholder security keys and salts, the default "wp_" table prefix, and whether the admin area is forced over HTTPS. * Information exposure. A reachable XML-RPC endpoint, the version-leaking readme.html, the generator meta tag, directory browsing, and sensitive files such as debug logs, .git, .env and config backups left in the web root. * HTTP security headers. Missing X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy and HSTS. * Transport and environment. Sites still on plain HTTP, and end-of-life PHP versions. * File permissions. World-readable or world-writable wp-config.php and site root. * Known vulnerabilities. Installed plugins that have been removed from the WordPress.org directory, which often means a plugin was pulled for an unresolved security issue. Each finding comes with a severity rating and clear steps to fix it. Every scan produces a security score out of 100 so you can track progress over time. = Scheduled scans and email alerts = Run a scan automatically once a day or once a week. The plugin can email you when the score drops, when the number of problems goes up, or when a high-risk issue appears. You can also choose to get an email after every scan. = Export reports = Save the latest scan as a CSV file, or open a clean printable report and save it as a PDF from your browser. = About Aardwolf Security = This plugin is made by [Aardwolf Security](https://aardwolfsecurity.com/). Automated checks are a good first line of defence, but they are not a replacement for a manual penetration test by a qualified tester. == External services == This plugin connects to one external service, the official WordPress.org Plugin API (https://api.wordpress.org/plugins/info/1.0/). * What it is used for: the Known Vulnerabilities check asks this API whether any of your installed plugins have been removed from the WordPress.org directory. * What data is sent, and when: the directory slug of each installed plugin (for example "akismet") is sent when a scan runs. No personal data, site content or credentials are sent. Responses are cached for 24 hours. * Terms and privacy: this is a WordPress.org service, covered by the [WordPress.org Terms](https://wordpress.org/about/) and [Privacy Policy](https://wordpress.org/about/privacy/). The plugin also sends requests to your own site (its own URL) to inspect response headers and look for exposed files. These stay on your own server. == Installation == 1. Upload the aardwolf-security-scanner folder to /wp-content/plugins/, or install the ZIP from Plugins, Add New, Upload Plugin. 2. Activate the plugin from the Plugins screen. 3. Open Security Scanner in the admin menu and click Run Security Scan. == Frequently Asked Questions == = Is it safe to run on a production site? = Yes. All checks are read-only. The plugin sends a few requests to your own site to inspect headers and look for exposed files, which is harmless. Keep a current backup before you change any settings, as good practice. = Does it fix things automatically? = No. The scanner reports each problem and tells you how to fix it. You make the changes yourself, such as editing wp-config.php, adjusting file permissions, or updating settings. = Why does a check say it could not complete? = Some checks send a request to your own site. If your host blocks these requests, those checks are skipped instead of failed, and the result explains what to check by hand. == Changelog == = 1.2.6 = * Rewrote the readme in plainer language and updated the tags for the plugin directory. No functional changes. = 1.2.5 = * Printable report stylesheet is now registered and enqueued via wp_enqueue_style()/wp_print_styles() instead of a hard-coded link tag. = 1.2.4 = * Moved the printable report's CSS to a bundled stylesheet (no inline style tag) and removed the inline print-button script. * Removed an unnecessary wp-admin/includes/plugin.php include in the login-protection check. * Corrected the Contributors username. = 1.2.3 = * Removed the duplicate Plugin URI header (it matched the Author URI); kept the Author URI. = 1.2.2 = * Output all logos via escaped image tags for cleaner markup. * Documented the WordPress.org Plugin API usage under a new "External services" readme section. = 1.2.1 = * Resolved WordPress.org Plugin Check findings: removed the unused Domain Path header and the discouraged load_plugin_textdomain() call, rewrote the CSV export without direct filesystem functions, scoped template variables, tidied the uninstall routine, and updated "Tested up to". = 1.2.0 = * Removed the optional WPScan API integration and the one-click hardening feature. These are planned for a future Pro add-on. The free directory-removal check, which needs no API key, remains. = 1.1.1 = * Scheduled scans now let you choose the time of day, and the day of the week for weekly scans, in your site timezone. * Fixed the oversized admin menu icon. * Failed checks now show a problem-worded title (for example "Usernames are publicly enumerable") instead of the healthy-state wording. * The user-enumeration check now tests the live vectors (REST users endpoint and the ?author= redirect) rather than stored user data. = 1.1.0 = * Added scheduled scans (daily or weekly) with email alerts on regression. * Added CSV and printable PDF report export. * Added a Known Vulnerabilities check. * Bumped "Tested up to" and refreshed the settings screen. = 1.0.0 = * Initial release: security checks across six categories, a security score, and optional one-click hardening. == Upgrade Notice == = 1.2.6 = Plain-language readme and updated directory tags. No functional changes. = 1.0.0 = Initial release.