About this plugin
CYRN watches your WordPress site for known security vulnerabilities in WordPress core, your plugins and your themes. When one is found, you see what it is, how severe it is and which version fixes it, here in your WordPress admin, on your CYRN dashboard and by e-mail. When WordPress offers the fixed version, you can install it in one click, or let WordPress install security fixes automatically.
This plugin connects your site to the CYRN service. A free plan covers one site; paid plans add more sites, daily scans and PDF reports.
What the plugin does
- Connects your site to your CYRN account in a few clicks, and proves you control the site automatically (no file to upload).
- Once a day, and a few minutes after you install, update or remove a plugin or theme, sends CYRN the list of software versions on the site.
- Shows the vulnerabilities found on its admin page and in a dashboard widget.
- Updates a vulnerable plugin or theme in one click, with WordPress’s own updater, when WordPress offers the version that fixes it.
- Optional, off by default: automatic security updates. WordPress then installs, in the background, the updates that fix a known vulnerability, and only those.
What the plugin does not do
- It sends no personal data, content, settings, file paths or user accounts.
- It adds nothing to your public pages.
- CYRN cannot change, install or run anything on your site: there is no remote command. Updates only happen when an administrator clicks “Update” or turns on automatic security updates on this site, and they always come from WordPress’s usual update source, never from CYRN.
- Nothing is sent to CYRN until an administrator clicks “Connect”.
External service
fr. It is only contacted after an administrator connects the site.
- When you connect, your browser is sent to https://intel.cyrn.fr/connect with the site’s address, where you sign in with your CYRN account (CYRN Auth) and choose the organisation. The plugin then receives a site key, and CYRN loads your home page once with a?cyrn_verify= parameter to confirm the plugin is installed on this site.
- Once a day and after software changes, the plugin sends: the WordPress version, the PHP version, whether the site is a multisite, and for each installed plugin and theme its folder name (slug), version and whether it is active. The site address is sent in the request’s User-Agent.
- On the plugin page, it reads the site’s status (verification, scan dates, vulnerabilities found).
- When you disconnect or uninstall, it asks CYRN to revoke the site key.
CYRN also scans the public pages of verified sites, like any visitor would, to confirm the versions in use.
- Terms: https://cyrn.fr/conditions-generales.html
- Privacy policy: https://cyrn.fr/confidentialite.html