About this plugin
The EU Cyber Resilience Act (CRA) and the NIS2 directive expect the businesses
they cover to know what software they run, monitor it for known
vulnerabilities, patch without delay – and to be able to prove all of that.
Dragon Compliance turns your WordPress site into something you can hand to an
auditor:
- Software inventory – WordPress core, every plugin and theme with version,
author and license, plus the PHP/database/server environment.
- SBOM export – download a standards-compliant CycloneDX 1.6 JSON Software
Bill of Materials, the artifact auditors and enterprise customers ask for.
- Vulnerability monitoring that works out of the box – a daily scan checks
WordPress core and every installed plugin and theme against the free
WPVulnerability database, with no account or API key, and lists affected
components by severity with CVE links. A component that could not be checked
is shown as “not checked”, never as clear. If you prefer, switch to the
Wordfence Intelligence feed with your own free token.
- Vulnerability alerts – new critical findings, and new findings whose
severity has not been published yet, are emailed to the site admin or to a
list of addresses you choose.
- CRA readiness checklist – automatic checks (HTTPS, auto-updates coverage,
debug mode, file editing, 2FA, default admin account, open criticals) plus
manual attestations for process facts like your update policy and backups,
with a completion score.
- Evidence log – every scan, detection, resolution and attestation change
is recorded with a timestamp, building the audit trail regulators expect.
Matching, findings and the evidence log all stay in your WordPress database.
To check for known vulnerabilities, the plugin asks a public vulnerability
database about your installed components (see External services below): it
sends component names and the WordPress version, never your site address,
users or content.
Everything above is free, fully functional and unlimited.
External services
This plugin connects to one vulnerability database at a time, chosen under
Tools → Compliance → Settings. Both are used only for vulnerability
monitoring: once a day, after you add, update or remove a plugin or theme,
when you press “Scan now”, and once more shortly after a scan that ran out of
time before every component was looked up.
WPVulnerability (default)
com) is a free, public database
of known WordPress vulnerabilities. By default the plugin asks
net about each installed component: the slug (folder
name) of every plugin and theme, and the WordPress core version number. Plugin
and theme versions are not sent; the plugin compares versions on your server.
Your site address, users and content are not sent; like any web request, the
service sees your server’s IP address. Answers are cached on your site for
12 hours. No account or API key is needed.
0.
com/privacy/
com/license/
Wordfence Intelligence (only when you choose it)
If you select Wordfence Intelligence and enter your own API token, the plugin
instead downloads the full Wordfence Intelligence vulnerability list from
) and matches it on your server.
Only your API token is sent with that request – no data about your site, its
inventory or its users. Without a token nothing is sent to Wordfence. You need
com account to generate a token.
com/terms-of-use/
com/privacy-policy/
Credits
dev), ISC License. com, MIT License). All other copyright (c) for Lucide are held by Lucide Contributors 2022.
The plugin itself does not include these icons.