Vulnerability monitoring now works without an account, using WPVulnerability. Sites with a saved Wordfence token keep Wordfence. Alerts can go to several addresses.<\/p>","1.0.13":"
Stricter handling of checklist input. No change to how scans or exports work.<\/p>","1.0.12":"
Fixed: scheduled vulnerability scans now run. Please update.<\/p>","1.0.11":"
Vulnerabilities that come back are reported again.<\/p>","1.0.10":"
Translation-ready throughout.<\/p>","1.0.8":"
Fixes cases where a failed database write was reported as saved: attestations, finding status changes and scan resolutions are now only recorded in the evidence log once they are actually stored.<\/p>","1.0.7":"
Adds a one-time WordPress.org review prompt on the Compliance screen after your first scan or SBOM export. No other changes.<\/p>","1.0.6":"
Adds the feed-source hook Dragon Compliance Pro 1.0.4 uses for zero-configuration vulnerability monitoring. No change for free users.<\/p>","1.0.5":"
Security: your Wordfence token is now stored with authenticated encryption, and monitoring re-scans as soon as you add, update or remove a plugin or theme. Recommended update.<\/p>","1.0.4":"
Listing and documentation improvements only. Safe to update.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.gif":{"filename":"icon-128x128.gif","revision":3711775,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.gif":{"filename":"icon-256x256.gif","revision":3711775,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3666619,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3666619,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{"blueprint.json":{"filename":"blueprint.json","revision":3738400,"resolution":false,"location":"assets","locale":"","contents":"{\"landingPage\":\"\\\/wp-admin\\\/tools.php?page=dragon-compliance\",\"preferredVersions\":{\"php\":\"8.2\",\"wp\":\"latest\"},\"features\":{\"networking\":true},\"steps\":[{\"step\":\"login\",\"username\":\"admin\",\"password\":\"password\"},{\"step\":\"installPlugin\",\"pluginData\":{\"resource\":\"wordpress.org\\\/plugins\",\"slug\":\"dragon-compliance\"},\"options\":{\"activate\":true}}]}"}},"all_blocks":[],"tagged_versions":["1.0.10","1.0.11","1.0.12","1.0.13","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.jpg":{"filename":"screenshot-1.jpg","revision":3666619,"resolution":"1","location":"assets","locale":"","width":1456,"height":839},"screenshot-2.jpg":{"filename":"screenshot-2.jpg","revision":3666619,"resolution":"2","location":"assets","locale":"","width":1456,"height":839},"screenshot-3.jpg":{"filename":"screenshot-3.jpg","revision":3666619,"resolution":"3","location":"assets","locale":"","width":1456,"height":839},"screenshot-4.jpg":{"filename":"screenshot-4.jpg","revision":3666619,"resolution":"4","location":"assets","locale":"","width":1456,"height":839},"screenshot-5.jpg":{"filename":"screenshot-5.jpg","revision":3666619,"resolution":"5","location":"assets","locale":"","width":1456,"height":839}},"screenshots":{"1":"Dashboard - readiness score, open findings and vulnerability monitoring at a glance.","2":"Findings - known vulnerabilities in installed plugins, themes and core, with severity and CVE links.","3":"Inventory & SBOM - every component on the site, exportable as a CycloneDX SBOM in one click.","4":"Checklist - automatic CRA readiness checks plus recorded process attestations.","5":"Evidence - a timestamped log of every scan, detection and attestation."}},"plugin_section":[],"plugin_tags":[14361,267090,269595,600,139069],"plugin_category":[54],"plugin_contributors":[276960],"plugin_business_model":[],"class_list":["post-358504","plugin","type-plugin","status-publish","hentry","plugin_tags-compliance","plugin_tags-nis2","plugin_tags-sbom","plugin_tags-security","plugin_tags-vulnerability-scanner","plugin_category-security-and-spam-protection","plugin_contributors-dragoncoreltd","plugin_committers-dragoncoreltd"],"banners":{"banner":"https:\/\/ps.w.org\/dragon-compliance\/assets\/banner-772x250.png?rev=3666619","banner_2x":"https:\/\/ps.w.org\/dragon-compliance\/assets\/banner-1544x500.png?rev=3666619","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/dragon-compliance\/assets\/icon-128x128.gif?rev=3711775","icon_2x":"https:\/\/ps.w.org\/dragon-compliance\/assets\/icon-256x256.gif?rev=3711775","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/dragon-compliance\/assets\/screenshot-1.jpg?rev=3666619","caption":"Dashboard - readiness score, open findings and vulnerability monitoring at a glance."},{"src":"https:\/\/ps.w.org\/dragon-compliance\/assets\/screenshot-2.jpg?rev=3666619","caption":"Findings - known vulnerabilities in installed plugins, themes and core, with severity and CVE links."},{"src":"https:\/\/ps.w.org\/dragon-compliance\/assets\/screenshot-3.jpg?rev=3666619","caption":"Inventory & SBOM - every component on the site, exportable as a CycloneDX SBOM in one click."},{"src":"https:\/\/ps.w.org\/dragon-compliance\/assets\/screenshot-4.jpg?rev=3666619","caption":"Checklist - automatic CRA readiness checks plus recorded process attestations."},{"src":"https:\/\/ps.w.org\/dragon-compliance\/assets\/screenshot-5.jpg?rev=3666619","caption":"Evidence - a timestamped log of every scan, detection and attestation."}],"raw_content":"\n
The EU Cyber Resilience Act (CRA) and the NIS2 directive expect the businesses\nthey cover to know what software they run, monitor it for known\nvulnerabilities, patch without delay - and to be able to prove<\/em> all of that.\nDragon Compliance turns your WordPress site into something you can hand to an\nauditor:<\/p>\n\n Matching, findings and the evidence log all stay in your WordPress database.\nTo check for known vulnerabilities, the plugin asks a public vulnerability\ndatabase about your installed components (see External services below): it\nsends component names and the WordPress version, never your site address,\nusers or content.<\/p>\n\n Everything above is free, fully functional and unlimited.<\/p>\n\n This plugin connects to one vulnerability database at a time, chosen under\nTools \u2192 Compliance \u2192 Settings. Both are used only for vulnerability\nmonitoring: once a day, after you add, update or remove a plugin or theme,\nwhen you press \"Scan now\", and once more shortly after a scan that ran out of\ntime before every component was looked up.<\/p>\n\n WPVulnerability (https:\/\/www.wpvulnerability.com) is a free, public database\nof known WordPress vulnerabilities. By default the plugin asks\nwww.wpvulnerability.net about each installed component: the slug (folder\nname) of every plugin and theme, and the WordPress core version number. Plugin\nand theme versions are not sent; the plugin compares versions on your server.\nYour site address, users and content are not sent; like any web request, the\nservice sees your server's IP address. Answers are cached on your site for\n12 hours. No account or API key is needed.<\/p>\n\n WPVulnerability data is published under CC0 1.0.<\/p>\n\n WPVulnerability privacy policy: https:\/\/www.wpvulnerability.com\/privacy\/\nWPVulnerability licence: https:\/\/www.wpvulnerability.com\/license\/<\/p>\n\n If you select Wordfence Intelligence and enter your own API token, the plugin\ninstead downloads the full Wordfence Intelligence vulnerability list from\nwww.wordfence.com (a service by Defiant Inc.) and matches it on your server.\nOnly your API token is sent with that request - no data about your site, its\ninventory or its users. Without a token nothing is sent to Wordfence. You need\na free wordfence.com account to generate a token.<\/p>\n\n Wordfence terms of service: https:\/\/www.wordfence.com\/terms-of-use\/\nWordfence privacy policy: https:\/\/www.wordfence.com\/privacy-policy\/<\/p>\n\n The WordPress.org listing icon is drawn with glyphs from Lucide (https:\/\/lucide.dev), ISC License. Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2022 as part of Feather (https:\/\/feathericons.com, MIT License). All other copyright (c) for Lucide are held by Lucide Contributors 2022. The plugin itself does not include these icons.<\/p>\n\n\n Not necessarily. The CRA covers products with digital elements placed on the\nEU market, and NIS2 covers organisations in certain sectors above certain\nsizes; many websites fall under neither. Whether either applies to your\nbusiness is a legal question. This plugin gives you the technical evidence\nbase either way - it is not legal advice.<\/p><\/dd>\n By default from WPVulnerability, a free public database, without an account.\nThe plugin sends it the slugs of your installed plugins and themes and your\nWordPress version, and compares the answers with your installed versions on\nyour server. You can switch to the Wordfence Intelligence Community Edition\nfeed with your own free token, in which case the whole feed is downloaded and\nnothing about your site is sent.<\/p><\/dd>\n That component is listed as \"not checked\" on the Dashboard, Findings and\nInventory tabs and in the evidence log, and its open findings stay open. It is\nnever reported as free of vulnerabilities. The next scan tries again.<\/p>\n\n A plugin or theme whose folder name cannot be a WordPress.org slug (for\nexample one with a space, a plus sign or brackets in it), one WPVulnerability\ndoes not accept as a slug, and a custom single-file plugin (a lone .php file\nin the plugins folder) are not failures: they are shown as \"Checked - not in\nthe database\". A pre-release of WordPress (a beta or release candidate) is\nchecked against the release it leads up to.<\/p><\/dd>\n New critical findings, and new findings whose severity the data source has not\npublished yet. The email lists the critical ones first, then the others, each\nmarked \"severity not published - review it\". Findings of high, medium or low\nseverity are shown on the Findings tab but not emailed.<\/p><\/dd>\n Only open findings with a published critical severity. A finding whose\nseverity has not been published does not make the check fail, so review those\non the Findings tab. The check also fails while any component could not be\nchecked.<\/p><\/dd>\n At the next scan, findings from the old source get the status \"Closed: data\nsource changed\", never \"Resolved\", and the new source's findings are recorded.\nAn issue both sources report (same component and CVE) is not alerted again,\nand stays ignored if you had ignored it. The switch is recorded in the\nevidence log. A site updated from an earlier version that had vulnerability\ndata but no saved Wordfence token moves to WPVulnerability, and that switch\nis recorded the same way.<\/p><\/dd>\n The site admin email by default. Under Settings you can enter several\naddresses, one per line or separated by commas; each gets its own email.<\/p><\/dd>\n CycloneDX 1.6 JSON.<\/p><\/dd>\n A Software Bill of Materials lists every software component you run, with versions and licenses - like an ingredients label for your site. Auditors, enterprise customers and EU regulation increasingly ask for one. This plugin exports yours in the standard CycloneDX format in one click.<\/p><\/dd>\n The Cyber Resilience Act's vulnerability and incident reporting obligations have applied since 11 September 2026, and the remaining requirements apply from 11 December 2027. If the CRA touches your business, the evidence trail is worth keeping from now on - findings and attestations only prove a history if they have one.<\/p><\/dd>\n No. Scans run in the background once a day via WP-Cron, there is no front-end code at all, and vulnerability answers are cached for 12 hours.<\/p><\/dd>\n No. It matches your installed software versions against a database of\npublicly known vulnerabilities. It does not scan files for infections.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
External services<\/h3>\n\n
WPVulnerability (default)<\/h4>\n\n
Wordfence Intelligence (only when you choose it)<\/h4>\n\n
Credits<\/h3>\n\n
\n
\/wp-content\/plugins\/dragon-compliance<\/code>, or\ninstall through the WordPress plugins screen.<\/li>\n\n
Does the CRA apply to my site?<\/h3><\/dt>\n
Where does the vulnerability data come from?<\/h3><\/dt>\n
What happens if a lookup fails?<\/h3><\/dt>\n
Which findings are emailed?<\/h3><\/dt>\n
What does the \"No open critical vulnerabilities\" check count?<\/h3><\/dt>\n
What happens when I switch the data source?<\/h3><\/dt>\n
Who receives alerts?<\/h3><\/dt>\n
What SBOM formats are supported?<\/h3><\/dt>\n
What is an SBOM, and why would I need one?<\/h3><\/dt>\n
When do the CRA obligations apply?<\/h3><\/dt>\n
Will it slow down my site?<\/h3><\/dt>\n
Is this a malware scanner?<\/h3><\/dt>\n
1.1.0<\/h4>\n\n
\n
1.0.13<\/h4>\n\n
\n
1.0.12<\/h4>\n\n
\n
1.0.11<\/h4>\n\n
\n
1.0.10<\/h4>\n\n
\n
1.0.9<\/h4>\n\n
\n
1.0.8<\/h4>\n\n
\n
1.0.7<\/h4>\n\n
\n
dragoncompliance_sbom_exported<\/code> action fires when an SBOM download is generated.<\/li>\n1.0.6<\/h4>\n\n
\n
1.0.5<\/h4>\n\n
\n
1.0.4<\/h4>\n\n
\n
1.0.3<\/h4>\n\n
\n
1.0.2<\/h4>\n\n
\n
1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n