Aardwolf Security Scanner

Aardwolf Security Scanner checks your WordPress site for the security problems attackers look for first. It runs a set of read-only checks, gives each finding a severity rating, and tells you how to fix it in clear language.

You can run a scan on demand or on a schedule. The plugin does not attack your server or change any files, and it does not send your data anywhere. Every check runs on your own install.

What it checks

• Software updates. Outdated WordPress core, plugins and themes, plus inactive plugins and themes that still sit on disk.
• Accounts and authentication. The default “admin” username, username enumeration through author archives and the REST API, risky registration defaults, and missing brute-force protection on the login form.
• Configuration. The dashboard file editor, exposed debug output, missing or placeholder security keys and salts, the default “wp_” table prefix, and whether the admin area is forced over HTTPS.
• Information exposure. A reachable XML-RPC endpoint, the version-leaking readme.html, the generator meta tag, directory browsing, and sensitive files such as debug logs, .git, .env and config backups left in the web root.
• HTTP security headers. Missing X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy and HSTS.
• Transport and environment. Sites still on plain HTTP, and end-of-life PHP versions.
• File permissions. World-readable or world-writable wp-config.php and site root.
• Known vulnerabilities. Installed plugins that have been removed from the WordPress.org directory, which often means a plugin was pulled for an unresolved security issue.

Each finding comes with a severity rating and clear steps to fix it. Every scan produces a security score out of 100 so you can track progress over time.

Scheduled scans and email alerts

Run a scan automatically once a day or once a week. The plugin can email you when the score drops, when the number of problems goes up, or when a high-risk issue appears. You can also choose to get an email after every scan.

Export reports

Save the latest scan as a CSV file, or open a clean printable report and save it as a PDF from your browser.

About Aardwolf Security

This plugin is made by Aardwolf Security. Automated checks are a good first line of defence, but they are not a replacement for a manual penetration test by a qualified tester.

External services

This plugin connects to one external service, the official WordPress.org Plugin API (https://api.wordpress.org/plugins/info/1.0/).

• What it is used for: the Known Vulnerabilities check asks this API whether any of your installed plugins have been removed from the WordPress.org directory.
• What data is sent, and when: the directory slug of each installed plugin (for example “akismet”) is sent when a scan runs. No personal data, site content or credentials are sent. Responses are cached for 24 hours.
• Terms and privacy: this is a WordPress.org service, covered by the WordPress.org Terms and Privacy Policy.

The plugin also sends requests to your own site (its own URL) to inspect response headers and look for exposed files. These stay on your own server.