Aardwolf Security Scanner

Aardwolf Security Scanner checks your WordPress site for the security problems attackers look for first. It runs a set of read-only checks, gives each finding a severity rating, and tells you how to fix it in clear language. You can run a scan on demand or on a schedule. The plugin does not attack your server or change any files, and it does not send your data anywhere. Every check runs on your own install. What it checks

• Software updates. Outdated WordPress core, plugins and themes, plus inactive plugins and themes that still sit on disk.
• Accounts and authentication. The default "admin" username, username enumeration through author archives and the REST API, risky registration defaults, and missing brute-force protection on the login form.
• Configuration. The dashboard file editor, exposed debug output, missing or placeholder security keys and salts, the default "wp_" table prefix, and whether the admin area is forced over HTTPS.
• Information exposure. A reachable XML-RPC endpoint, the version-leaking readme.html, the generator meta tag, directory browsing, and sensitive files such as debug logs, .git, .env and config backups left in the web root.
• HTTP security headers. Missing X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy and HSTS.
• Transport and environment. Sites still on plain HTTP, and end-of-life PHP versions.
• File permissions. World-readable or world-writable wp-config.php and site root.
• Known vulnerabilities. Installed plugins that have been removed from the WordPress.org directory, which often means a plugin was pulled for an unresolved security issue.

Each finding comes with a severity rating and clear steps to fix it. Every scan produces a security score out of 100 so you can track progress over time. Scheduled scans and email alerts Run a scan automatically once a day or once a week. The plugin can email you when the score drops, when the number of problems goes up, or when a high-risk issue appears. You can also choose to get an email after every scan. Export reports Save the latest scan as a CSV file, or open a clean printable report and save it as a PDF from your browser. About Aardwolf Security This plugin is made by Aardwolf Security. Automated checks are a good first line of defence, but they are not a replacement for a manual penetration test by a qualified tester.

1.2.6

• Rewrote the readme in plainer language and updated the tags for the plugin directory. No functional changes.

1.2.5

• Printable report stylesheet is now registered and enqueued via wp_enqueue_style()/wp_print_styles() instead of a hard-coded link tag.

1.2.4

• Moved the printable report's CSS to a bundled stylesheet (no inline style tag) and removed the inline print-button script.
• Removed an unnecessary wp-admin/includes/plugin.php include in the login-protection check.
• Corrected the Contributors username.

1.2.3

• Removed the duplicate Plugin URI header (it matched the Author URI); kept the Author URI.

1.2.2

• Output all logos via escaped image tags for cleaner markup.
• Documented the WordPress.org Plugin API usage under a new "External services" readme section.

1.2.1

• Resolved WordPress.org Plugin Check findings: removed the unused Domain Path header and the discouraged load_plugin_textdomain() call, rewrote the CSV export without direct filesystem functions, scoped template variables, tidied the uninstall routine, and updated "Tested up to".

1.2.0

• Removed the optional WPScan API integration and the one-click hardening feature. These are planned for a future Pro add-on. The free directory-removal check, which needs no API key, remains.

1.1.1

• Scheduled scans now let you choose the time of day, and the day of the week for weekly scans, in your site timezone.
• Fixed the oversized admin menu icon.
• Failed checks now show a problem-worded title (for example "Usernames are publicly enumerable") instead of the healthy-state wording.
• The user-enumeration check now tests the live vectors (REST users endpoint and the ?author= redirect) rather than stored user data.

1.1.0

• Added scheduled scans (daily or weekly) with email alerts on regression.
• Added CSV and printable PDF report export.
• Added a Known Vulnerabilities check.
• Bumped "Tested up to" and refreshed the settings screen.

1.0.0

• Initial release: security checks across six categories, a security score, and optional one-click hardening.