Dragon Compliance - CRA & NIS2 Compliance, SBOM Export & Vulnerability Scanner
| 开发者 | dragoncoreltd |
|---|---|
| 更新时间 | 2026年10月11日 01:02 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Software inventory - WordPress core, every plugin and theme with version, author and license, plus the PHP/database/server environment.
- SBOM export - download a standards-compliant CycloneDX 1.6 JSON Software Bill of Materials, the artifact auditors and enterprise customers ask for.
- Vulnerability monitoring that works out of the box - a daily scan checks WordPress core and every installed plugin and theme against the free WPVulnerability database, with no account or API key, and lists affected components by severity with CVE links. A component that could not be checked is shown as "not checked", never as clear. If you prefer, switch to the Wordfence Intelligence feed with your own free token.
- Vulnerability alerts - new critical findings, and new findings whose severity has not been published yet, are emailed to the site admin or to a list of addresses you choose.
- CRA readiness checklist - automatic checks (HTTPS, auto-updates coverage, debug mode, file editing, 2FA, default admin account, open criticals) plus manual attestations for process facts like your update policy and backups, with a completion score.
- Evidence log - every scan, detection, resolution and attestation change is recorded with a timestamp, building the audit trail regulators expect.
安装:
- Upload the plugin files to
/wp-content/plugins/dragon-compliance, or install through the WordPress plugins screen. - Activate the plugin through the 'Plugins' screen.
- Go to Tools → Compliance. Vulnerability monitoring is already on; press "Scan now" for a first result, or wait for the daily scan.
- (Optional) Under Settings, add more alert recipients, or switch the data source to Wordfence Intelligence with your own free API token.
屏幕截图:
常见问题:
Does the CRA apply to my site?
Not necessarily. The CRA covers products with digital elements placed on the EU market, and NIS2 covers organisations in certain sectors above certain sizes; many websites fall under neither. Whether either applies to your business is a legal question. This plugin gives you the technical evidence base either way - it is not legal advice.
Where does the vulnerability data come from?
By default from WPVulnerability, a free public database, without an account. The plugin sends it the slugs of your installed plugins and themes and your WordPress version, and compares the answers with your installed versions on your server. You can switch to the Wordfence Intelligence Community Edition feed with your own free token, in which case the whole feed is downloaded and nothing about your site is sent.
What happens if a lookup fails?
That component is listed as "not checked" on the Dashboard, Findings and Inventory tabs and in the evidence log, and its open findings stay open. It is never reported as free of vulnerabilities. The next scan tries again. A plugin or theme whose folder name cannot be a WordPress.org slug (for example one with a space, a plus sign or brackets in it), one WPVulnerability does not accept as a slug, and a custom single-file plugin (a lone .php file in the plugins folder) are not failures: they are shown as "Checked - not in the database". A pre-release of WordPress (a beta or release candidate) is checked against the release it leads up to.
Which findings are emailed?
New critical findings, and new findings whose severity the data source has not published yet. The email lists the critical ones first, then the others, each marked "severity not published - review it". Findings of high, medium or low severity are shown on the Findings tab but not emailed.
What does the "No open critical vulnerabilities" check count?
Only open findings with a published critical severity. A finding whose severity has not been published does not make the check fail, so review those on the Findings tab. The check also fails while any component could not be checked.
What happens when I switch the data source?
At the next scan, findings from the old source get the status "Closed: data source changed", never "Resolved", and the new source's findings are recorded. An issue both sources report (same component and CVE) is not alerted again, and stays ignored if you had ignored it. The switch is recorded in the evidence log. A site updated from an earlier version that had vulnerability data but no saved Wordfence token moves to WPVulnerability, and that switch is recorded the same way.
Who receives alerts?
The site admin email by default. Under Settings you can enter several addresses, one per line or separated by commas; each gets its own email.
What SBOM formats are supported?
CycloneDX 1.6 JSON.
What is an SBOM, and why would I need one?
A Software Bill of Materials lists every software component you run, with versions and licenses - like an ingredients label for your site. Auditors, enterprise customers and EU regulation increasingly ask for one. This plugin exports yours in the standard CycloneDX format in one click.
When do the CRA obligations apply?
The Cyber Resilience Act's vulnerability and incident reporting obligations have applied since 11 September 2026, and the remaining requirements apply from 11 December 2027. If the CRA touches your business, the evidence trail is worth keeping from now on - findings and attestations only prove a history if they have one.
Will it slow down my site?
No. Scans run in the background once a day via WP-Cron, there is no front-end code at all, and vulnerability answers are cached for 12 hours.
Is this a malware scanner?
No. It matches your installed software versions against a database of publicly known vulnerabilities. It does not scan files for infections.
更新日志:
- New: vulnerability monitoring works out of the box. WPVulnerability is the default data source, with no account or API key. Each installed plugin and theme is looked up by its slug, and WordPress core by its version; answers are cached for 12 hours.
- New: a component whose lookup fails is listed as "not checked" on the Dashboard, Findings and Inventory tabs and in the evidence log. Its open findings stay open, and the "No open critical vulnerabilities" check does not pass until it is checked.
- New: a plugin or theme whose name cannot be a WordPress.org slug, and a custom single-file plugin, is shown as "Checked - not in the database" instead of "not checked". A WordPress beta or release candidate is checked against the release it leads up to.
- New: findings whose severity has not been published are emailed too, after the critical ones and marked for review.
- New: switching the data source closes the old source's findings as "data source changed" instead of fixed. An issue both sources report is not alerted again and keeps its ignored status. A site updated with vulnerability data but no saved Wordfence token moves to WPVulnerability, and that switch is recorded in the evidence log too.
- Changed: a WordPress core issue listed several times under one CVE is shown once, and a copy without a CVE is dropped when its description matches a CVE entry. Copies worded differently can still appear as separate findings.
- New: choose the data source under Settings. Sites that already saved a Wordfence Intelligence token keep Wordfence.
- New: alerts can go to several email addresses (one per line or separated by commas). Leave the field empty to keep emailing the site admin. A list with an invalid address is refused whole, and an alert the mail system refuses is recorded in the evidence log.
- Changed: requests to WPVulnerability and Wordfence identify the plugin instead of carrying the site address in the user agent.
- Changed: the Wordfence feed can only be fetched from www.wordfence.com.
- Removed: the License tab and all add-on prompts.
- Checklist notes and attestations are cleaned as they are read. A malformed submission saves an empty note instead of the word "Array".
- The plugin inventory reads each plugin's licence through WordPress's own plugin list.
- Another plugin that changes the list of plugin headers can no longer hide licences from the inventory or the SBOM.
- Fixed: uninstall deletes data only when the opt-in is clearly on (1, true, yes or on), not for a value set to "false" or "no".
- Fixed: the daily scan and the scan after a plugin change stopped with an error when run by WP-Cron, so only Scan now worked. Scheduled scans now run.
- Fixed: a custom single-file plugin named like a WordPress.org plugin could be matched to that plugin's vulnerabilities. Only Hello Dolly is matched by file name.
- Multisite: each site schedules its own scan, reads the network's auto-update settings and sees network-activated two-factor plugins.
- Deactivating clears both scheduled scans, and uninstall runs per site.
- Fixed: a vulnerability that returns after it was resolved (for example after a plugin downgrade) is reopened and alerted again.
- Single-file plugins such as Hello Dolly are matched against the vulnerability feed.
- Alert text shows vulnerability titles correctly.
- Every screen, email and alert is now translatable, so community translations from translate.wordpress.org cover the whole plugin. Counts use proper plural forms, and numbers and dates follow your site's language.
- Severity, status and evidence entries show readable labels.
- An "Upgrade to Pro" link on the Plugins screen, a one-line pointer at the foot of the plugin's own screens, and a single dismissible note once the plugin has done its job. All three disappear when the Pro add-on is active; nothing in the free plugin is locked or changed.
- Fixed: an attestation whose database write failed was still logged as evidence and reported as saved. All four attestations are now stored in a single write that is read back before any evidence is recorded, evidence is recorded only for items that actually changed, and a refused write shows an error instead of "Attestations saved".
- Fixed: ignoring or reopening a finding recorded a status-change evidence entry even when the row did not change. Evidence is now recorded only when the status actually changed, and a no-op or failed update shows a notice instead of "Finding updated".
- Fixed: a scan whose "mark resolved" write failed still recorded resolution evidence and fired the resolved hook for every finding. Resolutions that were not stored are no longer reported, and the next scan retries them.
- Fixed: the database schema version was stamped even when a table could not be created, which stopped the plugin from retrying. Each table is now checked to exist before the version is recorded; a failure is retried every 10 minutes and shown to administrators as a notice naming the missing tables.
- Asks for a WordPress.org review once, only on the Compliance screen and only after a vulnerability scan has completed or an SBOM has been exported. "Maybe later" snoozes it for a month and "No thanks" is permanent.
- New
dragoncompliance_sbom_exportedaction fires when an SBOM download is generated. - Listing title, description and tags now say what the plugin does, so it is easier to find in the plugin directory.
- New: the vulnerability feed source can now be supplied by Dragon Compliance Pro, which downloads it from Dragon Core so licensed sites need no Wordfence account. The free plugin only accepts www.wordfence.com or api.dragoncore.ltd as a source - any other host is ignored.
- Improvement: the dashboard and Findings screens now say when monitoring is configured but no vulnerability data has been downloaded yet, and show why the last download failed, instead of looking healthy with nothing checked.
- Hardening: the feed request no longer follows redirects; the Wordfence token is attached to the request after the source is validated and is never exposed to other plugins; an oversized feed record aborts the refresh (keeping the last good data) rather than being read into memory; an empty local index is never revalidated with a conditional request.
- Free users: no change; your Wordfence token keeps working exactly as before.
- Security: the stored Wordfence Intelligence API token now uses authenticated encryption (tamper-detecting), so a modified ciphertext is rejected rather than decrypted.
- New: vulnerability monitoring re-scans immediately when a plugin or theme is installed, updated or removed, instead of waiting for the next daily run - newly added software is checked straight away.
- Expanded the plugin listing: clearer free vs Pro breakdown, fuller FAQ, and a live-preview blueprint.
- Added screenshots of every screen to the plugin listing.
- Compatibility: tested up to WordPress 7.1.
- Housekeeping: corrected the contributor name in the plugin readme.
- Performance: new database index keeps evidence sealing fast as the log grows.
- New: "Delete data on uninstall" checkbox in settings.
- Polish: helpful empty states on the Inventory and Evidence screens; accessibility improvements.
- Initial release: inventory, CycloneDX 1.6 SBOM export, daily vulnerability monitoring via Wordfence Intelligence, CRA readiness checklist with attestations, evidence log, critical-finding email alert.