Erdo CRA Compliance – EU Cyber Resilience Act, GDPR & NIS2 Scanner for WordPress

The EU Cyber Resilience Act (CRA) is a regulation that requires manufacturers of products with digital elements — including software and websites sold or used in the EU — to meet cybersecurity standards throughout the product lifecycle. If you sell products or services in the EU, run a WordPress site that processes EU user data, or develop WordPress plugins, the CRA likely applies to you. The first deadline (Vulnerability Disclosure Policy) is September 11, 2026. Full compliance is required by December 11, 2027.

Use the VDP Generator in Erdo CRA Compliance. It creates a ready-to-publish policy document pre-filled with your site details. The plugin also automatically serves it at the standard URL /.well-known/security.txt so security researchers can find it without you touching your server configuration.

Erdo CRA Compliance automatically serves an RFC 9116-compliant security.txt at yourdomain.com/.well-known/security.txt. You do not need to create or upload the file manually — the plugin handles it as soon as you activate it and fill in the Settings tab.

An SBOM (Software Bill of Materials) is a machine-readable inventory of all software components in your product. The CRA requires vendors to provide an SBOM to document what their software is made of. Erdo CRA Compliance generates a CycloneDX 1.4 JSON SBOM covering WordPress core, all active plugins, and your active theme — ready to provide to customers or regulators.

Run the Plugin Risk Scanner in Erdo CRA Compliance. It checks every active plugin against CRA readiness criteria: last updated date, WordPress version lag, PHP requirements, support health, and whether the plugin has been closed or removed from WordPress.org. Each plugin receives a risk rating (LOW / MEDIUM / HIGH) with specific reasons and recommended actions.

The GDPR Scanner in Erdo CRA Compliance detects third-party scripts loading on your site — Google Analytics, Facebook Pixel, HubSpot, Intercom, and others — and flags them as potential data-handling risks. You get a list of external domains your site contacts, so you can audit your cookie consent setup and data processing agreements.

No. This plugin provides automated analysis and document templates to help you assess and document your compliance posture. All assessments and generated documents should be reviewed by a qualified legal or compliance professional before regulatory use.

The CRA is an EU regulation requiring manufacturers of "products with digital elements" (including software) to meet cybersecurity requirements throughout the product lifecycle — including vulnerability disclosure, security updates, and SBOM documentation.

The plugin is designed for single-site installations. Multisite support is not included in this version.

The score (0–100) is calculated as: 100 minus 10 points per HIGH risk finding and 5 points per MEDIUM risk finding, floored at 0. It is an indicative benchmark, not a regulatory certification.

Common reasons: not updated for over 2 years, tested on a WordPress version 2+ major releases behind current, requires an end-of-life PHP version, or has been removed from WordPress.org.

The plugin captures enqueued script sources on frontend page loads and stores them temporarily. This allows the GDPR scanner to identify external domains even when running in the admin context.