VulnCue

No. This plugin only sees what's visible from inside your WordPress installation. An external scan (like the one VulnCue runs from the outside, or a pentest) checks additional things that can only be seen from the outside: TLS certificate, HTTP headers, email SPF/DMARC records, mixed content, etc.

No. Scanning and the known-vulnerability check work without creating any account. The account is optional and only adds email alerts for new CVEs.

No. By design, it doesn't modify anything on your site — it only detects issues and explains how to fix each one. Applying the change (updating, moving a file, editing wp-config.php) is up to you or whoever manages the site.

No. The whole scan only runs when you open the plugin's screen in wp-admin — never for your visitors or on the public side of your site.

It starts at 0 and each finding adds points based on its severity: up to 30 for critical, 18 for high, 8 for medium, 3 for low, and 1 for informational — each additional finding of the same severity adds less and less, so lots of minor warnings don't drive up the risk as much as a single serious one. 0 means no problem was detected in the last scan, and 100 is the maximum risk.

You can click "Scan again" whenever you want. If you connect an account, it also scans itself automatically: every 7 days on the free account, every day on a paid plan.

Yes. Each site on the network is scanned separately (its own findings and risk level), and the Network Dashboard shows a combined summary of every site.

Everything the plugin saved on your WordPress is deleted, and the client area is notified that this site is no longer connected. Your VulnCue account itself isn't deleted (in case you use it on another site with the same email).

Yes, built in and free forever — no extra plugin needed. Each user turns it on from their own profile (Users → Your Profile → "Two-Factor Authentication") by scanning a QR code with an authenticator app (Google Authenticator, Authy, Microsoft Authenticator...). If you're an administrator, you can also require it for specific roles from the "Two-Factor Authentication" screen in the VulnCue menu.

When you turn on 2FA you get 10 one-time backup codes — save them somewhere safe. If you lose those too, any administrator can turn off your 2FA from "Two-Factor Authentication" → user table → "Reset 2FA", without needing your phone or your password.

It's designed not to: it's never turned on automatically (each person turns it on for themselves), requiring it for a role always gives a configurable grace period before it's actually enforced, and there's an emergency switch for whoever has server file access — adding define('VULNCUE_2FA_DISABLE', true); to wp-config.php disables the check instantly, no database changes needed.

No. It only applies to the normal username-and-password login screen. Application Passwords, the REST API and XML-RPC (used by mobile apps, integrations and automations) keep working exactly the same.

Not by default, ever. If you manage the policy screen, only roles with dashboard access (administrator, editor, author...) are suggested by default; shopper-only roles (like WooCommerce's "subscriber" or "customer") are shown as not recommended and stay unchecked unless you decide otherwise.