VulnCue
| 开发者 | vulncue |
|---|---|
| 更新时间 | 2026年9月18日 21:17 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
.env,
.git), and more.
All of these checks are 100% free, with no need to create an account or
give your email. If you want an email alert when a new vulnerability (CVE)
affects one of your installed plugins, you can connect a free account from
VulnCue's client area (https://vulncue.com/) — optional, never required to
use the plugin.
安装:
- Upload the
vulncue-securityfolder to/wp-content/plugins/, or install it from Dashboard → Plugins → Add New, searching for "VulnCue". - Activate it.
- Go to "VulnCue" in the side menu to see the result of the first scan (it runs automatically on activation).
屏幕截图:
常见问题:
Does this replace a full security audit?
No. This plugin only sees what's visible from inside your WordPress installation. An external scan (like the one VulnCue runs from the outside, or a pentest) checks additional things that can only be seen from the outside: TLS certificate, HTTP headers, email SPF/DMARC records, mixed content, etc.
Do I have to create an account to use it?
No. Scanning and the known-vulnerability check work without creating any account. The account is optional and only adds email alerts for new CVEs.
Does the plugin fix issues automatically?
No. By design, it doesn't modify anything on your site — it only detects issues and explains how to fix each one. Applying the change (updating, moving a file, editing wp-config.php) is up to you or whoever manages the site.
Does it slow down my site?
No. The whole scan only runs when you open the plugin's screen in wp-admin — never for your visitors or on the public side of your site.
How is the 0-100 risk level calculated?
It starts at 0 and each finding adds points based on its severity: up to 30 for critical, 18 for high, 8 for medium, 3 for low, and 1 for informational — each additional finding of the same severity adds less and less, so lots of minor warnings don't drive up the risk as much as a single serious one. 0 means no problem was detected in the last scan, and 100 is the maximum risk.
How often should I scan my site again?
You can click "Scan again" whenever you want. If you connect an account, it also scans itself automatically: every 7 days on the free account, every day on a paid plan.
Does it work on WordPress Multisite installs?
Yes. Each site on the network is scanned separately (its own findings and risk level), and the Network Dashboard shows a combined summary of every site.
What happens if I uninstall the plugin?
Everything the plugin saved on your WordPress is deleted, and the client area is notified that this site is no longer connected. Your VulnCue account itself isn't deleted (in case you use it on another site with the same email).
更新日志:
- First public release. 100% local, free-forever check engine, no account or email needed: outdated core/plugins/themes, PHP EOL, WP_DEBUG, default security keys, DISALLOW_FILE_EDIT, exposed "admin" user, open registration with administrator as the default role, exposed sensitive files, exposed readme.html and generator tag, PHP execution and directory listing in the uploads folder, table prefix and wp-config.php permissions, inactive plugins/themes, automatic core updates, two-factor authentication, brute-force protection, backup plugin, new or recently promoted administrator accounts, XML-RPC, REST user enumeration, and SSL/TLS certificate expiry/trust.
- Known vulnerability (CVE) check against VulnCue's public catalog and core integrity check against wordpress.org's official checksums — both enabled by default, no account or email needed, and both can be disabled.
- Optional connection of a free VulnCue account (email only, with link-based confirmation) for new-CVE email alerts and a weekly risk-level summary — never required for the rest of the plugin. Scheduled auto-scan via WP-Cron for connected accounts.
- 0-100 risk level with a visual ring (0 = no issues found, the higher it is, the more important the findings; repeated findings of the same severity weigh less each time so the scale doesn't saturate), a severity bar, and a history chart of the risk level with each scan's number always visible.
- Hide individual findings you're already aware of (with its own list so you can unhide them whenever you want) — they don't count toward the risk level or the menu badge while hidden.
- Menu-bar alert for new critical/high findings, a reminder if it's been a while since your last scan, a "what's changed since your last scan" summary, Tools → Site Health integration, PDF export, and WordPress Multisite support (a summary of every site on the network, from the Network Dashboard).
- Full English translation (en_US, en_GB, en_AU, en_CA, en_NZ, en_ZA): the whole plugin also works on English-language WordPress installs.
- Optional "why are you deactivating VulnCue?" survey when clicking "Deactivate" on Dashboard → Plugins, with the option to skip it and just deactivate.
- WP-Cron check every hour (previously once a day) so the first automatic scan/report after connecting an account takes at most ~1 h instead of up to 24 h — the real scan frequency (7 days free, 1 day paid) doesn't change, only the first-time worst case.