Introducing Site Security

Hi Dupa,

A vulnerability scan reads the version numbers off your WordPress core, plugins and themes, and checks each one against a database of known issues. That is the right first question to ask. It is not the only one.

It has nothing to say about the copy of wp-config.php your last migration left in the web root, the uploads folder that lists its contents to anyone who asks, or the login cookie your site sends without the Secure flag. Those are not vulnerabilities in anybody’s plugin. They are things your site is doing right now, and an attacker needs no CVE to take advantage of them.

Site Security is the check for all of that, and it is now in your dashboard.