Dragon Compliance

CRA and NIS2 compliance for WordPress: software inventory, SBOM export, vulnerability scanning, readiness checklist and a timestamped evidence log.

Download free Documentation On WordPress.org

A CRA/NIS2 readiness dashboard at a glance: your compliance score, open vulnerability findings and continuous monitoring status.

Live vulnerability findings for your plugins, themes and core — matched to CVEs from the Wordfence intelligence feed, with severity and status.

A complete software inventory with one-click CycloneDX SBOM export — the machine-readable bill of materials regulators increasingly expect.

An automated CRA checklist covering HTTPS, updates, file-editing, 2FA and more, plus attestations you can record against each control.

A tamper-evident, hash-chained evidence log that timestamps every finding, scan and attestation for your audit trail.

CRA & NIS2 compliance for WordPress — software inventory, CycloneDX SBOM export, known-vulnerability monitoring, readiness checklist and evidence log. All processing stays on your server.

Guides

Put Dragon Compliance to work

Step-by-step guides from the team that builds it. All guides

Compliance

CRA compliance for WordPress: a practical checklist for agencies and site owners

What the EU Cyber Resilience Act and NIS2 actually ask of a WordPress site, the dates that matter, and a checklist you can evidence rather than just tick.

5 min readRead

Compliance

How to generate an SBOM for a WordPress site (CycloneDX)

What a Software Bill of Materials is, why clients now ask WordPress teams for one, what it should contain, CycloneDX versus SPDX, and how to export one in CycloneDX.

4 min readRead

Requirements

· WordPress 6.2 or newer
· PHP 8.0 or newer
· WordPress 6.2+ · PHP 8.0+

Changelog

v1.1.0

Vulnerability monitoring now works on a fresh install with no account or API key, and alerts can go to several email addresses.

View full changelog →