Dragon Compliance

A quiet pointer to the Pro add-on: an Upgrade to Pro link on the Plugins screen, a one-line note at the foot of the plugin's screens, and a single dismissible notice once the plugin has done its job. Nothing in the free plugin is locked or changed, and all three disappear when Pro is active.

Four fixes so that a failed database write is never reported as saved or recorded as evidence.

What's fixed in 1.0.8

• Attestations are only logged once they are stored. If the database refused the attestation write, the checklist still recorded an "attestation changed" evidence entry and reported "Attestations saved". All four attestations are now stored in one write that is read back before any evidence is recorded, evidence is recorded only for items that actually changed, and a refused write shows an error notice instead.
• Finding status changes are only logged when a row changed. Ignoring or reopening a finding recorded evidence even when the update did not land or the finding already had that status. Evidence is now recorded only for a real change, and a no-op or failed update says so.
• Unsaved scan resolutions are no longer reported. A scan whose "mark resolved" write failed still recorded resolution evidence and fired the resolved hook for every finding. Resolutions that were not stored are dropped from the scan summary, and the next scan retries them.
• The schema version is stamped only after the tables exist. A failed table creation was previously recorded as complete, so the plugin never retried. Each table is now checked before the version is stored; a failure is retried every 10 minutes and administrators see a notice naming the missing tables.
• Only findings that really changed are recorded as resolved. Resolving a batch of findings counted every one it put forward, so a finding you ignored in another tab a moment earlier was written to the evidence log as resolved. The log now records only the findings whose status actually changed.
• A refused evidence entry is retried instead of lost. Saving a checklist attestation also writes an evidence entry. If the attestation saved but the evidence write was refused, the entry was lost for good, because repeating the same attestation is treated as no change. Such entries are now kept and written on the next attempt, and the screen reports the partial save.
• Sites already missing a table are repaired on upgrade. An earlier version could record the schema as up to date even when a table had not been created, and because that recorded version did not change in this release those sites would have skipped the new check forever. The tables are now confirmed to exist before the recorded version is trusted.

No settings or data changes otherwise.

Dragon Compliance now asks for a WordPress.org review once, on its own screen, after your first vulnerability scan or SBOM export.

What's new in 1.0.7

• One-time review prompt. After a scan completes or you export an SBOM, the Compliance screen shows a short request for a WordPress.org review. "Maybe later" hides it for a month and "No thanks" hides it for good. It never appears anywhere else in wp-admin.
• New dragoncompliance_sbom_exported action fires when an SBOM download is generated.
• The plugin directory listing now describes what the plugin does in its title and tags, so it is easier to find.

No behaviour, settings or data changes otherwise.

Adds the feed-source hook that lets Dragon Compliance Pro 1.0.4 provide zero-configuration vulnerability monitoring; nothing changes for free users.

= 1.0.6 =

• New: the vulnerability feed source can be supplied by Dragon Compliance Pro, which downloads it from Dragon Core so licensed sites need no Wordfence account. The free plugin only accepts www.wordfence.com or api.dragoncore.ltd as a source.
• Improvement: the dashboard and Findings screens now say when monitoring is configured but no vulnerability data has been downloaded yet, and show why the last download failed.
• Hardening: no redirects on the feed request, the Wordfence token is never exposed to other plugins, oversized feed records abort the refresh instead of consuming memory, and an empty local index is never revalidated conditionally.
• Free users: no change — your Wordfence token keeps working exactly as before.

Faster detection: a newly installed or updated plugin/theme is now scanned within minutes instead of waiting for the daily scan; secrets are authenticated at rest.

= 1.0.5 =

• Improvement: installing, updating, activating or removing a plugin/theme now triggers a debounced rescan, closing the up-to-24h window before a new vulnerability was noticed.
• Hardening: authenticated encryption for stored secrets.

Listing improvements: clearer free vs Pro breakdown, fuller FAQ and a live-preview blueprint.

• Docs: expanded plugin listing copy and FAQ.

Screenshots of every screen are now part of the WordPress.org listing.

• Added listing screenshots (dashboard, findings, inventory and SBOM, checklist, evidence).

Tested and verified on WordPress 7.1.

• Compatibility: tested up to WordPress 7.1.

Faster evidence sealing on busy sites via a new database index, a Delete-data-on-uninstall setting, and clearer empty states on the Inventory and Evidence screens.

Dragon Compliance is here: CRA and NIS2 evidence for WordPress.

Software inventory with CycloneDX SBOM export, continuous vulnerability monitoring against the Wordfence intelligence feed (local — no account, no data leaves your site), a CRA readiness checklist, and an evidence log. Built for the EU Cyber Resilience Act reporting obligations that begin 11 September 2026.