Dragon Compliance

Vulnerability monitoring now works on a fresh install with no account or API key, and alerts can go to several email addresses.

What's new

• Monitoring out of the box. Dragon Compliance now uses the free WPVulnerability database by default. Each scan looks up your installed plugins and themes by their slug and WordPress core by its version, then compares versions on your server. Answers are cached for 12 hours. No account, no token.
• Nothing is reported clear by mistake. If a lookup fails, that component is shown as "not checked" on the Dashboard, Findings and Inventory tabs and in the evidence log. Its open findings stay open, and the "No open critical vulnerabilities" check waits until it has been checked. The next scan tries again.
• Choose your data source. Under Tools > Compliance > Settings you can switch between WPVulnerability and Wordfence Intelligence (with your own free token). If you already saved a Wordfence token, you stay on Wordfence until you change it.
• Custom plugins are not flagged as failures. A custom single-file plugin, or a plugin or theme folder whose name cannot be a WordPress.org slug, is shown as "Checked - not in the database". A WordPress beta or release candidate is checked against the release it leads up to.
• Alerts for findings without a severity. WPVulnerability does not rate every vulnerability. New findings whose severity has not been published are emailed too, after the critical ones, each marked "severity not published - review it".
• Several alert recipients. Enter up to 20 addresses, one per line or separated by commas; each gets its own email. Leave the field empty to keep emailing the site admin. If the mail system refuses an alert, the evidence log says so.

Also changed

• Requests to the vulnerability services no longer carry your site address in the user agent.
• The Wordfence feed can only be fetched from www.wordfence.com.
• A WordPress core issue listed several times under one CVE is shown once, and a copy without a CVE is dropped when its description matches a CVE entry. Copies worded differently can still appear as separate findings.
• The License tab and the add-on prompts are gone.

Good to know

• Switching data source closes the old source's findings at the next scan with the status "Closed: data source changed", never "Resolved". An issue both sources report (same component and CVE) is not alerted again and stays ignored if you had ignored it. The switch is recorded in the evidence log.
• A site updated with vulnerability data but no saved Wordfence token moves to WPVulnerability, and that switch is recorded in the evidence log at the first scan.
• The "No open critical vulnerabilities" check counts only findings with a published critical severity, so review "Unknown" findings on the Findings tab.

Checklist input is now cleaned as it is read, and the plugin inventory reads each plugin's licence through WordPress's own plugin list.

• A malformed checklist submission saves an empty note instead of the word "Array".
• Another plugin that changes the list of plugin headers can no longer hide licences from the inventory or the SBOM.
• Fixed: uninstall deletes data only when the opt-in is clearly on (1, true, yes or on), not for a value set to "false" or "no".

Fixed: scheduled vulnerability scans now run. Please update.

What's new in 1.0.12

• Fixed: the daily scan and the scan after a plugin change stopped with an error when run by WP-Cron, so only Scan now worked. Scheduled scans now run.
• Fixed: a custom single-file plugin named like a WordPress.org plugin could be matched to that plugin's vulnerabilities. Only Hello Dolly is matched by file name.
• Multisite: each site schedules its own scan, reads the network's auto-update settings and sees network-activated two-factor plugins.
• Deactivating clears both scheduled scans, and uninstall runs per site.

Vulnerabilities that come back are reported again.

What's new in 1.0.11

• Fixed: a vulnerability that returns after it was resolved (for example after a plugin downgrade) is reopened and alerted again.
• Single-file plugins such as Hello Dolly are matched against the vulnerability feed.
• Alert text shows vulnerability titles correctly.

Translation-ready throughout.

What's new in 1.0.10

• Every screen, email and alert is now translatable, so community translations from translate.wordpress.org cover the whole plugin. Counts use proper plural forms, and numbers and dates follow your site's language.
• Severity, status and evidence entries show readable labels.

A quiet pointer to the Pro add-on: an Upgrade to Pro link on the Plugins screen, a one-line note at the foot of the plugin's screens, and a single dismissible notice once the plugin has done its job. Nothing in the free plugin is locked or changed, and all three disappear when Pro is active.

Four fixes so that a failed database write is never reported as saved or recorded as evidence.

What's fixed in 1.0.8

• Attestations are only logged once they are stored. If the database refused the attestation write, the checklist still recorded an "attestation changed" evidence entry and reported "Attestations saved". All four attestations are now stored in one write that is read back before any evidence is recorded, evidence is recorded only for items that actually changed, and a refused write shows an error notice instead.
• Finding status changes are only logged when a row changed. Ignoring or reopening a finding recorded evidence even when the update did not land or the finding already had that status. Evidence is now recorded only for a real change, and a no-op or failed update says so.
• Unsaved scan resolutions are no longer reported. A scan whose "mark resolved" write failed still recorded resolution evidence and fired the resolved hook for every finding. Resolutions that were not stored are dropped from the scan summary, and the next scan retries them.
• The schema version is stamped only after the tables exist. A failed table creation was previously recorded as complete, so the plugin never retried. Each table is now checked before the version is stored; a failure is retried every 10 minutes and administrators see a notice naming the missing tables.
• Only findings that really changed are recorded as resolved. Resolving a batch of findings counted every one it put forward, so a finding you ignored in another tab a moment earlier was written to the evidence log as resolved. The log now records only the findings whose status actually changed.
• A refused evidence entry is retried instead of lost. Saving a checklist attestation also writes an evidence entry. If the attestation saved but the evidence write was refused, the entry was lost for good, because repeating the same attestation is treated as no change. Such entries are now kept and written on the next attempt, and the screen reports the partial save.
• Sites already missing a table are repaired on upgrade. An earlier version could record the schema as up to date even when a table had not been created, and because that recorded version did not change in this release those sites would have skipped the new check forever. The tables are now confirmed to exist before the recorded version is trusted.

No settings or data changes otherwise.

Dragon Compliance now asks for a WordPress.org review once, on its own screen, after your first vulnerability scan or SBOM export.

What's new in 1.0.7

• One-time review prompt. After a scan completes or you export an SBOM, the Compliance screen shows a short request for a WordPress.org review. "Maybe later" hides it for a month and "No thanks" hides it for good. It never appears anywhere else in wp-admin.
• New dragoncompliance_sbom_exported action fires when an SBOM download is generated.
• The plugin directory listing now describes what the plugin does in its title and tags, so it is easier to find.

No behaviour, settings or data changes otherwise.

Adds the feed-source hook that lets Dragon Compliance Pro 1.0.4 provide zero-configuration vulnerability monitoring; nothing changes for free users.

= 1.0.6 =

• New: the vulnerability feed source can be supplied by Dragon Compliance Pro, which downloads it from Dragon Core so licensed sites need no Wordfence account. The free plugin only accepts www.wordfence.com or api.dragoncore.ltd as a source.
• Improvement: the dashboard and Findings screens now say when monitoring is configured but no vulnerability data has been downloaded yet, and show why the last download failed.
• Hardening: no redirects on the feed request, the Wordfence token is never exposed to other plugins, oversized feed records abort the refresh instead of consuming memory, and an empty local index is never revalidated conditionally.
• Free users: no change — your Wordfence token keeps working exactly as before.

Faster detection: a newly installed or updated plugin/theme is now scanned within minutes instead of waiting for the daily scan; secrets are authenticated at rest.

= 1.0.5 =

• Improvement: installing, updating, activating or removing a plugin/theme now triggers a debounced rescan, closing the up-to-24h window before a new vulnerability was noticed.
• Hardening: authenticated encryption for stored secrets.

Listing improvements: clearer free vs Pro breakdown, fuller FAQ and a live-preview blueprint.

• Docs: expanded plugin listing copy and FAQ.

Screenshots of every screen are now part of the WordPress.org listing.

• Added listing screenshots (dashboard, findings, inventory and SBOM, checklist, evidence).

Tested and verified on WordPress 7.1.

• Compatibility: tested up to WordPress 7.1.

Faster evidence sealing on busy sites via a new database index, a Delete-data-on-uninstall setting, and clearer empty states on the Inventory and Evidence screens.

Dragon Compliance is here: CRA and NIS2 evidence for WordPress.

Software inventory with CycloneDX SBOM export, continuous vulnerability monitoring against the Wordfence intelligence feed (local — no account, no data leaves your site), a CRA readiness checklist, and an evidence log. Built for the EU Cyber Resilience Act reporting obligations that begin 11 September 2026.