CRA and NIS2 evidence for WordPress: software inventory, SBOM export, vulnerability monitoring and a readiness checklist — entirely local, no account, no data leaves your site.
Why now
The EU Cyber Resilience Act's reporting obligations begin 11 September 2026 (24h/72h/14d incident reporting), with main obligations following in December 2027. NIS2 pulls site owners in through supply-chain duties. If you ship software or run sites for clients in the EU, the paperwork era has started.
The tabs
- Dashboard — readiness score, open findings, monitoring status.
- Inventory & SBOM — every plugin, theme and core with versions; export as CycloneDX SBOM.
- Findings — your inventory checked against the Wordfence vulnerability intelligence feed. Checks run locally against a downloaded copy: your plugin list is never sent anywhere.
- Checklist — CRA readiness items with pass/attest states.
- Evidence — a log of compliance-relevant events (scans, updates, attestations).
Data & privacy
Everything stays on your server. The only outbound request is downloading the vulnerability feed — from www.wordfence.com with your own token, or from api.dragoncore.ltd when Dragon Compliance Pro is licensed (see below). Your inventory is never uploaded either way. Uninstall keeps your evidence by default — evidence you can lose by uninstalling isn't evidence.
Dragon Compliance Pro
Zero-configuration vulnerability monitoring (no Wordfence account — the feed comes from Dragon Core), white-label reports for clients/auditors, SBOM snapshots and diffs with SPDX export, a hash-chained tamper-evident evidence log, time-to-patch metrics, alert routing (email, signed webhook, Slack), and a dedicated NIS2 view.
Uninstall
Deleting the plugin keeps all its data by default, so a reinstall picks up where you left off. To remove everything on uninstall, opt in first:
wp option update dragoncompliance_delete_data_on_uninstall 1