Dragon Compliance

CRA and NIS2 evidence for WordPress: software inventory, SBOM export, vulnerability monitoring and a readiness checklist — entirely local, no account, no data leaves your site.

Why now

The EU Cyber Resilience Act's reporting obligations begin 11 September 2026 (24h/72h/14d incident reporting), with main obligations following in December 2027. NIS2 pulls site owners in through supply-chain duties. If you ship software or run sites for clients in the EU, the paperwork era has started.

The tabs

• Dashboard — readiness score, open findings, monitoring status.
• Inventory & SBOM — every plugin, theme and core with versions; export as CycloneDX SBOM.
• Findings — your inventory checked against the Wordfence vulnerability intelligence feed. Checks run locally against a downloaded copy: your plugin list is never sent anywhere.
• Checklist — CRA readiness items with pass/attest states.
• Evidence — a log of compliance-relevant events (scans, updates, attestations).

Data & privacy

Everything stays on your server. The only outbound request is downloading the public vulnerability feed. Uninstall keeps your evidence by default — evidence you can lose by uninstalling isn't evidence.

Dragon Compliance Pro

White-label reports for clients/auditors, SBOM snapshots and diffs with SPDX export, a hash-chained tamper-evident evidence log, time-to-patch metrics, alert routing (email, signed webhook, Slack), and a dedicated NIS2 view.

Uninstall

Deleting the plugin keeps all its data by default, so a reinstall picks up where you left off. To remove everything on uninstall, opt in first:

wp option update dragoncompliance_delete_data_on_uninstall 1