Title: Pura Vida Vulnerability Scanner Author: trgomez Published: 15 Giugno 2026 Last modified: 16 Giugno 2026 --- Ricerca i plugin ![](https://ps.w.org/pura-vida-vulnerability-scanner/assets/banner-772x250.png?rev =3572401) ![](https://ps.w.org/pura-vida-vulnerability-scanner/assets/icon-256x256.png?rev =3572395) # Pura Vida Vulnerability Scanner Di [trgomez](https://profiles.wordpress.org/trgomez/) [Scarica](https://downloads.wordpress.org/plugin/pura-vida-vulnerability-scanner.1.1.0.zip) * [Dettagli](https://it.wordpress.org/plugins/pura-vida-vulnerability-scanner/#description) * [Recensioni](https://it.wordpress.org/plugins/pura-vida-vulnerability-scanner/#reviews) * [Installazione](https://it.wordpress.org/plugins/pura-vida-vulnerability-scanner/#installation) * [Sviluppo](https://it.wordpress.org/plugins/pura-vida-vulnerability-scanner/#developers) [Supporto](https://wordpress.org/support/plugin/pura-vida-vulnerability-scanner/) ## Descrizione Pura Vida Vulnerability Scanner checks everything installed on your site, including plugins, themes and WordPress core, against the **Wordfence Intelligence** vulnerability database, audits your site’s security posture, and shows you exactly what is at risk and how to fix it. It does not invent findings. It correlates your installed software and configuration against authoritative public sources (Wordfence Intelligence, CVE/MITRE, the WordPress. org update channel) and live checks of your own server. **Security overview** The dashboard opens with an at-a-glance status table covering: * WordPress Version: OK / Warning * Vulnerable Plugins: OK / Critical / High / Medium * Missing Headers: Present / Missing / N/A (HSTS, CSP, X-Frame-Options, X-Content- Type-Options, Referrer-Policy) * SSL: Valid / Expiring soon / Expired / N/A (certificate expiry) * DNS: OK / Issues / N/A * Email Security: SPF and DMARC (DKIM is selector-specific) * CDN/WAF: Detected / Not detected / N/A **What it does** * Inventories every installed plugin, theme and the WordPress core version. * Matches each item and version against a continuously updated vulnerability feed. * Shows severity (CVSS), the CVE identifier, a description and the recommended fix for every finding. * Audits your configuration and lists prioritized hardening recommendations (2FA, updates, HTTPS, file editor, and more). * Optional scheduled scans with email alerts when new critical/high issues appear. **Data sources** * Wordfence Intelligence Vulnerability Data Feed: free for personal and commercial use; includes CVE (MITRE) and CVSS information. * CVE (MITRE Corporation): the canonical vulnerability identifiers. * WordPress.org update channel: available core, plugin and theme updates. * Live site checks performed by the plugin: HTTP headers, SSL, DNS, SPF/DMARC and CDN/WAF. This product includes data that may be copyrighted by Defiant Inc. (Wordfence Intelligence) and by the MITRE Corporation (CVE®); their notices are displayed alongside the relevant findings. Developed by Pura Vida Design Studio, Open Source Security & Website Tools (https:// puravidadesignstudio.com/). ### External services This plugin connects to one external service to function: the Wordfence Intelligence Vulnerability Data Feed. **Wordfence Intelligence Vulnerability Data Feed (Defiant Inc.)** This plugin downloads the public WordPress vulnerability database from Wordfence in order to match it against the plugins, themes and core version installed on your site. * What is sent: your Wordfence Intelligence API key (in the request Authorization header) and your site’s URL (in the request User-Agent header), sent to https:// www.wordfence.com/. The list of plugins and themes installed on your site is NOT transmitted; matching is performed locally on your own server. * When it is sent: when you run a manual scan, and when a scheduled scan runs ( about once per day). The downloaded database is cached locally for 24 hours so the service is contacted at most about once per day. * Service terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/ * Privacy policy: https://www.wordfence.com/privacy-policy/ The plugin also performs read-only checks against your own site for the Security Overview: a loopback HTTP request to your own home URL (to inspect response headers and detect a CDN/WAF) and DNS lookups for your own domain (to check DNS resolution and SPF/DMARC records). These query your own domain and public DNS only; no data is sent to any third party. ## Installazione 1. Upload the `pura-vida-vulnerability-scanner` folder to `/wp-content/plugins/`, or install the ZIP via **Plugins Add New Upload Plugin**. 2. Activate the plugin through the **Plugins** menu in WordPress. 3. Go to **Pura Vida Vulnerability Scanner Settings** and paste a free Wordfence Intelligence API key (create one at your Wordfence account Integrations). 4. Open **Pura Vida Vulnerability Scanner** and click **Scan now**. ## FAQ ### Do I need a paid account anywhere? No. The Wordfence Intelligence feed is free for personal and commercial use. You only need to generate a free API key. ### Why do some rows show N/A? Your host may block loopback HTTP requests or disable PHP’s DNS/OpenSSL functions. Those checks are skipped safely while everything else still works. ### Why isn’t DKIM checked automatically? DKIM records live at a selector-specific hostname that varies per mail provider and can’t be reliably guessed. Pura Vida Vulnerability Scanner checks SPF and DMARC, which are deterministic. ### Does the plugin send my site data anywhere? It downloads the public vulnerability feed and matches it locally on your server. Your list of installed plugins is not transmitted. ### How often is the data updated? The feed is cached locally and refreshed on your chosen schedule (daily by default), so scans are fast and stay within the provider’s rate limits. ## Recensioni Non ci sono recensioni per questo plugin. ## Contributi e sviluppo “Pura Vida Vulnerability Scanner” è un software open source. Le persone che hanno contribuito allo sviluppo di questo plugin sono indicate di seguito. Collaboratori * [ trgomez ](https://profiles.wordpress.org/trgomez/) [Traduci “Pura Vida Vulnerability Scanner” nella tua lingua.](https://translate.wordpress.org/projects/wp-plugins/pura-vida-vulnerability-scanner) ### Ti interessa lo sviluppo? [Esplora il codice](https://plugins.trac.wordpress.org/browser/pura-vida-vulnerability-scanner/) segui il [repository SVN](https://plugins.svn.wordpress.org/pura-vida-vulnerability-scanner/), segui il [log delle modifiche](https://plugins.trac.wordpress.org/log/pura-vida-vulnerability-scanner/) tramite [RSS](https://plugins.trac.wordpress.org/log/pura-vida-vulnerability-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 * Fix: vulnerability feed could get stuck on “not downloaded yet” after a rate- limited or failed download. Added a 30-minute cooldown so the plugin no longer retries on every scan. * Improvement: failed downloads are now logged (when WP_DEBUG is enabled) and stored so the dashboard can explain why there is no data. * Improvement: download timeout increased to 60 seconds to avoid false failures on slow hosts. #### 1.0.9 * Removed Plugin URI so it no longer duplicates the Author URI. #### 1.0.8 * Renamed plugin to Pura Vida Vulnerability Scanner; updated slug/text domain, Plugin URI and contributors per WordPress.org pre-review. #### 1.0.7 * Set Tested up to 7.0 (the current WordPress release). #### 1.0.6 * Set Tested up to 6.8 (a current, released WordPress version). #### 1.0.5 * Fixed: set the Tested up to header to a version the Plugin Check recognizes as released. #### 1.0.4 * Fixed: resolved all Plugin Check findings (Tested up to header, Domain Path, prefixed view variables, removed discouraged functions, justified socket/close and per-field sanitization). #### 1.0.3 * Added: External services disclosure (required for WordPress.org listing). #### 1.0.2 * Fixed: status overview table header labels now align with their columns. #### 1.0.1 * Fixed: status overview table now renders with full styling (asset cache busting). * Improved: manual scans re-use the cached vulnerability database, so repeated scans no longer hit the provider’s daily download limit. * Improved: clearer messaging about the once-per-day database caching behavior. #### 1.0.0 * Initial release: vulnerability scanning for plugins, themes and core; security overview table; configuration recommendations; scheduled scans and email alerts. ## Meta * Versione **1.1.0** * Ultimo aggiornamento **4 mesi fa** * Installazioni attive **Meno di 10** * Versione WordPress ** 5.6 o superiore ** * Testato fino alla versione **7.0.7** * Versione PHP ** 7.2 o superiore ** * Lingua * [English (US)](https://wordpress.org/plugins/pura-vida-vulnerability-scanner/) * Tag * [hardening](https://it.wordpress.org/plugins/tags/hardening/)[malware](https://it.wordpress.org/plugins/tags/malware/) [scanner](https://it.wordpress.org/plugins/tags/scanner/)[security](https://it.wordpress.org/plugins/tags/security/) [vulnerability](https://it.wordpress.org/plugins/tags/vulnerability/) * [Visualizzazione avanzata](https://it.wordpress.org/plugins/pura-vida-vulnerability-scanner/advanced/) ## Valutazioni Non sono state ancora inviate recensioni. [La tua recensione](https://wordpress.org/support/plugin/pura-vida-vulnerability-scanner/reviews/#new-post) [Vedi tutte le recensioni](https://wordpress.org/support/plugin/pura-vida-vulnerability-scanner/reviews/) ## Collaboratori * [ trgomez ](https://profiles.wordpress.org/trgomez/) ## Supporto Hai qualcosa da dire? Ti serve aiuto? [Chiedi nel forum di supporto](https://wordpress.org/support/plugin/pura-vida-vulnerability-scanner/)