Title: Shieldome Security Scanner Author: nemanjashieldome Published: 6 Novembre 2026 Last modified: 6 Novembre 2026 --- Ricerca i plugin ![](https://ps.w.org/shieldome-scanner/assets/banner-772x250.png?rev=3787488) ![](https://ps.w.org/shieldome-scanner/assets/icon-256x256.png?rev=3787488) # Shieldome Security Scanner Di [nemanjashieldome](https://profiles.wordpress.org/nemanjashieldome/) [Scarica](https://downloads.wordpress.org/plugin/shieldome-scanner.1.3.0.zip) * [Dettagli](https://it.wordpress.org/plugins/shieldome-scanner/#description) * [Recensioni](https://it.wordpress.org/plugins/shieldome-scanner/#reviews) * [Installazione](https://it.wordpress.org/plugins/shieldome-scanner/#installation) * [Sviluppo](https://it.wordpress.org/plugins/shieldome-scanner/#developers) [Supporto](https://wordpress.org/support/plugin/shieldome-scanner/) ## Descrizione Shieldome Security Scanner brings automated vulnerability scanning into your WordPress dashboard. Instead of leaving wp-admin to run a security check, trigger an OWASP Top 10:2025 scan of your site and see the result – security grade, risk score, and findings – right where you already work. #### What it checks * Exposed configuration and backup files * Outdated WordPress core, themes, and plugins with known vulnerabilities * XML-RPC exposure and brute-force attack surface * Missing or misconfigured security headers * SSL/TLS certificate validity and configuration * Debug information and verbose error disclosure * User enumeration via author archives * OWASP Top 10:2025 checks – the same engine used by the Shieldome SaaS platform #### How it works This plugin does not scan your site locally – it calls the Shieldome API (app.shieldome. com) to run the scan and reports the result back to your dashboard. **Using it requires a Shieldome account and an active plan** (a free trial is available at signup); the plugin itself is free, but the scanning service it connects to is a paid SaaS product beyond the trial period. See [shieldome.com](https://shieldome.com) for current plans. #### Data sent to Shieldome When you trigger a scan, this plugin sends your configured target URL to the Shieldome API (app.shieldome.com) for scanning, authenticated with the API key you provide in Settings. Unless you turn it off in Settings, it also sends the list of installed plugins and themes (slug, version, active or not) and the WordPress version, with each scan and once a day (see External services below). When you click “Verify this site” in Settings, it sends this site’s home URL to Shieldome and publishes a one- time verification token (see External services). No posts, pages, users, comments or settings are transmitted; the scan metadata (status, grade, risk score) is sent back. See the [Shieldome Privacy Policy](https://shieldome.com/privacy) for details on how scan data is handled. ### External services This plugin is the dashboard for the Shieldome scanning service (https://shieldome. com) and does nothing without it. It connects to the Shieldome API at https://app. shieldome.com/api: * When you click “Start Security Scan”: it sends the target URL and your Shieldome API key, and, unless you turn it off in Shieldome > Settings, the list of installed plugins and themes (slug, version, active or not) and the WordPress version. While the scan runs it asks the API for the scan status. * Once a day (WP cron), when an API key is set and the plugin list option is on: the site URL and the same list of plugins, themes and WordPress version, so Shieldome can alert you to newly published vulnerabilities in them. * When you click “Verify this site” in Shieldome > Settings: this site’s home URL and your API key. Shieldome replies with a one-time token, which the plugin publishes at the public REST route `/?rest_route=/shieldome/v1/verify` (it returns only that token, and 404 when no verification is pending). Shieldome then requests that route from your site once to confirm you control it, and the plugin deletes the token when the site is verified. No posts, pages, users, comments or settings are sent. Shieldome then scans the target URL from its own servers, as an outside visitor would. Shieldome terms of service: https://shieldome.com/terms Shieldome privacy policy: https://shieldome.com/privacy ## Screenshot [⌊The Shieldome page in wp-admin: security grade, risk score, last scan and a one- click scan⌉⌊The Shieldome page in wp-admin: security grade, risk score, last scan and a one-click scan⌉[ The Shieldome page in wp-admin: security grade, risk score, last scan and a one- click scan [⌊Settings: API key, target URL, the plugin list option and one-click site verification⌉⌊ Settings: API key, target URL, the plugin list option and one-click site verification⌉[ Settings: API key, target URL, the plugin list option and one-click site verification ## Installazione 1. Upload the plugin files to `/wp-content/plugins/shieldome-scanner`, or install directly through the WordPress plugins screen. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. Go to **Shieldome Settings** and enter your Shieldome API key (get one at [app.shieldome.com/account](https://app.shieldome.com/account)– sign up for a free trial if you don’t have an account yet). 4. Go to **Shieldome** in the admin menu and click **Scan Now**. ## FAQ ### Do I need a Shieldome account? Yes. The plugin is a dashboard interface to the Shieldome scanning service – it needs an API key from a Shieldome account to run scans. Create one at [app.shieldome.com](https://app.shieldome.com); new accounts include a free trial. ### Is this plugin free? The plugin itself is free and open source (GPLv2). Running scans through it uses your Shieldome account’s plan the same way the Shieldome web dashboard does – there is no separate charge for using the plugin versus the website. ### Does this scan run on my server? No. Scans run on Shieldome’s infrastructure against your site’s public URL, the same as an external visitor would see it. This plugin only triggers the scan and displays the result – it adds no scanning load to your own server. ### What data does the plugin store on my site? Only your API key, target URL, and the summary of your most recent scan (grade, risk score, date) – stored as standard WordPress options. Full scan details and history live in your Shieldome account, not on your WordPress site. ### What does the plugin send to Shieldome? With each scan of this site, and once a day: the target URL and, unless you turn it off in Shieldome Settings, the list of installed plugins and themes (slug, version, active or not) and the WordPress version. The daily list lets Shieldome alert you when a newly published vulnerability affects an installed plugin, without waiting for the next scan. Shieldome checks that list against the Wordfence Intelligence vulnerability database, so inactive plugins and plugins that load nothing on public pages are covered too. No content, users or settings are sent. The list is not sent when the target URL is another site. ### Why verify my site? Shieldome runs its active checks (injection and access-control tests that send crafted requests to your site) only on sites whose owner has been verified, so nobody can run them against a site they do not control. Unverified sites still get the full passive assessment. The plugin verifies its own site in one click from Shieldome Settings; you can also verify with a DNS TXT record from your Shieldome account. ### Can I scan a site other than the one the plugin is installed on? Yes. Set a different **Target URL** in Shieldome Settings. ## Recensioni Non ci sono recensioni per questo plugin. ## Contributi e sviluppo “Shieldome Security Scanner” è un software open source. Le persone che hanno contribuito allo sviluppo di questo plugin sono indicate di seguito. Collaboratori * [ nemanjashieldome ](https://profiles.wordpress.org/nemanjashieldome/) [Traduci “Shieldome Security Scanner” nella tua lingua.](https://translate.wordpress.org/projects/wp-plugins/shieldome-scanner) ### Ti interessa lo sviluppo? [Esplora il codice](https://plugins.trac.wordpress.org/browser/shieldome-scanner/) segui il [repository SVN](https://plugins.svn.wordpress.org/shieldome-scanner/), segui il [log delle modifiche](https://plugins.trac.wordpress.org/log/shieldome-scanner/) tramite [RSS](https://plugins.trac.wordpress.org/log/shieldome-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.3.0 * New: one-click site ownership verification in Shieldome Settings, so scans of this site include Shieldome’s active checks without setting up a DNS record #### 1.2.1 * Fixed: a finished scan always showed grade “F” in the admin page; it now shows the real grade * Ready for translation (text domain shieldome-scanner); input sanitising and output escaping tightened * New: uninstalling removes the plugin’s options and its daily event * Readme: an “External services” section describing exactly what is sent to Shieldome and when #### 1.2.0 * New: the inventory is also sent once a day (WP cron), so scheduled scans use it and you are alerted when a newly published vulnerability affects an installed plugin; the settings page shows the last daily send #### 1.1.0 * New: scans of this site include the list of installed plugins, themes and the WordPress version (names and versions only; can be turned off in Settings), so every installed component, active or inactive, is checked against known vulnerabilities #### 1.0.1 * Fixed: scan requests were rejected due to an incorrect authentication header ( the plugin previously could not successfully start a scan under any configuration) * Fixed: the target URL was not being sent correctly to the scan API * Fixed: scan results (grade, risk score) were read from the wrong response field and never displayed after a completed scan #### 1.0.0 * Initial release ## Meta * Versione **1.3.0** * Ultimo aggiornamento **2 giorni fa** * Installazioni attive **Meno di 10** * Versione WordPress ** 5.8 o superiore ** * Testato fino alla versione **7.1.4** * Versione PHP ** 7.4 o superiore ** * Lingua * [English (US)](https://wordpress.org/plugins/shieldome-scanner/) * Tag * [owasp](https://it.wordpress.org/plugins/tags/owasp/)[security](https://it.wordpress.org/plugins/tags/security/) [security audit](https://it.wordpress.org/plugins/tags/security-audit/)[vulnerability scanner](https://it.wordpress.org/plugins/tags/vulnerability-scanner/) * [Visualizzazione avanzata](https://it.wordpress.org/plugins/shieldome-scanner/advanced/) ## Valutazioni Non sono state ancora inviate recensioni. [La tua recensione](https://wordpress.org/support/plugin/shieldome-scanner/reviews/#new-post) [Vedi tutte le recensioni](https://wordpress.org/support/plugin/shieldome-scanner/reviews/) ## Collaboratori * [ nemanjashieldome ](https://profiles.wordpress.org/nemanjashieldome/) ## Supporto Hai qualcosa da dire? Ti serve aiuto? [Chiedi nel forum di supporto](https://wordpress.org/support/plugin/shieldome-scanner/)