=== JustWhat Security Audit ===
Contributors: justwhat, pbpyrojust
Tags: security, audit, vulnerabilities, hardening, headers
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Security checks in wp-admin: updates, PHP, risky settings, headers, and (with permission) pentest-style checks. Optional vulnerability lookups.

== Description ==

JustWhat Security Audit checks your WordPress site for what attackers look for first and tells you why each problem matters and how to fix it. It only reports: it changes nothing on your site, and it isn't a firewall or a malware scanner, so use it alongside your security plugin and backups.

**Always on (passive checks)**

* Updates: WordPress, plugins and themes with updates waiting, inactive plugins and unused themes, automatic security updates turned off, a PHP version past its security support.
* WordPress settings: a site address that isn't HTTPS, open registration that hands out a powerful role, PHP errors shown to visitors, a debug log in a public folder, missing or default security keys, the theme and plugin file editor, a user called "admin", a world-writable wp-config.php, XML-RPC.
* What visitors get: security headers on your home page (HSTS, frame protection, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy), version numbers shown in headers and the page source, and security.txt.

These only read what WordPress knows about itself and what any visitor gets.

**Pentest-style checks (off until you confirm written permission)**

The first step of a penetration test: requests to your own site that a normal visitor wouldn't make. Exposed files (.env, .git, wp-config.php backups, database dumps, debug and error logs, phpinfo pages), a listed uploads folder, usernames found through /?author=1 or the REST API, xmlrpc.php answering, readme.html showing your version, open redirects, and error pages that reveal server paths. Each is one GET request to a well-known address of this site. Nothing logs in, submits forms, guesses passwords, uploads or changes anything, and a file only counts as exposed when its content looks like the real file.

**Known vulnerabilities (off until you turn it on)**

Checks WordPress and every installed plugin and theme (not just the ones a page loads) against the Wordfence Intelligence vulnerability database, with how serious each one is and the version that fixes it.

**What you get**

* A security grade (A+ to F) on the same scale as the JustWhat Security Audit command-line tool and Vinny, with findings grouped by kind and sorted by severity.
* For each finding: what was found, why it matters and how to fix it.
* Built-in help (Security Audit → Help, plus a Help tab on each screen).

== Pentest-style checks: written permission required ==

**Only turn on the pentest-style checks for a site you own, or that you have the site owner's written permission to test.** In many countries, and under many hosting companies' terms, requests like these count as security testing even when each one is harmless, and testing without permission can be illegal. Permission from a site's owner doesn't cover the hosting company's own systems.

They stay off until an administrator ticks the written-permission statement under Security Audit → Settings. The plugin saves who agreed, when, and the exact statement; withdrawing permission is saved too. If the site moves to a new address, permission is asked for again.

== No warranty, no liability ==

This plugin is free software, provided "as is", without warranty of any kind, under the GNU General Public License. Its authors accept no liability for any damage or claim arising from its use. You are solely responsible for having permission for the checks you run and for how you use the results. No automated check finds every problem; a clean result doesn't mean a site is secure.

== External services ==

This plugin connects to one outside service, and only when you turn it on:

**Vinny vulnerability lookups** (vinny.justwhat.net, run by the plugin's author). When "Vulnerability lookups" is on under Security Audit → Settings, each check sends the WordPress version and the slug and version of every installed plugin and theme to https://vinny.justwhat.net/api/wp-vulns/. Vinny matches them against the Wordfence Intelligence vulnerability database and returns the matches. Nothing else is sent: no site address, users or content. Vinny keeps a hashed form of the sending network's IP address, the number of components and matches, and the plugin version for 30 days, only to limit abuse. Vinny's terms: https://vinny.justwhat.net/legal/terms/ · privacy policy: https://vinny.justwhat.net/legal/privacy/

Vulnerability data is provided by Wordfence Intelligence (https://www.wordfence.com/threat-intel/), free for commercial use with attribution; records may include CVE data from MITRE (https://www.cve.org/Legal/TermsOfUse), whose notices are shown with the matches.

WordPress's own update checks with wordpress.org run as they always do; the plugin asks WordPress for their results.

The rest of the plugin only makes requests to your own site's address.

== Installation ==

1. Install from Plugins → Add New, or upload the zip under Plugins → Add New → Upload Plugin.
2. Activate it, then open Security Audit and select Run checks.
3. Optional: under Security Audit → Settings, confirm written permission to turn on the pentest-style checks, and turn on vulnerability lookups.

== Frequently Asked Questions ==

= Does it change anything on my site? =

No. It reads settings and makes requests to your own site, then reports. Fixes are up to you; each finding says how.

= Is it a firewall or malware scanner? =

No. It finds weaknesses before someone uses them. Keep a security plugin or your host's firewall for blocking attacks and scanning files.

= Why are some checks off? =

The pentest-style checks request addresses a normal visitor wouldn't, which counts as security testing, so they need your written-permission confirmation. The vulnerability lookup sends component versions to an outside service, so it waits for you to turn it on.

= My CDN adds security headers, but the plugin says they're missing. =

The plugin requests your home page from the server, which may go around your CDN or firewall. If your CDN adds the headers, visitors get them; the plugin can't see them from inside.

= Is anything sent outside my site? =

Only if you turn on vulnerability lookups: component slugs and versions, to Vinny. See External services.

== Screenshots ==

1. Dashboard: the grade, findings by severity and which kinds of checks ran.
2. Findings with why each one matters and how to fix it.
3. Settings: the written-permission statement for pentest-style checks and the vulnerability lookup switch.

== Changelog ==

= 1.1.0 =
* New name: JustWhat Security Audit (was Universal Security Audit). Your checks, permission record and settings carry over; deactivate and delete the old copy.
* Changed: Settings → Checks to keep (10 by default, up to 50) sets how many checks are saved with their findings.

= 1.0.0 =
* First release: passive checks (updates, PHP, WordPress settings, headers, security.txt), pentest-style checks behind a recorded written-permission statement, optional Wordfence vulnerability lookups through Vinny, built-in help.
