Most WordPress break-ins go through a plugin or theme with a known, published hole that nobody updated. So every day we check each WordPress site against a database of published vulnerabilities, and by default we install the fixed version for you.
Which sites are checked
Every live WordPress site: sites built on the WordPress stack, and sites with the WordPress or WooCommerce one-click app. It is not tied to a plan. A WordPress copy you uploaded yourself to another kind of site is not scanned.
What is checked
Once a day, on our own servers, we compare your site against the Wordfence Intelligence vulnerability feed:
- Plugins and themes: each installed version against the known vulnerabilities for it.
- WordPress itself: the installed version, and whether a newer major version is out.
- Changed files: plugins from the WordPress.org directory are compared with their official release. Plugins whose files differ are listed.
The vulnerability feed is downloaded to our servers and matched there, so your plugin list is never sent to Wordfence. The version and file checks ask WordPress.org, as WordPress itself does.
Automatic fixes (the default)
When a plugin or theme has a known vulnerability and a fixed version exists, we update it to that version for you:
- We check the site loads before we start. If it is already failing, we change nothing and the issue stays on your list.
- We keep a copy of the plugin's (or theme's) current folder, and, where we can, a snapshot of the site for our team to fall back on.
- We install the fixed version.
- We check that your home page and the WordPress login page still load.
- If they do not, we put the previous version's folder back. Only that plugin or theme is reset, so orders, posts and comments written in the meantime stay.
We never deactivate a plugin. A plugin with no fixed version yet stays as it is, and is listed for you to decide about. A vulnerability in WordPress itself is listed, not patched by us: WordPress installs its own security releases, and major versions wait for you (see below).
Notify me only
Prefer to update yourself, for example because you test every update on a staging copy first? Switch the site to Notify me only. We keep checking every day and email you what we find, and the updating is up to you.
Where you see it
Open Sites → your site → Settings and scroll to WordPress security. The Settings tab is shown to the account's owner, administrators and developers.
- The top line says when the site was Last checked and which WordPress version it runs. A new site says Not scanned yet until its first check, which runs within a day.
- Automatic security fixes shows Automatic or Notify me only. Press Notify me only (and confirm) to stop automatic fixes, or Turn on automatic fixes to start them again.
- Needs attention lists open issues, most severe first: the plugin, theme or WordPress version, the issue and its CVE number when there is one, a link to the Wordfence record, the severity, and the installed version with the fixed one. A row also says when a fix was tried and undone, or when no fix exists yet.
- Files that differ from the official release lists the plugins with changed files, and how many.
- Fixed for you recently lists the latest fixes we installed.
When something needs you, it also shows on Home under Needs you, as WordPress security with the site's name and a Review link.
Dismiss a finding
If you know about an issue and accept it, for example a plugin with no fix that you cannot do without yet, press Dismiss on its row and confirm. It leaves the list. The vulnerability itself stays until the plugin or theme is updated or removed. A dismissed finding comes back only if something changes, such as the issue returning after it was fixed.
Changed files
Changed files are often innocent: a hand edit, or one plugin patching another. If nobody on your side changed them, contact support and we compare them with a backup.
Major WordPress versions
WordPress installs its own security releases. A new major version waits for you, because a theme or plugin may not support it yet: try it on a staging copy first.
Caution: If the update fails, or the site does not load afterwards, we restore the whole site to the restore point taken just before it. Anything written to the site during those minutes, such as an order or a comment, is undone with it.
When one is out, WordPress security shows a row for it marked Available. Press Update WordPress to VERSION and confirm. The row shows Queued while it waits. We check the site loads, take a restore point, update WordPress and its database, and check the site again. We email you either way.
If the update did not go through, WordPress security says so and gives the reason, and your site is left as it was.
The emails
We email the person who created the site and the account's owners and administrators when we find a new vulnerability, when we install a fix, when a fix had to be undone, when a plugin's files change, when a new major WordPress version is out, and when a major update you asked for finishes or fails. Several findings of the same kind from one check arrive as one email.
All of these are in the WordPress security notice category. You can switch it off under Settings → Profile, in Email from us: untick WordPress security and press Save choices. The checks and automatic fixes carry on either way.