# WordPress vulnerability scanning and auto-patching > Every day we check your plugins, themes and WordPress version for known vulnerabilities, and install security fixes for you. Source: https://veldhost.eu/docs/wordpress-security-scanning Last verified: 2026-11-12 Most WordPress break-ins go through a plugin or theme with a known, published hole that nobody updated. So every day we check each WordPress site against a database of published vulnerabilities, and by default we install the fixed version for you. ## Which sites are checked Every live WordPress site: sites built on the WordPress stack, and sites with the WordPress or WooCommerce one-click app. It is not tied to a plan. A WordPress copy you uploaded yourself to another kind of site is not scanned. ## What is checked Once a day, on our own servers, we compare your site against the Wordfence Intelligence vulnerability feed: - **Plugins and themes:** each installed version against the known vulnerabilities for it. - **WordPress itself:** the installed version, and whether a newer major version is out. - **Changed files:** plugins from the WordPress.org directory are compared with their official release. Plugins whose files differ are listed. The vulnerability feed is downloaded to our servers and matched there, so your plugin list is never sent to Wordfence. The version and file checks ask WordPress.org, as WordPress itself does. ## Automatic fixes (the default) When a plugin or theme has a known vulnerability and a fixed version exists, we update it to that version for you: 1. We check the site loads before we start. If it is already failing, we change nothing and the issue stays on your list. 2. We keep a copy of the plugin's (or theme's) current folder, and, where we can, a snapshot of the site for our team to fall back on. 3. We install the fixed version. 4. We check that your home page and the WordPress login page still load. 5. If they do not, we put the previous version's folder back. Only that plugin or theme is reset, so orders, posts and comments written in the meantime stay. We never deactivate a plugin. A plugin with no fixed version yet stays as it is, and is listed for you to decide about. A vulnerability in WordPress itself is listed, not patched by us: WordPress installs its own security releases, and major versions wait for you (see below). ## Notify me only Prefer to update yourself, for example because you test every update on a [staging copy](https://veldhost.eu/docs/staging-copy) first? Switch the site to **Notify me only**. We keep checking every day and email you what we find, and the updating is up to you. ## Where you see it Open [Sites](https://manage.veldhost.eu/portal/sites) → your site → **Settings** and scroll to **WordPress security**. The Settings tab is shown to the account's owner, administrators and developers. - The top line says when the site was **Last checked** and which WordPress version it runs. A new site says *Not scanned yet* until its first check, which runs within a day. - **Automatic security fixes** shows **Automatic** or **Notify me only**. Press **Notify me only** (and confirm) to stop automatic fixes, or **Turn on automatic fixes** to start them again. - **Needs attention** lists open issues, most severe first: the plugin, theme or WordPress version, the issue and its CVE number when there is one, a link to the **Wordfence record**, the severity, and the installed version with the fixed one. A row also says when a fix was tried and undone, or when no fix exists yet. - **Files that differ from the official release** lists the plugins with changed files, and how many. - **Fixed for you recently** lists the latest fixes we installed. When something needs you, it also shows on [Home](https://manage.veldhost.eu/portal) under **Needs you**, as **WordPress security** with the site's name and a **Review** link. ### Dismiss a finding If you know about an issue and accept it, for example a plugin with no fix that you cannot do without yet, press **Dismiss** on its row and confirm. It leaves the list. The vulnerability itself stays until the plugin or theme is updated or removed. A dismissed finding comes back only if something changes, such as the issue returning after it was fixed. ### Changed files Changed files are often innocent: a hand edit, or one plugin patching another. If nobody on your side changed them, contact support and we compare them with a backup. ## Major WordPress versions WordPress installs its own security releases. A new major version waits for you, because a theme or plugin may not support it yet: try it on a [staging copy](https://veldhost.eu/docs/staging-copy) first. > **Caution:** If the update fails, or the site does not load afterwards, we restore the whole site to the restore point taken just before it. Anything written to the site during those minutes, such as an order or a comment, is undone with it. When one is out, **WordPress security** shows a row for it marked **Available**. Press **Update WordPress to VERSION** and confirm. The row shows **Queued** while it waits. We check the site loads, take a restore point, update WordPress and its database, and check the site again. We email you either way. If the update did not go through, **WordPress security** says so and gives the reason, and your site is left as it was. ## The emails We email the person who created the site and the account's owners and administrators when we find a new vulnerability, when we install a fix, when a fix had to be undone, when a plugin's files change, when a new major WordPress version is out, and when a major update you asked for finishes or fails. Several findings of the same kind from one check arrive as one email. All of these are in the **WordPress security** notice category. You can switch it off under **Settings** → [Profile](https://manage.veldhost.eu/portal/account), in **Email from us**: untick **WordPress security** and press **Save choices**. The checks and automatic fixes carry on either way. ## Related - [WordPress: your first steps](https://veldhost.eu/docs/wordpress-getting-started) - [The WordPress admin gate](https://veldhost.eu/docs/wordpress-admin-gate) - [Backups & one-click restore](https://veldhost.eu/docs/backups-and-restore) - [Staging copy](https://veldhost.eu/docs/staging-copy)