Title: Aardwolf Security Scanner Author: aardwolfsec Published: 2026-يىلى 22-ئىيۇل Last modified: 2026-يىلى 25-ئىيۇل --- قىستۇرما ئىزدە ![](https://ps.w.org/aardwolf-security-scanner/assets/banner-772x250.png?rev=3619131) ![](https://ps.w.org/aardwolf-security-scanner/assets/icon-256x256.png?rev=3619131) # Aardwolf Security Scanner يازغۇچى [aardwolfsec](https://profiles.wordpress.org/aardwolfsec/) [چۈشۈر](https://downloads.wordpress.org/plugin/aardwolf-security-scanner.1.2.6.zip) * [تەپسىلاتلار](https://ug.wordpress.org/plugins/aardwolf-security-scanner/#description) * [باھالاشلار](https://ug.wordpress.org/plugins/aardwolf-security-scanner/#reviews) * [ئورنىتىش](https://ug.wordpress.org/plugins/aardwolf-security-scanner/#installation) * [ئىجادىيەت](https://ug.wordpress.org/plugins/aardwolf-security-scanner/#developers) [قوللاش](https://wordpress.org/support/plugin/aardwolf-security-scanner/) ## چۈشەندۈرۈش Aardwolf Security Scanner checks your WordPress site for the security problems attackers look for first. It runs a set of read-only checks, gives each finding a severity rating, and tells you how to fix it in clear language. You can run a scan on demand or on a schedule. The plugin does not attack your server or change any files, and it does not send your data anywhere. Every check runs on your own install. #### What it checks * Software updates. Outdated WordPress core, plugins and themes, plus inactive plugins and themes that still sit on disk. * Accounts and authentication. The default «admin» username, username enumeration through author archives and the REST API, risky registration defaults, and missing brute-force protection on the login form. * Configuration. The dashboard file editor, exposed debug output, missing or placeholder security keys and salts, the default «wp_» table prefix, and whether the admin area is forced over HTTPS. * Information exposure. A reachable XML-RPC endpoint, the version-leaking readme. html, the generator meta tag, directory browsing, and sensitive files such as debug logs, .git, .env and config backups left in the web root. * HTTP security headers. Missing X-Frame-Options, X-Content-Type-Options, Referrer- Policy, Content-Security-Policy and HSTS. * Transport and environment. Sites still on plain HTTP, and end-of-life PHP versions. * File permissions. World-readable or world-writable wp-config.php and site root. * Known vulnerabilities. Installed plugins that have been removed from the WordPress. org directory, which often means a plugin was pulled for an unresolved security issue. Each finding comes with a severity rating and clear steps to fix it. Every scan produces a security score out of 100 so you can track progress over time. #### Scheduled scans and email alerts Run a scan automatically once a day or once a week. The plugin can email you when the score drops, when the number of problems goes up, or when a high-risk issue appears. You can also choose to get an email after every scan. #### Export reports Save the latest scan as a CSV file, or open a clean printable report and save it as a PDF from your browser. #### About Aardwolf Security This plugin is made by [Aardwolf Security](https://aardwolfsecurity.com/). Automated checks are a good first line of defence, but they are not a replacement for a manual penetration test by a qualified tester. ### External services This plugin connects to one external service, the official WordPress.org Plugin API (https://api.wordpress.org/plugins/info/1.0/). * What it is used for: the Known Vulnerabilities check asks this API whether any of your installed plugins have been removed from the WordPress.org directory. * What data is sent, and when: the directory slug of each installed plugin (for example «akismet») is sent when a scan runs. No personal data, site content or credentials are sent. Responses are cached for 24 hours. * Terms and privacy: this is a WordPress.org service, covered by the [WordPress.org Terms](https://wordpress.org/about/) and [Privacy Policy](https://wordpress.org/about/privacy/). The plugin also sends requests to your own site (its own URL) to inspect response headers and look for exposed files. These stay on your own server. ## ئورنىتىش 1. Upload the aardwolf-security-scanner folder to /wp-content/plugins/, or install the ZIP from Plugins, Add New, Upload Plugin. 2. Activate the plugin from the Plugins screen. 3. Open Security Scanner in the admin menu and click Run Security Scan. ## FAQ ### Is it safe to run on a production site? Yes. All checks are read-only. The plugin sends a few requests to your own site to inspect headers and look for exposed files, which is harmless. Keep a current backup before you change any settings, as good practice. ### Does it fix things automatically? No. The scanner reports each problem and tells you how to fix it. You make the changes yourself, such as editing wp-config.php, adjusting file permissions, or updating settings. ### Why does a check say it could not complete? Some checks send a request to your own site. If your host blocks these requests, those checks are skipped instead of failed, and the result explains what to check by hand. ## باھالاشلار بۇ قىستۇرمىغا تېخى باھا يېزىلمىدى. ## تۆھپىكار ۋە ئىجادكار «Aardwolf Security Scanner» كودى ئوچۇق يۇمشاق دېتال. تۆۋەندىكى كىشىلەر بۇ قىستۇرمىغا تۆھپە قوشقان. تۆھپىكار * [ aardwolfsec ](https://profiles.wordpress.org/aardwolfsec/) [«Aardwolf Security Scanner» نى تىلىڭىزغا تەرجىمە قىلىڭ](https://translate.wordpress.org/projects/wp-plugins/aardwolf-security-scanner) ### ئىجادىيەتكە قىزىقامسىز؟ [كودقا كۆز يۈگۈرتۈپ](https://plugins.trac.wordpress.org/browser/aardwolf-security-scanner/)، [SVN خەزىنە](https://plugins.svn.wordpress.org/aardwolf-security-scanner/) تەكشۈرۈپ ياكى [RSS](https://plugins.trac.wordpress.org/log/aardwolf-security-scanner/?limit=100&mode=stop_on_copy&format=rss) ئارقىلىق [ئىجادىيەت خاتىرىسى](https://plugins.trac.wordpress.org/log/aardwolf-security-scanner/) گە مۇشتەرى بولغىلى بولىدۇ. ## ئۆزگىرىش خاتىرىسى #### 1.2.6 * Rewrote the readme in plainer language and updated the tags for the plugin directory. No functional changes. #### 1.2.5 * Printable report stylesheet is now registered and enqueued via wp_enqueue_style()/ wp_print_styles() instead of a hard-coded link tag. #### 1.2.4 * Moved the printable report’s CSS to a bundled stylesheet (no inline style tag) and removed the inline print-button script. * Removed an unnecessary wp-admin/includes/plugin.php include in the login-protection check. * Corrected the Contributors username. #### 1.2.3 * Removed the duplicate Plugin URI header (it matched the Author URI); kept the Author URI. #### 1.2.2 * Output all logos via escaped image tags for cleaner markup. * Documented the WordPress.org Plugin API usage under a new «External services» readme section. #### 1.2.1 * Resolved WordPress.org Plugin Check findings: removed the unused Domain Path header and the discouraged load_plugin_textdomain() call, rewrote the CSV export without direct filesystem functions, scoped template variables, tidied the uninstall routine, and updated «Tested up to». #### 1.2.0 * Removed the optional WPScan API integration and the one-click hardening feature. These are planned for a future Pro add-on. The free directory-removal check, which needs no API key, remains. #### 1.1.1 * Scheduled scans now let you choose the time of day, and the day of the week for weekly scans, in your site timezone. * Fixed the oversized admin menu icon. * Failed checks now show a problem-worded title (for example «Usernames are publicly enumerable») instead of the healthy-state wording. * The user-enumeration check now tests the live vectors (REST users endpoint and the ?author= redirect) rather than stored user data. #### 1.1.0 * Added scheduled scans (daily or weekly) with email alerts on regression. * Added CSV and printable PDF report export. * Added a Known Vulnerabilities check. * Bumped «Tested up to» and refreshed the settings screen. #### 1.0.0 * Initial release: security checks across six categories, a security score, and optional one-click hardening. ## Meta * Version **1.2.6** * ئاخىرقى يېڭىلانغان ۋاقىت **3 ھەپتە بۇرۇن** * ئاكتىپ ئورنىتىش سانى **10 دىن ئاز** * WordPress نەشرى ** 5.6 ياكى يۇقىرى ** * **7.0.4** دا سىنالغان * PHP نەشرى ** 7.2 ياكى يۇقىرى ** * تىل * [English (US)](https://wordpress.org/plugins/aardwolf-security-scanner/) * بەلگە * [hardening](https://ug.wordpress.org/plugins/tags/hardening/)[security](https://ug.wordpress.org/plugins/tags/security/) [security audit](https://ug.wordpress.org/plugins/tags/security-audit/)[security scanner](https://ug.wordpress.org/plugins/tags/security-scanner/) [vulnerability](https://ug.wordpress.org/plugins/tags/vulnerability/) * [ئالىي كۆرۈنۈش](https://ug.wordpress.org/plugins/aardwolf-security-scanner/advanced/) ## دەرىجە No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/aardwolf-security-scanner/reviews/#new-post) [بارلىق ئىنكاسنى كۆرسەت](https://wordpress.org/support/plugin/aardwolf-security-scanner/reviews/) ## تۆھپىكار * [ aardwolfsec ](https://profiles.wordpress.org/aardwolfsec/) ## قوللاش چۈشەندۈرۈشىڭىز بارمۇ؟ ياردەم لازىممۇ؟ [قوللاش مۇنبىرىنى كۆرسەت](https://wordpress.org/support/plugin/aardwolf-security-scanner/)