WPDeeply
Documentation
WPDeeply Risk Monitor documentation: install, first scan, understanding results.
Everything you need to run and read a scan. If something here is unclear, that is a documentation bug — tell us at triumphoid@proton.me.
Getting started
- Install — download the ZIP from the download page, then Plugins → Add New Plugin → Upload Plugin.
- First scan — open WPDeeply → Risk Report and press Scan. It takes a few seconds and makes no changes to your site.
- Dashboard — a security score, then findings grouped by what to do about them.
Understanding results
- Critical — known vulnerability, component active, exploit path plausible. Act now.
- High — known vulnerability, or abandoned software you depend on.
- Medium — unresolved issues in inactive components, or unsupported versions.
- Low — housekeeping: unused themes, stale inactive plugins.
- Abandoned — no update in a long time, or removed from WordPress.org.
- Inactive — installed but switched off; still code on your server.
Troubleshooting
- A vulnerability I know about is not detected — check the plugin folder name matches the WordPress.org slug. Renamed folders break matching.
- A false positive — forks and white-labelled bundles keep the original version string. Report it and we will exclude the fork.
- Version detection problems — plugins that hard-code an old version in their header will report that version. Nothing can fix this from the outside.
- Connection problems — the scan needs outbound HTTPS. Hosts that block outbound requests will return an empty match set rather than a false all-clear.
Privacy
A scan sends component slugs and version numbers, your WordPress version and your PHP version. It does not send post content, user data, email addresses or file contents. See security for detail.