WPDeeply Risk Monitor
The free WordPress plugin that finds vulnerable, abandoned and risky software on your site.
Installs from your WordPress admin. No account, no site key, and no data leaves the site except the component list it needs to look up.
What happens when you run a scan
Inventory
Reads the plugin, theme and core versions from your install, including inactive ones and any parent themes.
Match
Compares each version against published vulnerability records and WordPress.org maintenance data.
Rank
Weighs severity against whether the component is active and whether a patched version exists.
Report
Writes one line per component and a remediation sentence for anything that needs a decision from you.
What a single finding contains
Enough to act without opening a second tab. No CVSS vector you have to interpret, no scoring dashboard.
What leaves your site, and what does not
plugin versions
theme slugs and versions
WordPress version
PHP version
user accounts or email addresses
file contents
licence keys or credentials
visitor analytics
The free plugin makes one outbound request per scan, and only when you press the button. Scheduled scans in Pro use the same request on a cron interval you set.
Why another security plugin?
Most WordPress security tools are built around traffic: firewalls, login limits, bot filtering. Risk Monitor is built around inventory. It answers a narrower question — is the software already installed on this site safe to keep running? — and answers it in a form you can act on in ten minutes.
That question matters because the majority of compromised WordPress sites are not broken into through clever new exploits. They are broken into through a plugin that had a published fix available for months.
What a scan actually does
- Reads the installed version of every plugin and theme, plus WordPress core and PHP.
- Matches those versions against published vulnerability records.
- Checks WordPress.org listings for removals, closures and long update gaps.
- Flags inactive components, which still ship code to your server.
- Looks for basic configuration exposure such as
WP_DEBUGleft enabled in production.
No files are uploaded, no content is read, and nothing is executed against your site from outside. A scan is a version comparison, which is why it takes seconds rather than hours.
The output
Every finding lands in one of three buckets, in priority order:
- Fix today — known vulnerability, component active, patch available.
- Replace soon — abandoned, removed from WordPress.org, or unsupported.
- Review — inactive plugins, leftover themes, configuration flags.
If a vulnerability has no patched version, Risk Monitor never tells you to “update”. It tells you to restrict or replace, and says so plainly.
Limits worth knowing
Version matching is imperfect. Forked plugins, white-labelled bundles and hand-edited version strings can produce both false positives and false negatives. Our methodology page explains exactly how matching works, and how to report a bad match.
Questions people ask before installing
Will it slow the site down?
Scans run on demand and write to a single option row. Nothing runs on front-end page loads.
Does it change anything on my site?
No. It reports and never updates, deactivates or deletes a component for you.
Does it detect malware already on the site?
No. It finds the risky software that lets malware in. For an infected site, start with the malware guides.
Does it work with premium plugins?
Yes, where a disclosure has been published. Commercial plugins outside the directory have thinner maintenance data.
Can I run it on client sites?
Yes. The free plugin has no site limit; Pro and Agency add central monitoring across installs.
What happens if I uninstall it?
It removes its own options and scheduled events. No orphan tables, no leftover cron entries.