December 4, 2017 by Paul G. | Blog, Shield Pro, Updates

Shield Pro: WordPress Plugin Vulnerability Scanner

Shield Image

Today sees the release of another awesome feature for the Shield Security plugin.

A couple of years ago we had a feature like this in the Shield plugin, but we had to remove it because the data source was old and was no longer being updated at that time.

It’s never a good thing to add a feature to a service, and then have to remove it. We learned a simple lesson that day:

never rely on free software/services to provide a professional service.

One of the biggest exceptions to this is WordPress, of course. But the reality is that this, alongside a few other open source projects, are rare exceptions.

This is also why we created Shield Pro – we want our security system to be professional, always improving, and current. Free is great for a while, but it’s not sustainable.

So today, with our Shield Pro offering, we can now purchase commercial licenses for different services and bring them into Shield Security for access by everyone. Of course, this is a paid feature since it would be far from sustainable for us to provide this service for free as we need to somehow cover our costs for this too.

What are the new Vulnerability Scanner Features?

We’ve made a number of great improvements when compared with the old scanner.

1. Much cleaner Plugins page display

With the scanner turned on, you’ll be able to see the list of vulnerable plugins and their exact vulnerabilities, listed on the main WordPress Plugins page.

The list will show you the names of the vulnerabilities, the versions they were fixed in, and a more info link to find out further information. We’ve also provided a handy filter link so you can view only vulnerable plugins from the list.

2. Hide display of vulnerable plugins from non security administrators

For those administrators who handle the security for their clients and they don’t want questions about vulnerability notifications, you can hide these notices from everyone except security admins.

Shield Security: Plugin Vulnerabilities Example 1

Note: Security Administrators are those users who have been given the Security Key in the Security Admin module of the Shield plugin.

3. Automatic update of vulnerable plugins

This is a brand new feature and it lets you have WordPress automatically upgrade any vulnerable plugins on your site.

Important Notes:

  1. The plugin must have an update available! That might seem obvious, but many folks get confused when they’ve set a plugin to automatically update and it’s still vulnerable. If there isn’t an update for it, it can’t automatically update and will remain “vulnerable”.
  2. Automatic updates are performed by WordPress, not by Shield. This means it can take between 12-24hrs for a plugin to automatically update.  And that’s not from the time the vulnerability is detected, but from the time that WordPress detects the available update.
  3. If it’s a premium plugin that’s vulnerable, and your license is out of date, or invalid, the automatic update wont work.

4. Email notification of vulnerable plugins

Every time a new vulnerability is detected, an email will be sent with all the known vulnerabilities on the site.


  1. Emails are digest emails – you will receive 1 email per automatic scan. So 5 different vulnerabilities will be listed within a single email, not 5x different emails.
  2. You will be notified by email of a specific vulnerability only once. Shield will not repeatedly send notifications of known vulnerabilities.

How can you get this scanner?

You can start protecting your site with this scanner simply by upgrading to Shield Pro.

The scanner will be automatically enabled, but to adjust some of the options mentioned above, you’ll need to go to the Hack Protection module, and select “Plugin Vulnerabilities” section.

As always, please leave your comments below if you have any suggestions or feedback.


Hey gorgeous!

If you're curious about ShieldPRO and would like to explore the powerful features for protecting your WordPress sites, click here to get started today. (14-day satisfaction guarantee!)

You'll get all PRO features, including AI Malware Scanning, WP Config File Protection, Plugin and Theme File Guard, import/export, exclusive customer support, and so much more.

Try ShieldPRO Today →

ShieldPRO Testimonials
@markfloodlist's Gravatar @markfloodlist

So far, so very good

I’ve tried several security plugins and Simple Security Firewall has been the best so far (installed it 2 weeks ago). In particular I like that: – It’s easy to set up and offers lots of control – It sends me an email to let me know exactly who is logging…

@hvizdal's Gravatar @hvizdal

Great plugin

Works great in the background, makes me sleep well without worrying about my website security 🙂

@johnnynt's Gravatar @johnnynt

Very useful plugin

It is very useful for easy configuring of some basic security options.

@cgmayhem's Gravatar @cgmayhem

Great plugin!

Great plugin for security. Definitely recommend it!

Comments (5)

    Is this included in the iControlWP bundle I pay for or no?

      Hi Debbie,

      Good question, and thanks for asking. Yes, this is included in your iControlWP subscription! 🙂


    Shield Security provides great features for improvements when compared with the old scanner. This technique is like including a custom size in Printer Properties, with the exception of you include it through the gadget director.

    Nice information, Test vulnerabilities of a WordPress installation, WordPress plugins, hosting environment and web server by using this WordPress Security Scanner

    Valuable information, wordPress website scanner would check for other themes that are installed but not active; such themes might contain vulnerabilities.

Leave a Comment

Your email address will not be published. Required fields are marked *

Click to access the login or register cheese