> ## Documentation Index
> Fetch the complete documentation index at: https://mainwp-docs-openapi-6-1-5-fixes.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability Checker

> MainWP Vulnerability Checker extension uses either the free MainWP NVD API or the WPScan Vulnerability Database API to identify known vulnerabilities in WordPress core, plugins, and themes on your Child Sites.

## What You'll Learn

* Scanning Child Sites for known WordPress core, plugin, and theme vulnerabilities
* Scheduling automated vulnerability checks
* Using MainWP NVD API vs WPScan Vulnerability Database
* Acting on vulnerability scan results

***

<div id="addon-data" style={{display: 'none'}} data-title="Vulnerability Checker" data-purchase-url="https://mainwp.com/extension/vulnerability-checker/" data-pricing-tier="free" data-bundle="Essentials" data-addon-type="extension" data-version="5.0.4" data-developer="MainWP" data-changelog-url="https://mainwp.com/changelog/mainwp-vulnerability-checker-extension/" data-requirements="MainWP Dashboard 4.5+, MainWP Child 4.1.7+" data-owned-by="Jestart LLC" data-privacy-url="https://mainwp.com/mainwp-plugin-privacy-policy/" />

<Info>
  **Extension Add-on** - This add-on provides standalone functionality within MainWP Dashboard. No third-party plugins required.
</Info>

[MainWP Vulnerability Checker](https://mainwp.com/extension/vulnerability-checker/) can use either the [WPScan Vulnerability Database API](https://wpscan.com/) or the [MainWP NVD API](https://nvd.nist.gov/) to identify known vulnerabilities in WordPress core, plugins, and themes on your Child Sites. You can review vulnerability details directly from your MainWP Dashboard.

* Get email notifications after scheduled vulnerability checks.
* Update vulnerable plugins and themes when a fixed version is available.
* Delete vulnerable plugins and themes.

## WPScan Vulnerability Database

The WPScan Vulnerability Database is an online browsable version of WPScan's data files that are used to detect known WordPress core, plugin, and theme vulnerabilities. This database has been compiled by the WPScan Team and various other contributors since WPScan's release. The development of the WPScan Vulnerability Database was funded by [BruCON](http://brucon.org/)'s 5by5 project.

To use this service, register with WPScan and enter the API token from your profile in the extension settings. WPScan offers a free tier with a limit of 25 API requests per day, and paid API access increases the daily request limit.

## MainWP NVD Database

This API is free and does not require a WPScan API token. The NVD is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables the automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics.

## Check Your Sites for Vulnerabilities

<Steps>
  <Step title="Login to your MainWP Dashboard" />

  <Step title="Go to MainWP > Add-ons > Security > Vulnerability Checker" />

  <Step title="Go to the Overview tab" />

  <Step title="Click the Check all sites button">
    Click the **Check all sites** button<img src="https://mintcdn.com/mainwp-docs-openapi-6-1-5-fixes/F_-OnP7qx3CGrvWd/images/add-ons/vulnerability-checker-check-all.jpg?fit=max&auto=format&n=F_-OnP7qx3CGrvWd&q=85&s=f6fd11c4e373de34d5d7739231cc4a16" alt="Screenshot of Vulnerability Checker overview page with Check all sites button highlighted" width="1703" height="810" data-path="images/add-ons/vulnerability-checker-check-all.jpg" />
  </Step>
</Steps>

The Extension will check your sites right away.

### Schedule Automatic Checks

If you want the Extension to perform automated checks,

<Steps>
  <Step title="Login to your MainWP Dashboard" />

  <Step title="Go to MainWP > Add-ons > Security > Vulnerability Checker" />

  <Step title="Go to the Settings tab" />

  <Step title="Set the automatic-check schedule">
    Under **Schedule automatic checks**, select **Daily**, **Weekly**, or **Monthly**.
  </Step>

  <Step title="Enable email notifications (optional)">
    Enable **Send email notifications** if you want to receive the results by email.
  </Step>

  <Step title="Save Settings" />
</Steps>

Vulnerability Checker sends an email only after a scheduled automatic-check cycle finishes. A manual check from the Overview tab or a vulnerability check included in a site sync does not trigger this email.

The email is sent to the recipient(s) configured for **Daily Digest Email** under **MainWP Dashboard > Settings > Email Settings**. If the Daily Digest recipient settings have not been saved, MainWP uses the WordPress **Administration Email Address** as the default recipient.

If you want to make sure that WP Cron jobs are regularly triggered on your MainWP Dashboard, you can Authorize the Uptime Robot service and add your dashboard site as a monitor. The Uptime Robot will ping your dashboard site regularly and make sure that all scheduled events are occurring.

### Include the Scan Process in the Sync Process

If you want the Vulnerability Checker extension to check your sites every time you Sync your sites,

<Steps>
  <Step title="Login to your MainWP Dashboard" />

  <Step title="Go to MainWP > Add-ons > Security > Vulnerability Checker" />

  <Step title="Go to the Settings tab" />

  <Step title="Locate the Check sites when syncing option" />

  <Step title="Enable the option" />

  <Step title="Save Settings" />
</Steps>

## MainWP NVD API

The MainWP NVD API uses the [NVD API](https://nvd.nist.gov/) to find potential vulnerabilities on your Child Sites and **is available for all users**.

<Note>
  MainWP NVD API requires MainWP Dashboard and MainWP Child 4.1.7 or higher.
</Note>

> The NVD is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables the automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics.

This API is free and does not require a WPScan API token. To enable the MainWP NVD API,

<Steps>
  <Step title="Go to MainWP > Add-ons > Security > Vulnerability Checker > Settings" />

  <Step title="Find Select service and select MainWP NVD API" />

  <Step title="Save Settings" />
</Steps>

Once the API Service has been selected, you can run the scan:

<Steps>
  <Step title="Go to MainWP > Add-ons > Security > Vulnerability Checker > Overview" />

  <Step title="Click the Check All Sites button" />
</Steps>

<Warning>
  NVD matching uses CPE and keyword searches rather than WordPress.org plugin and theme slug lookups, so the API can return false-positive results.

  For some vulnerabilities, the NVD API lacks the "Fixed in version" information, which can lead to the extension showing vulnerabilities that have already been resolved.

  To remove false positives and get accurate results, use the "Ignore" function for detected vulnerabilities you recognize as false-positive.
</Warning>

***

## Related Resources

* [Security Add-ons](/add-ons/security) - Browse all security tools
* [Managing Plugins with MainWP](/sites/plugins/managing-plugins-with-mainwp) - Plugin management guide
* [How Secure is MainWP](/getting-started/how-secure-is-the-mainwp-plugin) - Security architecture overview