WordPress plugin · GPLv2 · v1.1.2

Korisec Security for WordPress

Hosted vulnerability checks, local login protection, and free encrypted backups to your own Google Drive with one-click rollback. Scans run in Korisec’s cloud — not on your server — with plain-English findings and CVE links.

Get a plugin key Install from WordPress.org View source

Free GPLv2 plugin — install from WordPress.org. Google Drive backups are free on any site, no key needed. Cloud checks use your Korisec account (14-day trial, then a paid plan). Source mirror on GitHub. Current release: v1.1.2.

How it works

Three steps, no scanner on your host

Create a Korisec account

Install the plugin

Install Korisec Security from WordPress.org, activate it, then open Korisec in wp-admin.

Paste the key and Connect

Nothing is sent until a site administrator connects. Connecting binds the key to this host and agrees to Korisec’s Terms and Privacy Policy.

What the plugin does

Cloud checks, local protection, free backups

Vulnerability scanner (hosted)

Reports WordPress core, plugin, and theme versions so cloud checks can find known CVEs — including software that is not visible from the public internet.

Actionable findings

See grade, severity, CVE links, and shortcuts to Plugins / Themes / Updates in wp-admin. Full history and PDFs stay in your Korisec account.

Login protection (local)

Limits failed wp-login attempts by IP. Runs on your site only — no Korisec API call — and works even before you connect a key.

Free Google Drive backups

Database, plugins, themes, uploads, and wp-config.php, on a daily or weekly schedule. Encrypted on your server before upload, so Google and Korisec cannot read them. No Korisec key needed.

One-click restore and undo

Every backup is verified in Drive before it counts. Restoring takes a safety backup first and swaps tables and folders in one step — undo instantly if anything looks wrong.

Disaster recovery key

Download a recovery key and keep it offline. Lost the whole server? Install WordPress and Korisec, connect the same Drive, import the key, and restore.

Changelog

Version history

Same notes as readme.txt on WordPress.org. Current release: 1.1.2.

1.1.2

Redesigned wp-admin UI on a scoped Bootstrap 5 layout: Checks, Actions, Billing, Team, Reports, Alerts, Protection and Backups now share one card/grid system
Fix: cards overlapping on medium and small screens (backup stat, recovery-key and settings cards, grade header and plan cards now wrap and scroll correctly)

1.1.1

Redesigned Backups screen: stat cards, side-by-side recovery key and settings, and Bootstrap-styled fields and buttons
WP-Cron health check: tested when the plugin is activated and monitored hourly. Korisec warns in wp-admin if scheduled tasks stop running, since automatic backups depend on them
Fix: restores could fail with a duplicate key error when a background step and the Backups screen ran at the same time
Lowering the number of backups to keep now removes the extra backups right away instead of after the next backup
Corrupted backups are re-checked in Google Drive: intact ones become restorable again, damaged ones are removed after 7 days to free space

1.1.0

New: free encrypted backups to Google Drive (database + wp-content + wp-config.php), no Korisec key needed
Daily or weekly schedule, retention, remote verification, and audit log
One-click restore with automatic safety backup and instant undo
Recovery key for restoring onto a fresh WordPress install

1.0.12

Fix Actions-tab Update links showing “The link you followed has expired” (nonce URLs were HTML-escaped twice)

1.0.11

Actions tab: update outdated plugins/themes with deep links, plus one-click remedies for XML-RPC, public usernames, and wp-admin/install.php
Richer inventory (plugin file paths and WordPress-known updates) posted before each check

1.0.10

Directory display name: Korisec Security – Vulnerability Scanner and Login Protection
SEO-focused short description and tags (vulnerability scanner, login security, brute force)

1.0.9

Findings show CVE links, known-exploited badges, and one-click links to Plugins / Themes / Updates when a fix version is known
Login protection: limit failed wp-login attempts by IP (local; on by default; configurable under Protection)

1.0.8

WordPress Plugin Check (plugin-repo) fixes: nonce in AJAX handlers, JSON payload sanitization, no false Cloudflare offload string

1.0.7

Reliable connection is on automatically so site owners do not edit wp-config.php

1.0.6

WordPress.org packaging: privacy policy suggestion, uninstall cleanup, i18n, service documentation
Origin IP pin is off unless KORISEC_PIN_ORIGIN is defined
Plugin key is sanitized before storage

1.0.5

Horizontal tabs for billing, team seats, PDF / white-label reports, and alerts
Plugin key can only manage the Korisec billing account that issued it

1.0.4

In-admin dashboard: grade, score, grouped findings, recent checks, live progress

1.0.3

Optional origin pin for hosts that cannot reach api.korisec.com through Cloudflare

1.0.2

Only treat Cloudflare challenge pages as Bot Fight blocks

1.0.1

Clearer connect errors when the API is unreachable
WordPress AJAX no longer returns HTTP 403 for Korisec API errors

1.0.0

First release: connect, inventory, run check, grade