How we check every warning

• What we read
• Who we trust
• Our rules
• Proof you can check
• Does it affect you?
• What we never do

What we read

Our system already reads the security news every 30 minutes. It covers three kinds of source:

The news often arrives hours or days before the databases catch up. Reading both is how we can warn you early.

Who we trust

Trusted sources are security companies and official bodies that report WordPress problems carefully: Wordfence, Patchstack, WPScan, Sucuri, Sansec, CISA, NVD, WordPress.org, php.net and the big security news sites.

Less trusted sources are everything else: smaller blogs, forums and social posts. They can be early and right, but they can also be wrong, so they count for less.

Our rules

1. We read the page ourselves. A source only counts if its page loads and actually names the problem and the product.
2. Copies count once. An article that repeats someone else’s report counts as that original source. Many pages from one company count once.
3. The proof sets the level. One trusted source makes “This week”. “Today” needs attacks, confirmed by two trusted sources or by CISA. One less trusted post is never enough. What the levels mean.
4. AI fills in a form. Code decides. When a news story needs reading, an AI only answers a few questions (which product, which versions, is it being attacked) and must quote the article word for word. Our code then checks every answer against the article and the databases, and throws out anything that doesn’t match.
5. Levels only go up with new proof. A source going offline never lowers a warning.

Proof you can check

Every warning shows you:

• who confirmed it, what they said, and when;
• how many sources agree, and how many don’t;
• your version, and the safe one;
• the official ID (a CVE number) if there is one;
• links, so you can read every source yourself.

Does it affect you?

Your site checks itself. The plugin downloads the parts of our list it needs and compares them with the exact versions on your site. You only hear about things your site really runs. Your list of plugins never leaves your site.

When we can’t be sure, we say so. If your host may have patched PHP for you, or a plugin only shares a name with one on WordPress.org, the warning says “may affect you” and tells you who to ask.

What we never do

• Change anything on your site.
• Warn you about things your site doesn’t use.
• Show scary counters or invent urgency.
• Ask for your password. Not by email, not anywhere.