Find what an attacker would find, before they do. Lockora Audit checks your core files, configuration and secrets, administrator accounts, uploads and public exposure, scores the site out of 100, and tells you what each finding is, why it matters, and what to do about it.
5.0 on WordPress.org 200+ active installs v0.4.2 · tested up to WordPress 7.0.4
Found this plugin already installed? Learn what it is and what to do →
Lockora doesn’t just diff plugin versions. It reads the site the way an auditor would — files, configuration, accounts and what is visible from the outside — and covers most of the WordPress security checklist in one scan.
Every WordPress core file is compared against the official WordPress.org checksums for your exact version. Modified or injected files are listed with their paths, and the result exports to CSV or TXT for your developer or host.
A bounded scan of wp-content looks for executable
files in uploads, PHP outside the standard code directories,
runtime executables, and exposed backup or secret-like files
— the places web shells and leaked archives actually live.
Checks the eight authentication keys and salts (with actions to
generate missing ones or rotate them), the database table prefix,
must-use plugins, HTTPS and security headers, and whether
debug.log or readme.html are reachable
from the internet.
Flags default usernames, more Administrators than a site needs, inactive admins, exposure of user ID 1, and username leaks through author archives. Also detects whether a login-protection or two-factor plugin is present. Read the user roles guide.
Core, plugin and theme update posture, automatic-update settings, PHP version support (via WordPress.org Serve Happy data), and SSL certificate expiry. Add your own Wordfence Intelligence API key and installed versions are matched against known vulnerabilities locally.
Four low-risk settings you can switch on from the plugin and switch back off at any time: disable XML-RPC, close the REST user routes, remove the generator tag, and send basic security headers. Everything else stays a recommendation until you act on it.
Plus a weighted score out of 100 compared with your previous scan, a summary in Tools → Site Health, and a sample report showing every check.
No agents. No staging clones. No log shipping. Lockora runs inside your WordPress admin — the scan happens on your server.
In WP Admin go to Plugins → Add New, search for “Lockora Security Audit”, install and activate. Works on WordPress 6.0+ and PHP 7.4+.
Open Tools → Lockora Security Audit and click
Run Scan. Or run wp lockora scan from the
command line. Step-by-step guide →
You get a score out of 100, a comparison with the previous scan, and each finding explained in plain English: what it is, why it matters, what to do.
Flip the reversible toggles, follow the guidance for the rest, export core-integrity and anomaly results as CSV or TXT, and re-scan to watch the score move.
Plain answers for anyone who wants to understand the plugin before trusting it with their site. Everything here matches the current release, v0.4.2.
wp lockora scan with cron or CI in the meantimeScheduled scans with email alerts, guided remediation with rollback points, network-wide reporting for multisite, and paid tiers for agencies are planned. The plugin is free while in beta, and this page will say so when any of that ships.
Not sure why you have this plugin? See “Is Lockora installed on your site?” →
The same scan is available from WP-CLI, so it fits a deployment pipeline or a cron job as easily as the admin screen.
wp lockora scan and wp lockora report, with --format=json and a --strict flag that fails a CI job when findings are presentlockora_scan_completed action that hands your integration the score and finding countsNo. The scan runs inside your WordPress admin, and the plugin does not send file contents, passwords, salts, API keys, raw logs or user lists anywhere. It contacts WordPress.org for core checksums, PHP support status and update data. Two features are optional and off unless you configure them: vulnerability matching with your own Wordfence Intelligence API key (the feed is fetched and matched locally), and an AI client report on WordPress 7.0+ that receives sanitized findings only. Details in the privacy policy.
Wordfence and Sucuri are firewalls and real-time scanners: they protect a site while it is being attacked. Lockora is a point-in-time audit. It checks core integrity, configuration and secrets, administrator accounts, uploads, public exposure and update posture, then scores the site and explains each finding. They solve different problems, and many sites run both. Read the full Lockora vs. Wordfence comparison →
Scans run only when you start them, from the admin or from WP-CLI, and nothing runs in the background between scans. The file scans are bounded by design so they stay manageable on shared hosting.
Yes. The four toggles — XML-RPC, REST user routes, generator tag output and basic security headers — are reversible switches in the plugin settings. Turn one off and the site returns to its previous behaviour. Lockora never applies a fix on its own.
The plugin is free on WordPress.org. The optional features use your own Wordfence Intelligence key or your site’s AI Connector, so any cost there is with those providers. The current release is built for single-site installs; network-wide reporting and paid tiers for agencies are on the roadmap and will be announced here first.
Lockora Audit is built by G. Schad, a BSI-certified cybersecurity specialist based in San Francisco, with 8 years of hands-on experience auditing several hundred WordPress websites. The same author maintains the Who Changed It? activity-log plugin. Meet the person behind the plugin →
Using the plugin
Go to WP Admin → Plugins → Installed Plugins and look for “Lockora Security Audit” in the list. If it’s there, it is installed. If it shows as “Active”, you will also see it under Tools. Found it unexpectedly? See the guide for site owners who did not install it themselves →
After activating, go to Tools → Lockora Security Audit and click Run Scan. When it finishes you get a score out of 100 and the list of findings. The getting-started guide walks through reading the report, and the sample report shows what a complete result looks like.
Go to WP Admin → Plugins → Installed Plugins, find Lockora Security Audit, click Deactivate, then Delete. This removes only the plugin’s own files — it does not affect your posts, media, users or any other content. If you switched on a hardening toggle, switch it off first if you want that behaviour reverted.
Only when you start a scan, from the admin or with wp lockora scan. Scheduled scans and alerts are on the roadmap; today you can schedule the WP-CLI command with cron or run it in a CI pipeline. No change is ever applied automatically.
The Administrator role, to run scans and view reports. It reads your WordPress files, options and users to perform the scan. It does not require FTP credentials, SSH access or any server-level configuration.
Every guide covers a finding the scan raises, written by the person who built the checks.
The 12 controls that prevent real compromises, and which ones the scan covers for you.
Brute-force amplification, pingback DDoS, and the one toggle that closes both.
Salts, debug flags, file editing, permissions — with a hardened example to copy.
Install the free plugin from the WordPress directory, open Tools → Lockora Security Audit, and click Run Scan.