Plugin identification

Found Lockora Audit in your plugin list?

Here is what it is, how it got installed, whether it is safe, and what to do next.

It is a legitimate security plugin

✓
Lockora Audit is not malware. It is a WordPress security audit plugin listed in the official WordPress plugin directory. It does not self-install, spread between sites, or make any changes to your site without explicit approval from an admin.

If you see it in WP Admin → Plugins, someone with administrator access to your site deliberately installed it — either to run a security audit or as part of an ongoing monitoring setup.

The plugin runs entirely inside your WordPress installation. It reads your files and configuration to find security issues, but it does not alter anything and does not phone home with your site’s source code.

How it got installed

Lockora Audit can only be installed manually — there is no mechanism for it to appear on its own. Someone with WP admin access either searched for it in the plugin directory or uploaded the zip file directly. The most common sources:

  • A developer or agency managing your site Security plugins are commonly installed during site maintenance, handovers, or as part of a security review. Your developer may have set it up and not mentioned it.
  • A managed WordPress host Some hosting providers pre-install or recommend security plugins as part of their setup process.
  • You (or a previous site admin) It may have been installed during an earlier security review and simply not removed.

If you are unsure who installed it, check WP Admin → Plugins for the install date, or review your site’s audit log if you have one.

What it does on your site

Lockora Audit is a read-only scanner. When you (or an admin) click Run audit, it:

  • Checks your WordPress core, plugins, and themes against known vulnerability databases
  • Reviews your configuration files (wp-config.php, .htaccess) for common security misconfigurations
  • Scans uploaded files for known malware signatures
  • Produces a plain-English report ranked by severity

It does not change anything automatically. Fixes are always opt-in: you review each recommendation in the plugin dashboard and approve it individually. Every fix creates a rollback point first.

Only redacted findings — never raw source code — are sent off-server for AI reasoning. You can disable that entirely on Pro and Agency plans. See a full list of what Lockora does and does not do →

What should you do now?

OPTION 01

Run an audit

Open the plugin and click Run audit to see a security report for your site. Takes under 3 minutes.

Getting started guide →

OPTION 02

Ask your site manager

If someone else maintains your site, ask them why it was installed and whether audits are being run regularly.

OPTION 03

Remove it

If you do not need it, you can safely uninstall it. See the steps below — it removes cleanly with no side effects.

How to completely remove Lockora Audit

Uninstalling the plugin is straightforward and has no impact on your content, database, or other plugins.

  1. Log in to WP Admin
  2. Go to Plugins → Installed Plugins
  3. Find Lockora Audit in the list
  4. Click Deactivate (required before deletion)
  5. Click Delete and confirm
✓
Uninstalling Lockora Audit removes only its own files. It does not delete posts, pages, media, users, or any other site content.
Who makes this plugin?
Lockora Audit is built by a BSI-aligned certified cybersecurity specialist with 8 years of hands-on experience auditing WordPress websites across agencies, ecommerce stores, publishers, and membership sites. It is an independent, privately-built tool — not affiliated with Automattic, WordPress.com, or any hosting provider. Questions? hello@lockora-audit.com