In short: Maintena checks every plugin and theme on your site against a trusted vulnerability database, explains what each risk actually means and what to do about it, and watches for security settings that have quietly drifted. The goal is simple: find and fix weaknesses before an attacker does.
What it is
Most WordPress sites are broken into by an old plugin or theme that has a known, publicly listed weakness. Maintena's Security & Vulnerability layer is built to catch exactly that.
It does three things for every connected site:
- It checks each plugin and theme against a vulnerability database to see whether anything installed has a known security issue.
- It adds a plain-English AI advisory that explains the real-world risk and what to do next, so you are not left reading raw security jargon.
- It keeps an eye on your site's security "hardening" settings and tells you when one of them slips from safe to unsafe.
All of the clever, sensitive work happens on Maintena's own servers. Your WordPress site never holds any scanning keys or credentials, and nothing extra is installed on it beyond the standard WordPress Agent.
How it works
Your WordPress Agent reports the list of plugins and themes on your site (and their versions), plus a set of security checks, each time it syncs. Maintena then does the judging: it looks each item up, decides whether the version you actually have installed is at risk, and turns that into something you can act on.
Vulnerability verdicts
For each plugin and theme, Maintena works out one of these verdicts:
| Verdict | What it means |
|---|---|
| Vulnerable | The version installed on your site is affected by a known security issue. Worth acting on. |
| Patched | A past issue existed, but the version you have is already safe. No action needed. |
| Clean | No known issues on record. |
| Unknown | We do not have a confident answer yet, usually because the check is still refreshing. |
A plugin or theme is only flagged as vulnerable when the issue affects the exact version you have installed. If a weakness was fixed in a newer release and you have already updated past it, Maintena will not cry wolf. Issues that were disclosed but no longer affect you are noted in the advisory, not counted as live risk.
How serious is it
Every issue is given a severity so you know what to tackle first:
| Severity | Typical examples |
|---|---|
| Critical | Remote code execution, SQL injection, malicious file upload |
| High | Missing authentication, file inclusion, server-side request forgery |
| Medium | Cross-site scripting, cross-site request forgery, information disclosure |
| Low | Clickjacking, open redirects |
Where the vulnerability database provides a formal severity score, Maintena uses it. Where it does not, Maintena estimates severity from the type of weakness. Treat these estimates as a solid guide for prioritising, not as a formal audit rating.
The AI advisory layer
On top of the facts, Maintena can add an AI advisory for a plugin. In plain English it gives you a trust verdict (trusted, use with caution, high risk, or unknown), the reasons behind it, a short security summary, and a clear recommendation.
The AI is only ever an interpreter. It never invents a vulnerability and never changes the underlying verdict or your Health Score. If the advisory is unavailable for any reason, you still see the full, factual vulnerability list. The advisory appears once the plugin's report has been opened at least once, where this feature is enabled.
The fleet-wide portfolio
If you manage more than one site, the Vulnerabilities page groups the same issue across every site it touches. Instead of "this plugin is vulnerable" repeated site by site, you get "this one issue affects 4 of your sites, fixed in version 3.5.1", ranked by how serious it is and how many sites it hits. That is the view that tells you where to spend your time first.
Security hardening drift
Separately from known vulnerabilities, Maintena snapshots your site's security settings the first time it syncs and treats that as your accepted baseline. It watches nine hardening checks:
- SSL / secure connection
- Debug mode
- File editing from the dashboard
- Admin username
- File permissions
- Directory browsing
- Database table prefix
- XML-RPC
- Login security
If one of these was safe and later slips to unsafe, Maintena raises an in-app alert and records it in your activity log, so a quiet change does not go unnoticed. It alerts once per change, not repeatedly, and only when a setting genuinely moves from good to bad.
If you made the change on purpose, someone on your team with the right permissions can re-accept the current settings as the new baseline, and future checks are measured from there.
What you need to do
For most customers there is nothing to configure. Scanning runs automatically on every connected site.
- Connect the agent. Install the Maintena WordPress Agent and enter your site key so syncs start flowing. See Getting started and The WordPress Agent. Everything below happens on its own once this is done.
- Nothing to switch on. There is no per-site toggle for scanning. Every connected site is checked automatically each time it syncs.
- Accept your hardening baseline (optional). Your first sync records your current security settings as the accepted baseline. If you later make a deliberate change, a team member with site-editing permission can re-accept the current settings from the site page so drift is measured from the new normal.
Good to know
- Your keys stay with us. All vulnerability and AI checks run on Maintena's servers using our own credentials. Nothing sensitive is ever stored on your WordPress site.
- Vulnerabilities affect your Health Score. A vulnerable plugin or theme lowers your Health Score through its plugins and themes sub-scores, so security risk shows up in your overall number, not just this page.
- Core WordPress is covered elsewhere. This layer scans plugins and themes. Risk from an out-of-date WordPress core is reflected in your Health Score instead.
- A resolved issue simply disappears. Once you update a plugin or theme past a vulnerability, or remove it, the entry drops off your list. There is no separate "resolved history" to tidy up.
- A partial sync is safe. If a sync does not complete, Maintena will not mistake missing data for removed plugins, so your vulnerability list is never wiped by accident.
On the roadmap
A few things are deliberately not built yet, so you always know what to expect:
- No email alert when a new vulnerability appears. A newly discovered issue shows up on this page and affects your Health Score right away, but it does not currently send an email or Slack message. Discovery is by looking, or through your reports. (Security hardening drift does raise an in-app alert.) See Notifications & email for what does alert today.
- No fixed re-scan schedule. Verdicts refresh as your site syncs and as reports are viewed, rather than on a separate timer.
- The AI advisory is per plugin, on demand. There is no single fleet-wide AI security summary yet, and the advisory populates after a plugin's report has been opened.