About the Zignites plugin scanner

What it is

It identifies itself on every request with this user agent:

ZignitesPluginScanner/1.0 (+https://zignites.com/tools/wordpress-plugin-risk-report/bot)

It runs only when a visitor pastes a URL into the WordPress Plugin Risk Report. There is no crawler, no schedule and no queue: no request is ever made to your site unless a person asked for a report about it in that moment. One report is at most one visit, and a repeat request for the same address within 24 hours is answered from a cached result without touching your site at all.

What it requests

In order, and never more than 40 requests in total:

• / — your homepage, the same document a browser would receive.
• /wp-json/, falling back to /?rest_route=/. Only the list of registered REST namespaces is read from it.
• One internal page linked from your homepage, and only when the homepage showed fewer than three plugins. Never more than two pages of yours in one scan.
• /robots.txt, before anything under your plugins directory.
• /wp-content/plugins/<plugin>/readme.txt — a plugin’s own readme, and only for plugins already named in your public HTML whose version we could not read from an asset URL. At most four of these are in flight at once.

The whole scan is capped at 25 seconds and each response is read to a maximum of 2 MB. A visitor can run five scans an hour and twenty a day.

What it never requests

No wp-login.php, no xmlrpc.php, no user enumeration through /wp-json/wp/v2/users, no directory listings, no PHP files, no admin paths, no form submissions and no attempt of any kind to authenticate. It reads only files a plugin author published deliberately. We store no raw HTML from your site, and a report is private to the person who ran it unless they publish it.

It does not check for vulnerabilities, and no report about your site will ever say it has one. What is reported is what the WordPress.org directory publishes about each plugin: last update date, tested-up-to version, and whether it is still listed.

How to block it

A Disallow rule covering your plugins directory — under our own token or under * — stops every readme request. We read robots.txt before those requests and skip everything it disallows, and the report then says outright that versions are missing because your robots.txt asked us not to look.

User-agent: ZignitesPluginScanner
Disallow: /wp-content/plugins/

Be aware of what that does not cover, because it is the request most likely to be in your log: robots.txt is not consulted before the two page requests above. Those fetch pages that are already public, at the moment a person asked about them, the same way a link preview or a page-speed tool does.

Blocking the user agent at your firewall or CDN works too, and needs nothing from us. A 403 or a 429 is treated as a refusal: the scan stops rather than retrying, and the visitor is told the site declined automated requests.

Excluding your domain entirely

Email zeeshan.sardar@zignites.com with the domain and we will add it to the exclusion list within 48 hours. The list is checked before every scan, so an excluded domain cannot be scanned by anyone — and it cannot have a report published about it either. If a report about your site is already public, say so in the same email and we will take it down.

Why the tool exists

We build and maintain WordPress plugins, and the question we were asked most often was whether a plugin someone was relying on had been abandoned. The answer is public information that is tedious to assemble by hand, so we assembled it. Our WordPress plugin development service is how the tool pays for itself; the tool itself is free and has no signup.