Title: Korisec Security – Vulnerability Scanner and Login Protection
Author: korisec
Published: <strong>Ọwẹ́wẹ̀  14, 2026</strong>
Last modified: Ọwẹ́wẹ̀  15, 2026

---

Ṣàwárí àwọn plugin

![](https://ps.w.org/korisec/assets/banner-772x250.png?rev=3694724)

![](https://ps.w.org/korisec/assets/icon.svg?rev=3694724)

# Korisec Security – Vulnerability Scanner and Login Protection

 Láti ọwọ́ [korisec](https://profiles.wordpress.org/korisec/)

[Ṣe ìgbàsílẹ̀](https://downloads.wordpress.org/plugin/korisec.1.0.12.zip)

 * [Àwọn àlàyé](https://yor.wordpress.org/plugins/korisec/#description)
 * [Àwọn àgbéyẹ̀wò](https://yor.wordpress.org/plugins/korisec/#reviews)
 *  [Ìgbéwọlẹ̀](https://yor.wordpress.org/plugins/korisec/#installation)
 * [Ìdàgbàsókè](https://yor.wordpress.org/plugins/korisec/#developers)

 [Ìrànlọ́wọ́](https://wordpress.org/support/plugin/korisec/)

## Àpèjúwe

Korisec is a **hosted** website security service. This plugin is the official WordPress
client: it does not run port scans, Nuclei, or other scanners inside WordPress.

After you paste a plugin key from your Korisec account, the plugin:

 1. Verifies this site with Korisec and binds the key to this host
 2. Sends WordPress core, plugin, and theme versions so cloud checks can include software
    that is not visible from the public internet
 3. Lets you start a cloud check from wp-admin and show grade, findings, and history
 4. Lets the **billing owner** who issued the key manage plan, team seats, PDF reports,
    and alerts (Telegram, Slack, WhatsApp, webhook)

Without a key, login protection and optional exposure remedies (XML-RPC, public 
usernames, install.php) still run locally. Those features do not send data to Korisec.

Paid plans, daily scan limits, and white-label PDFs are features of the **Korisec
service**, not locked code inside this plugin. The plugin’s PHP is fully available
under GPLv2 or later.

#### External service

This plugin requires a Korisec account and talks only to `https://api.korisec.com`(
unless you set `KORISEC_API_BASE` in wp-config.php).

 * Terms of Use: https://korisec.com/terms.html
 * Privacy Policy: https://korisec.com/privacy.html
 * Plugin page: https://korisec.com/wordpress/
 * Dashboard: https://app.korisec.com

Nothing is sent until a site administrator pastes a `kr_live_…` key and clicks Connect.

#### Data sent after Connect

Typical payloads include this site’s URL and host, WordPress and PHP versions, names
and versions of installed plugins/themes (and whether they are active), heartbeat,
scan start/status requests, and billing/team/alert settings for the Korisec account
that issued the key.

## Ìgbéwọlẹ̀

 1. Create a Korisec account at https://app.korisec.com/signup and add a plugin key
    under Account  API keys
 2. Install this plugin and activate it
 3. Open **Korisec** in wp-admin, paste the key, and Connect (you agree to Korisec’s
    terms and privacy policy)
 4. Run a check, or wait for Korisec’s scheduled scans

The plugin connects to Korisec automatically. You do not need to edit wp-config.
php.

## FAQ

### Does this plugin scan my server?

No. Checks run on Korisec workers. The plugin only reports inventory and displays
results.

### Why do I need a key?

The key authenticates this site to the Korisec API. It is not a license gate for
local scanner code. Without a key the plugin does not contact Korisec.

### What if my Korisec plan ends?

The hosted service pauses cloud checks until the account is renewed. The plugin 
itself remains installed and GPLv2 licensed.

### How do I stop sending data?

Disconnect on the Connection tab, or delete the plugin. Deleting removes the stored
key from WordPress. Korisec account history is managed in the Korisec dashboard.

### Can I point the plugin at my own API?

Yes. In wp-config.php set `define( 'KORISEC_API_BASE', 'https://your-host.example');`

## Àwọn àgbéyẹ̀wò

Kò sí àwọn àgbéyẹ̀wò fún plugin yìí.

## Àwọn Olùkópa & Olùgbéejáde

“Korisec Security – Vulnerability Scanner and Login Protection” jẹ́ ètò ìṣàmúlò 
orísun ṣíṣí sílẹ̀. Àwọn ènìyàn wọ̀nyí ti ṣe ìkópa sí plugin yìí.

Àwọn Olùkópa

 *   [ korisec ](https://profiles.wordpress.org/korisec/)

[Túmọ̀ “Korisec Security – Vulnerability Scanner and Login Protection” sí èdè rẹ.](https://translate.wordpress.org/projects/wp-plugins/korisec)

### Ṣe o nífẹ̀ẹ́ sí ìdàgbàsókè?

[Ṣàwárí koodu](https://plugins.trac.wordpress.org/browser/korisec/), ṣàyẹ̀wò [ibi ìpamọ́ SVN](https://plugins.svn.wordpress.org/korisec/),
tàbí ṣe àgbékalẹ̀ sí [àkọsílẹ̀ ìdàgbàsókè](https://plugins.trac.wordpress.org/log/korisec/)
nípasẹ̀ [RSS](https://plugins.trac.wordpress.org/log/korisec/?limit=100&mode=stop_on_copy&format=rss).

## Àkọsílẹ̀ àwọn àyípadà

#### 1.0.12

 * Fix Actions-tab Update links showing “The link you followed has expired” (nonce
   URLs were HTML-escaped twice)

#### 1.0.11

 * Actions tab: update outdated plugins/themes with deep links, plus one-click remedies
   for XML-RPC, public usernames, and wp-admin/install.php
 * Richer inventory (plugin file paths and WordPress-known updates) posted before
   each check

#### 1.0.10

 * Directory display name: Korisec Security – Vulnerability Scanner and Login Protection
 * SEO-focused short description and tags (vulnerability scanner, login security,
   brute force)

#### 1.0.9

 * Findings show CVE links, known-exploited badges, and one-click links to Plugins/
   Themes / Updates when a fix version is known
 * Login protection: limit failed wp-login attempts by IP (local; on by default;
   configurable under Protection)

#### 1.0.8

 * WordPress Plugin Check (plugin-repo) fixes: nonce in AJAX handlers, JSON payload
   sanitization, no false Cloudflare offload string

#### 1.0.7

 * Reliable connection is on automatically so site owners do not edit wp-config.
   php

#### 1.0.6

 * WordPress.org packaging: privacy policy suggestion, uninstall cleanup, i18n, 
   service documentation
 * Origin IP pin is off unless KORISEC_PIN_ORIGIN is defined
 * Plugin key is sanitized before storage

#### 1.0.5

 * Horizontal tabs for billing, team seats, PDF / white-label reports, and alerts
 * Plugin key can only manage the Korisec billing account that issued it

#### 1.0.4

 * In-admin dashboard: grade, score, grouped findings, recent checks, live progress

#### 1.0.3

 * Optional origin pin for hosts that cannot reach api.korisec.com through Cloudflare

#### 1.0.2

 * Only treat Cloudflare challenge pages as Bot Fight blocks

#### 1.0.1

 * Clearer connect errors when the API is unreachable
 * WordPress AJAX no longer returns HTTP 403 for Korisec API errors

#### 1.0.0

 * First release: connect, inventory, run check, grade

## Àkójọpọ̀ Meta

 *  Ẹ̀yà **1.0.12**
 *  Ìgbàgbọ́hùn tó kẹ́yìn **ọjọ́ 2 sẹ́yìn**
 *  Àwọn ìgbéwọlẹ̀ tó ṣiṣẹ́ **Tó kéré sí 10**
 *  Ẹ̀yà WordPress ** 6.0 tàbí ju bẹ́ẹ̀ lọ **
 *  Dánwò dé **7.1**
 *  Ẹ̀yà PHP ** 7.4 tàbí ju bẹ́ẹ̀ lọ **
 *  Èdè
 * [English (US)](https://wordpress.org/plugins/korisec/)
 * Àwọn àmì
 * [Brute Force](https://yor.wordpress.org/plugins/tags/brute-force/)[login security](https://yor.wordpress.org/plugins/tags/login-security/)
   [security](https://yor.wordpress.org/plugins/tags/security/)[vulnerability scanner](https://yor.wordpress.org/plugins/tags/vulnerability-scanner/)
   [wordpress security](https://yor.wordpress.org/plugins/tags/wordpress-security/)
 *  [Ìwòye Tó Péye](https://yor.wordpress.org/plugins/korisec/advanced/)

## Àwọn ìbò

Kò sí ìwádìí tí a tíì fi ránṣẹ́.

[Your review](https://wordpress.org/support/plugin/korisec/reviews/#new-post)

[Wo gbogbo àwọn àgbéyẹ̀wò](https://wordpress.org/support/plugin/korisec/reviews/)

## Àwọn Olùkópa

 *   [ korisec ](https://profiles.wordpress.org/korisec/)

## Ìrànlọ́wọ́

Nǹkan wà tí o fẹ́ sọ? Ṣé o nílò ìrànlọ́wọ́?

 [Wo àpéjọ ìrànlọ́wọ́](https://wordpress.org/support/plugin/korisec/)