Read-only WordPress security pluginSee from inside the site what we cannot see from outside
An outside scan only sees what the site shows: plugins that leave no trace on the front end and hidden versions stay “possible” in the report. The read-only Noroxi Connector reports the exact version of every installed component once a day, so your report matches exact versions instead of guesses.
Free on every plan · GPLv2+ · writes nothing to the site · v1.1.0
What it adds
Exact versions, no possible records
The exact version of every installed plugin, theme and core arrives. Records that stay “possible” from outside become confirmed or clean; inactive plugins and auto-update status show up too.
File integrity
The plugin compares WordPress core files, and a few plugins each day, with the official checksums published by WordPress.org. Files that differ or should not be there show up in the report by path; file contents are never sent.
Notice within the hour
When a new vulnerability record reaches Noroxi, a finding and a notification arrive in the same hourly run if your site runs that version. No need to scan again.
Settings you cannot see from outside
The PHP version (past its security support or not), the core auto-update mode, whether errors are shown to visitors and whether files can be edited from the dashboard; all in plain language in the report.
Exactly what is sent
The plugin's settings page shows the data to be sent as it is. The format looks like this (the example domain is fictional):
- The site host name (to confirm the token belongs to this site), the WordPress and PHP versions
- For each plugin and theme: slug, version, whether it is active, whether auto-updates are on
- Four settings: core auto-update mode, error display (WP_DEBUG), dashboard file editing (DISALLOW_FILE_EDIT)
- Integrity: the relative PATHS of files that differ from the official checksums and the number of missing core files
Not sent
Users, email addresses, posts and other content, file contents, other settings, IP addresses, plugin names and authors.
{
"v": 2,
"agent": "1.1.0",
"site": "kuzey-yazilim.example",
"core": "6.8.1",
"plugins": [
{
"slug": "contact-form-7",
"version": "6.0.6",
"active": true,
"auto_update": true
},
{
"slug": "woocommerce",
"version": "9.8.5",
"active": true,
"auto_update": false
}
],
"themes": [
{
"slug": "twentytwentyfive",
"version": "1.2",
"active": true,
"auto_update": true
}
],
"env": {
"php": "8.3.14",
"core_auto": "minor",
"debug_display": false,
"file_edit": true
},
"integrity": {
"core": {
"modified": [],
"missing": 0,
"unknown": []
},
"plugins": [
{
"slug": "contact-form-7",
"version": "6.0.6",
"modified": []
}
],
"checked": 1
}
}Setup in three steps
01
Create a token
In your Noroxi account, on the “WordPress connector” card of the domain page. The token is valid only for that domain and can only send; it cannot read your report.
02
Install the plugin
Go to Plugins → Add New → Upload Plugin, upload the zip file and activate it.
03
Paste the token
Open Tools → Noroxi Connector and press “Save and send”. You can also set the token in wp-config.php with the NOROXI_CONNECTOR_TOKEN constant; then it is not stored in the database.
Managing dozens of sites?
The Plugins page in your account lists your WordPress sites without the connector and creates tokens for the ones you select in one go. You download a ready WP-CLI script and a CSV with the tokens; you can also install with the bulk plugin upload of tools such as MainWP or ManageWP. The same page shows in one table which plugin runs at which client in which version.
Open the Plugins pageFrequently asked questions
- Does the plugin scan or change my site?
- No. It reads the plugin and theme list WordPress already keeps, computes file checksums on disk and sends the result. It adds no front-end output, REST route or AJAX handler; it writes only its own settings row and its own daily task, and uninstalling removes both.
- Will it slow my server down?
- It sends once a day through WordPress scheduled tasks. The integrity check takes at most 20 seconds per send and looks at up to eight plugins each time; all plugins are covered within a few days.
- What if the token leaks?
- The token can only send an inventory for its own domain; it cannot read the report. Revoke it or create a new one on the domain page and the old one stops working at once.
- Does a differing file mean my site was compromised?
- Not always. The file may have been edited by hand or patched by the host. The report gives the file's path and asks you to compare it with the official package; if the change has no explanation, replace the file with the official version and change your admin passwords.
- Does it see my paid plugins?
- It sees their versions and matches them with vulnerability records. Paid plugins have no official checksums on WordPress.org, so the integrity check cannot cover them.
- Can I use it on my staging site?
- Each site uses its own domain and its own token. A token sent from another domain is rejected, so a copy of the site cannot overwrite the production report.
Noroxi Connector is not a firewall or a malware scanner: it does not block attacks and does not look at file contents. It reports versions and differences from the official release; the report and your review make the call.