WordPress Scanner Action

Performs syntax checks, virus scanning and plugins and themes vulnerability checks for WordPress sites

This Github Action performs standard scanning for WordPress sites which includes PHP syntax checks, virus scanning and plugins and themes vulnerabilities scanning.

API Access

This Action leverages our own WP-CLI Vulnerability Scanner to perform the known vulnerabilities scanning of WordPress plugins and themes. WP-CLI Vulnerability Scanner works with WPScan, Patchstack and Wordfence Intelligence to check reported vulnerabilities; you can choose any one of these three to use. Note: Authentication is optional for the Wordfence Intelligence Vulnerability API.

Inputs

Name	Required	Default	Description
vuln_api_provider	False	wordfence	The vulnerability API provider for the WordPress plugins and themes scanning. Supported values: wordfence, patchstack and wpscan
vuln_api_token	False	-	The API token to authenticate against the vulnerability API provider. This input is optional if vuln_api_provider is set to wordfence
disable_vuln_scan	False	false	Disable the WordPress plugins and themes vulnerability scanner
virus_scan_update	False	true	Update the ClamAV definitions database before executing the virus scanner (recommended)
disable_virus_scan	False	false	Disable the ClamAV virus scanner
phpsyntax_enable_debug	False	false	The PHP syntax checks could generate a large output depending on the amount of PHP files in the repository, for this reason the output is suppresed by default. Set this input to true if you want to visualize the full output. Useful for troubleshooting in case the PHP syntax checks fails
disable_phpsyntax_check	False	false	Disable the PHP syntax checks
content_dir	False	$GITHUB_WORKSPACE	Location of the wp-content directory inside the repository. Set this input to ./ if you have a wp-content based repository
wp_core_version	False	latest	WordPress core version to use for the plugins and themes vulnerability scanner. Must match the version of your WordPress site for better results
composer_build	False	false	Install the Composer dependencies in your composer.json file before executing the WordPress plugins and themes vulnerability scanner. The composer.json file must exists in the repository's root directory. Set this input to true if you install plugins and themes via Composer in CI. Note: This won't affect your final deploy artifact
no_fail	False	false	Exits the scanner without failing even if any issues are found

Examples

Basic example with Composer dependencies

This example assumes that you have a wp-content based repository and uses Patchstack as the API provider.

name: "PHP Syntax Check, virus scanning, and WP Plugins & Themes vulnerability scanning"

on:
  push:
    branches:
      - '**'

jobs:
  wp-scanner:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
      
      - name: WordPress Scanner
        uses: 10up/wp-scanner-action@v1
        with:
          vuln_api_provider: 'patchstack'
          vuln_api_token: ${{ secrets.PATCHSTACK_TOKEN }}
          content_dir: './'
          wp_core_version: '6.5.5'
          composer_build: 'true'

Plugins and Themes under version control

This example assumes that you have all plugins and themes under version control inside a directory named wp-content in the repository.

name: "PHP Syntax Check, virus scanning, and WP Plugins & Themes vulnerability scanning"

on:
  push:
    branches:
      - '**'

jobs:
  wp-scanner:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
      
      - name: WordPress Scanner
        uses: 10up/wp-scanner-action@v1
        with:
          vuln_api_provider: 'patchstack'
          vuln_api_token: ${{ secrets.PATCHSTACK_TOKEN }}
          content_dir: './wp-content'
          wp_core_version: '6.5.5'

Support Level

Active: 10up is actively working on this, and we expect to continue work for the foreseeable. Bug reports, feature requests, questions, and pull requests are welcome.

Changelog

A complete listing of all notable changes to this Github Action are documented in CHANGELOG.md.

Contributing

Please read CODE_OF_CONDUCT.md for details on our code of conduct, CONTRIBUTING.md for details on the process for submitting pull requests to us, and CREDITS.md for a listing of maintainers and contributors.

Like what you see?