CyberNote Security Checker

説明

CyberNote Security Checker is a lightweight plugin that audits your WordPress site’s security posture without sending any data to external servers.

Many security plugins are powerful but heavy, English-only, and full of technical jargon. CyberNote Security Checker takes the opposite approach: it targets Japanese individual bloggers and small business owners who need to understand exactly what to do — delivered quickly and without specialist knowledge.

12項目を診断。外部通信は一切ありません。

A widget appears on the WordPress dashboard showing results in three levels: good (no action needed) / attention (improvement recommended) / recommended (priority action required). Each item includes a plain-Japanese explanation of the risk and step-by-step remediation guidance.

Category A: Version Freshness (3 checks)

• WordPress core — Detects whether security-only maintenance releases are unapplied. Distinguishes urgency between security patches and feature updates.
• PHP version — Evaluated against official PHP support status. End-of-life versions flagged as “priority action”; security-only branches as “attention”.
• Plugin and theme updates — Displays the count and names of pending updates. A direct link opens the standard WordPress update screen; the plugin never performs updates itself.

Category B: Hardening Settings (9 checks)

• Debug display — WP_DEBUG with screen output on a production site is flagged as “priority action”; log-only mode as “attention”.
• ファイル編集機能 — 管理画面からテーマやプラグインのコードを編集できる設定が有効な場合、「要対応」として表示します。
• Admin username — If a user named admin or administrator exists, flagged as “attention” (changing it carries migration risk, so no urgent push).
• HTTPS — Sites running on plain HTTP are flagged as “priority action”.
• Database table prefix — Default wp_ prefix flagged as “attention” (live-site changes carry risk, so no urgent push).
• XML-RPC — Enabled XML-RPC is flagged as “attention”; use-case guidance included before recommending disablement.
• REST API user enumeration — If anonymous requests to /wp/v2/users return user data, flagged as “attention”.
• Security keys (salts) — Checks whether the wp-config.php authentication unique keys and salts are set and not left at the default placeholder. Missing or default keys are flagged as “priority action” (login cookies could be forged). Key values are never read out or displayed.
• 未使用のプラグイン・テーマ — 停止中のプラグインや未使用のテーマもサーバー上にファイルが残るため、脆弱性がある場合は攻撃に悪用される可能性があります。該当する場合は「改善推奨」として表示し、削除方法を案内します。予備としてテーマを1つ残すことは問題ありません。

設計方針

• 読み取り専用 — 診断結果を表示するだけで、サイトの設定やファイルを自動的に変更することはありません。
• No external requests — Every check reads WordPress built-in APIs and site configuration only. Nothing leaves your server.
• Lightweight — No real-time file scanning, no custom WAF, no resident processes. Diagnostics run once when the admin page loads.
• 平易な説明 — 専門用語の使用を避け、各項目について「なぜ確認が必要か」「何をすればよいか」を日常的な言葉で説明します。

Vulnerability alerts (separate external service)

This plugin is free and fully functional on its own. Matching your installed plugins and themes against external vulnerability databases (CVE) requires server-side processing that cannot be done locally, so it is offered separately as an external service called CyberNote, not bundled in this plugin. See https://www.cybernote.click/wp-security-checker-guide/ for details.