Korisec is a hosted website security service. This plugin is the official WordPress client: it does not run port scans, Nuclei, or other scanners inside WordPress.
After you paste a plugin key from your Korisec account, the plugin:
- Verifies this site with Korisec and binds the key to this host
- Sends WordPress core, plugin, and theme versions so cloud checks can include software that is not visible from the public internet
- Lets you start a cloud check from wp-admin and show grade, findings, and history
- Lets the billing owner who issued the key manage plan, team seats, PDF reports, and alerts (Telegram, Slack, WhatsApp, webhook)
Without a key, login protection and optional exposure remedies (XML-RPC, public usernames, install.php) still run locally. Those features do not send data to Korisec.
Paid plans, daily scan limits, and white-label PDFs are features of the Korisec service, not locked code inside this plugin. The plugin’s PHP is fully available under GPLv2 or later.
External service
This plugin requires a Korisec account and talks only to https://api.korisec.com (unless you set KORISEC_API_BASE in wp-config.php).
- Terms of Use: https://korisec.com/terms.html
- Privacy Policy: https://korisec.com/privacy.html
- Plugin page: https://korisec.com/wordpress/
- Dashboard: https://app.korisec.com
Nothing is sent until a site administrator pastes a kr_live_… key and clicks Connect.
Data sent after Connect
Typical payloads include this site’s URL and host, WordPress and PHP versions, names and versions of installed plugins/themes (and whether they are active), heartbeat, scan start/status requests, and billing/team/alert settings for the Korisec account that issued the key.