Performs syntax checks, virus scanning and plugins and themes vulnerability checks for WordPress sites

This Github Action performs standard scanning for WordPress sites which includes PHP syntax checks, virus scanning and plugins and themes vulnerabilities scanning.

This Action leverages our own WP-CLI Vulnerability Scanner to perform the known vulnerabilities scanning of WordPress plugins and themes. WP-CLI Vulnerability Scanner works with WPScan, Patchstack and Wordfence Intelligence to check reported vulnerabilities; you can choose any one of these three to use. Note: Authentication is optional for the Wordfence Intelligence Vulnerability API.

This example assumes that you have a wp-content based repository and uses Patchstack as the API provider.

name: "PHP Syntax Check, virus scanning, and WP Plugins & Themes vulnerability scanning"

on:
  push:
    branches:
      - '**'

jobs:
  wp-scanner:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
      
      - name: WordPress Scanner
        uses: 10up/wp-scanner-action@v1
        with:
          vuln_api_provider: 'patchstack'
          vuln_api_token: ${{ secrets.PATCHSTACK_TOKEN }}
          content_dir: './'
          wp_core_version: '6.5.5'
          composer_build: 'true'

This example assumes that you have all plugins and themes under version control inside a directory named wp-content in the repository.

name: "PHP Syntax Check, virus scanning, and WP Plugins & Themes vulnerability scanning"

on:
  push:
    branches:
      - '**'

jobs:
  wp-scanner:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
      
      - name: WordPress Scanner
        uses: 10up/wp-scanner-action@v1
        with:
          vuln_api_provider: 'patchstack'
          vuln_api_token: ${{ secrets.PATCHSTACK_TOKEN }}
          content_dir: './wp-content'
          wp_core_version: '6.5.5'

Active: 10up is actively working on this, and we expect to continue work for the foreseeable. Bug reports, feature requests, questions, and pull requests are welcome.

A complete listing of all notable changes to this Github Action are documented in CHANGELOG.md.

Please read CODE_OF_CONDUCT.md for details on our code of conduct, CONTRIBUTING.md for details on the process for submitting pull requests to us, and CREDITS.md for a listing of maintainers and contributors.