About our scanner

If you've seen the PatchCheckupBot/1.0 user-agent in your site's logs, this page explains exactly what it does.

What we do

• We send a few standard GET requests to the homepage, /readme.html, /wp-json/, and /wp-login.php — no different from any browser visiting those pages.
• We read the PHP version from public response headers when exposed, the WordPress core version from the generator tag, and plugin versions from the version query string on public asset files.
• We compare the detected versions against a curated list of pre-verified, publicly disclosed CVEs.

What we don't do

• We never attempt to log in, submit forms, or try credentials.
• We never exploit or attempt to trigger any vulnerability.
• We never modify anything on your site.
• We don't re-scan a site unless someone requests it again.

I don't want my site scanned

If you'd like your site excluded from PatchCheckup scans, or have any question about this bot, contact us at [email protected].