10up/WordPress Scanner Action
Scan WordPress sites for plugins and themes vulnerabilities, PHP syntax and viruses
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Jul 31, 2025
- License
- MIT
Pinned Snippet
uses: 10up/wp-scanner-action@75371fe927396bd16da76de26884d9b777e92b0d # v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| vuln_api_provider | Vulnerability API provider | no | wordfence |
| vuln_api_token | Token to authenticate with the vulnerability API provider | no | — |
| disable_vuln_scan | Disable the Plugin and Themes scanner | no | false |
| virus_scan_update | Update the ClamAV definitions database before executing the virus scan | no | true |
| disable_virus_scan | Disable the virus scanner | no | false |
| phpsyntax_enable_debug | Enable PHP syntax debug output | no | false |
| disable_phpsyntax_check | Disable the PHP syntax check | no | false |
| content_dir | Location of the wp-content directory inside the repository | no | — |
| wp_core_version | WordPress Core version to use for the vulnerability scans | no | — |
| composer_build | Run composer install before scanning | no | false |
| no_fail | Exit without failing even if any issues are found | no | false |
Outputs
no outputs