Responsible Use

Last updated: 13 June 2026

CoreScanWP is a reconnaissance tool. Like any tool, it can be used for good or for harm. This page describes what we consider responsible use and what we will not tolerate.

What is okay to scan

• Sites you own and operate
• Sites for which you have written authorization from the owner
• Sites you are evaluating as part of a due-diligence process where reconnaissance is reasonable
• Public information about a competitor or partner that they themselves expose
• Your own learning : exploring how the WordPress ecosystem fits together

What is not okay

• Scanning sites with the intent of finding and exploiting vulnerabilities you are not authorized to fix
• Mass-scanning the internet to compile lists of vulnerable installations
• Using scan results to identify and target outdated installations for any unsanctioned access
• Publishing scan reports that identify a site as vulnerable without first attempting responsible disclosure
• Bypassing rate-limits or technical controls to evade our service's safeguards

How CoreScanWP stays passive

CoreScanWP does not log in, brute-force, exploit, or probe for vulnerabilities. It only reads resources the site already serves to any browser visitor. Specifically:

• Homepage HTML and the headers of that response
• Up to five inner pages, discovered via internal links
• The public /wp-json/, /feed/, and /readme.html endpoints
• Public readme.txt files for ~230 popular plugin slugs
• The theme's style.css file

The scanner does not attempt authentication, does not bypass access controls, and does not trigger any operation that would require a logged-in session.

If you find a vulnerability

If CoreScanWP surfaces a vulnerable plugin or theme on a site you do not own, please disclose responsibly:

1. Find the site's security contact — check the page footer or a security@ address
2. Describe the finding with the CVE id, the detected version, and the fix version
3. Give the operator a reasonable window (30 to 90 days) to patch before disclosing publicly
4. Do not exploit the issue, copy data, or pivot to other systems

Reporting a bug in the scanner itself

Found a false positive, a false negative, or a security issue in CoreScanWP? Please email hello@corescanwp.com. We will respond within seven days.