# AskarLabs — Full site content Source: https://askarlabs.com/ Generated: 2026-06-27 AskarLabs makes security software for developers and site owners. Two product lines: CMS Security (vScan, vPatch) and Identity & Access (PasswordLab). --- ## Homepage — https://askarlabs.com/ ### Hero Security tools for your CMS sites and your team's passwords. vScan checks your WordPress, Joomla and Drupal sites for plugin vulnerabilities around the clock. PasswordLab keeps your team's credentials on servers you control. ### Products **CMS Security** — Covers WordPress, Joomla and Drupal from start to finish. Find what is exposed, patch it and keep watching it. All from one place. (2 products · 1 live) **vScan** (live) Continuous vulnerability scanning for every plugin, theme and core file you ship. - Re-scan the moment a new CVE is published - WordPress, Joomla and Drupal, one dashboard - Findings ranked by real exploitability **vPatch** (coming soon) Apply security patches automatically, with a one-click rollback when something goes sideways. - Staged rollouts with health checks at each step - Diffs reviewed before anything touches production - Atomic rollback to the last known-good state **Identity & Access** — Your team's passwords stored on servers you control. You decide who can access what and from where. (1 product · 1 live) **PasswordLab** (live · passwordlab.io) A self-hosted password manager for business. Install it on your own server, your cloud, or bare metal. Your passwords never leave your infrastructure. - AES-256 at rest and in transit, with 2FA on by default - Deploy on AWS, GCP, Azure, DigitalOcean, Linode — or bare metal - Web app, browser extension and mobile, sharing one vault - Per-seat licensing starting at 5 — affordable from team to enterprise --- ## WPAudit — https://askarlabs.com/wpaudit/ Title: Free WordPress Security Audit Tool — AskarLabs Description: Check if your WordPress site has security holes. Free online scan by AskarLabs. No sign up needed. Free online security check for any public WordPress site. Runs 13 passive checks from outside the site — no plugin, no login, nothing to install. Results arrive in under a minute with a 0–100 score and per-check pass/warn/fail results. ### Hero Is your WordPress site exposed? Check any WordPress site for security problems in seconds. We test for the 13 most common weaknesses and give you a clear score. No plugin, no login, nothing to install. ### How it works 01 — Enter your URL Type your WordPress site address in the box above. No account or plugin needed. 02 — We run 13 checks Our tool checks your version, headers, config, plugins, and more. Takes under a minute. 03 — Get your report See a simple pass, warn, or fail result for each check. Each one includes advice on what to do. ### 13 checks 1. **WordPress Version** — Checks if your WordPress version is old and if it leaks version info through readme.html or generator tags. 2. **Readme.html Exposure** — Checks if readme.html is public. This file gives attackers your exact version number. 3. **Login Page Exposure** — Checks if the standard WordPress login pages are available like normal. 4. **User Enumeration** — Checks if attackers can find usernames through /?author=1 for brute force attacks. 5. **XML-RPC** — Checks if xmlrpc.php is turned on. This can be used for brute force and DDoS attacks. 6. **Open Registration** — Checks if anyone can sign up for an account on your site without approval. 7. **File Editor** — Checks if the theme and plugin editor is accessible. DISALLOW_FILE_EDIT setting. 8. **Debug Display** — Checks if WP_DEBUG_DISPLAY leaks PHP error messages to your site visitors. 9. **SSL / HTTPS** — Checks if HTTPS is forced and if HTTP traffic redirects to the secure version. 10. **Security Headers** — Checks for X-Frame-Options, HSTS, CSP, Referrer-Policy and 3 other headers. 11. **Directory Listing** — Checks if wp-content folders show their file lists when visited directly. 12. **Outdated Plugins** — Checks readme.txt files of 6 common plugins: Yoast SEO, Contact Form 7, Elementor, WooCommerce, Wordfence Security, and Akismet. 13. **TimThumb** — Checks for exposed timthumb.php files that have known remote code execution flaws. ### Why it matters - 43% of all websites use WordPress. This makes it the biggest target on the internet. - 96% of WordPress security issues come from plugins and themes, not WordPress itself. - 39 seconds is the average time between automated attacks on a typical exposed site. ### How the scan works 1. User enters a public WordPress URL in the form. 2. The tool makes passive HTTP requests from the AskarLabs server — no agent, no plugin. 3. Each check runs server-side via curl with a custom user-agent string. 4. Results stream back in real time over Server-Sent Events (SSE). 5. Each check returns a result object with a status (pass/warn/fail), label, detail text, and a score out of 100. 6. The overall 0–100 Security Score is an average of all 13 check scores. 7. The score maps to a grade: Excellent (85+), Good (70–84), Fair (50–69), Poor (0–49). ### What is a WordPress security audit A WordPress security audit is a systematic check of your site's configuration, installed components, and public-facing security posture. Unlike automated malware scanning — which looks for existing infections — a security audit identifies potential entry points before an attacker can use them. You should run a security audit after any major update — a new plugin, theme change, or core upgrade. You should also run one if you have never checked your site before, or if it has been more than a few weeks since your last review. ### FAQ Q: Is this scan really free? A: Yes. The tool runs all 13 checks against any public WordPress site at no cost. You do not need to sign up. Continuous monitoring is a separate paid product called vScan. But this one-time check is always free. Q: Do I need to install a plugin? A: No. The check happens from outside your site. We only look at what your site shows to the public internet. Nothing gets installed on your server. Q: How long does a scan take? A: Usually under a minute. The tool runs all 13 checks one after another and shows each result as it finishes. You see findings appear live. Q: Is it safe to run on a live site? A: Yes. The tool only reads public pages. It never logs in, changes anything, or tries to break into your site. Q: How is the security score calculated? A: Each check adds to a score out of 100. A pass gives full points, a warning gives partial points, and a fail gives zero. The total maps to a grade: Excellent, Good, Fair, or Poor. Q: How often should I re-scan? A: New security issues come out every day. We suggest scanning after each plugin, theme, or core update. Or use vScan for ongoing monitoring that alerts you when something changes. ### CTA This check gives you a snapshot. vScan re-checks your site whenever a new problem is found and tells your team before attackers can use it. --- ### Why AskarLabs Built by people who use security tools, for people who use security tools. 01 — Tools that tell you what matters No noise, no vague scores. Each product tells you what is wrong, where it is, and what to fix. Then it leaves you alone. 02 — Run them your way PasswordLab runs on your own server today. The CMS Security line is SaaS with self-hosted plans on the way. Your call. 03 — One bill, one team, one standard Start with one product and add more when you're ready. Same account, same support team, same way of doing things. --- ## vScan landing — https://askarlabs.com/vscan/ Title: WordPress, Joomla & Drupal Vulnerability Scanner — AskarLabs vScan Description: Automated vulnerability scanning for WordPress, Joomla and Drupal. Detect plugin vulnerabilities, misconfigurations and security gaps before attackers do. ### The risk Most sites get hacked through a plugin someone forgot to update. Outdated plugins, themes and core files are the most common entry point for attackers. The fix is simple once you know what to look at. - 61% of CMS breaches trace back to a known, unpatched vulnerability. - 47 days — average time between a CVE being published and a typical site patching it. - 4.2M live sites are running a plugin with an active vulnerability right now. ### How it works Set up in minutes, protected around the clock. 01 — Install the plugin Install and activate the vScan plugin on your CMS site. One-time setup, no server access, no dev work needed. 02 — We scan continuously We check every component on your site against newly published CVEs around the clock. 03 — Get alerted straight away When we find a vulnerability, we send an alert to your team right away. ### Capabilities Everything vScan does for your site. - Continuous CVE monitoring — We re-scan as soon as a new vulnerability is published. - Multi-CMS coverage — WordPress, Joomla and Drupal, all in one dashboard. - CVE severity scoring — Every finding shows its CVE score so you know how serious it is. - Full-stack coverage — Plugins, themes and core files all checked, not just the top layer. - Alert routing — Email alerts go out as soon as we find a vulnerable component. Slack and webhook support coming soon. ### FAQ Q: What CMS platforms does vScan support? A: WordPress, Joomla, and Drupal — monitored from a single dashboard. Q: How often does vScan check for new vulnerabilities? A: vScan re-scans the moment a new CVE is disclosed. Coverage is continuous and event-driven. Q: Does vScan require server access or developer setup? A: No. It installs as a plugin. No server access, no SSH, no developer involvement required. Q: How does vScan differ from Wordfence or Patchstack? A: vScan is purpose-built for multi-site monitoring across WordPress, Joomla, and Drupal in one dashboard. It focuses on CVE-based vulnerability detection with severity-ranked alerts. Q: Can vScan integrate with our existing alerting tools? A: vScan ships with email alerts. Slack and webhook routing are on the near-term roadmap. --- ## vScan features — https://askarlabs.com/vscan/features/ Title: vScan Features — CVE Monitoring & Plugin Scanning Description: Explore every vScan feature including full-stack inventory, hourly CVE monitoring, severity scoring, scheduled scans and real-time alerts for WordPress, Joomla and Drupal. ### Full-stack inventory From plugin to PHP, nothing left out. Every component on your CMS gets checked: plugins, themes, WordPress core, PHP runtime, the web server itself. Each one logged with its version and any known vulnerabilities. - Type-aware inventory: Plugin · Theme · Core · Server · Runtime - Filter chips: Vulnerable · Safe · By type · Search by CVE ### CVE monitoring Every new CVE checked against your site. Hourly on Premium, daily on Free. vScan pulls from public CVE feeds and our own database. When a new vulnerability is published for something on your site, it gets flagged on your next scan. Every hour on Premium, every 24 hours on Free. - Hourly scanning (Premium): Your site re-fingerprinted every 60 minutes - Daily scanning (Free): Full inventory re-scan once every 24 hours - Severity prioritization: Real exploitability ranks first, not just CVSS - Impact-scored alerts: Only flagged if the vulnerable component is active on your site ### Feature grid - Scheduled scanning — Every component re-checked on your next scan automatically. No manual trigger needed. Premium runs every hour, Free runs every 24 hours. - Full-stack inventory — Plugins, themes, CMS core, PHP runtime, web server. Every layer checked and logged with its exact version. Checks up to 9 layers per site. - Severity prioritization — Findings ranked by how likely they are to be exploited, not just the highest CVSS score. Scored on 4 axes: CVSS, EPSS, exposure, popularity. - Smart filtering & search — Filter by status and type with live counts. Search by software name, version or CVE ID. Find any item in 2 keystrokes. - Alerts routing — Email, Slack and webhooks send an alert when we find a vulnerable component on your site. (Email live · Slack · Webhook coming soon) - CSV export — Pull the whole inventory or just the vulnerable rows. For audits, compliance, or piping into your own tools. (Coming soon) ### Multi-CMS coverage Three CMSes, one console. Whatever flavour of CMS your team ships on, vScan speaks it. Same dashboard, same inventory model, same CVE feed — just pointed at a different stack. - WordPress: Plugins · Themes · Core · MU — Full coverage · 96k+ plugins indexed - Joomla: Extensions · Templates · Core — Full coverage · 8.4k+ extensions indexed - Drupal: Modules · Themes · Core · Profiles — Full coverage · 47k+ modules indexed ### Privacy & control No access to your server. No changes to your files. No agents installed on your server. No write access to your database or files. vScan only reads what is installed and reports back. - API key: Bound to one domain. Every API key locks to a single domain on first save. If someone exfiltrates it, it can't be used anywhere else. - CMS plugin: Installed in your CMS. Not on your server. vScan runs as a lightweight plugin inside your WordPress, Joomla or Drupal. No SSH credentials, no server daemon, no kernel access. - Read-only: We look. We don't touch. vScan never writes to your database, never edits a file, never auto-runs an update. Your hand stays on every fix. --- ## vScan pricing — https://askarlabs.com/vscan/price/ Title: vScan Pricing — Plans for Agencies & Hosts Description: Simple, transparent pricing for vScan. Start free for one site and scale to agency and hosting plans as your portfolio grows. Free forever · Cancel anytime · No card required Pricing that fits one site or ten thousand. Whether you run one personal site, a roster of client sites, or thousands of hosted sites, there is a plan for you. Switch any time. ### Individual plans (1–10 sites) For developers and small site owners running their own WordPress, Joomla or Drupal projects. **Free — $0/year** One site, daily scans, no card needed. - 1 website - Daily automated scan - Email alerts on critical CVEs Frequency: 1 site · Scan every 24 hours No credit card · Cancel never **Starter — $39/year** (Most chosen) For a business owner with one site who wants hourly scanning. - 1 website - Hourly automated scan - Email alerts on critical CVEs - Slack & webhook alerts (coming soon) Frequency: 1 site · Scan every hour Billed annually · Cancel anytime **Pro — $351/year** (Power users) For developers running multiple projects at once. - 10 websites - Hourly automated scan - Email alerts on critical CVEs - Slack & webhook alerts (coming soon) - Priority email support Frequency: 10 sites · 10% discount · Scan every hour Billed annually · Cancel anytime ### Agency plans (11–500 sites) For agencies managing security across a roster of client sites. Reseller margin and client workspaces included. **Studio — $828/year** (Small studio) For small studios managing up to 25 client sites. - 25 sites - 15% discount - Hourly automated scan - Email alerts on critical CVEs - Slack & webhook alerts (coming soon) - Priority email support Frequency: 25 sites · 15% discount **Agency — $3,120/year** (Most chosen) For agencies running security scanning for their clients. - 100 sites - 20% discount - Hourly automated scan - Email alerts on critical CVEs - Slack & webhook alerts (coming soon) - Priority email support Frequency: 100 sites · 20% discount **Agency+ — $14,625/year** (Scale) For large agencies and MSPs managing hundreds of sites. - 500 sites - 25% discount - Dedicated support engineer - Hourly automated scan - Email alerts on critical CVEs - Slack & webhook alerts (coming soon) - Priority email support - Priority phone support Frequency: 500 sites · 25% discount ### Hosting Provider plans (500+ sites) For hosting providers running vScan across thousands of customer sites. Bulk enrolment, custom contracts and data residency available. **Enterprise — Custom pricing** For hosting providers running vulnerability scanning across thousands of customer sites. - Unlimited sites - Bulk enrolment via API or CSV - Choose EU / US / APAC residency - Co-branded tenant portal - 99.99% uptime SLA - Dedicated CSM & quarterly review - High-throughput API (50 rps) - On-prem & private cloud deploy - 24/7 phone support - Dedicated engineer Frequency: Unlimited sites · Custom contract Contact: /contact/ ### Included in every plan WordPress, Joomla & Drupal · Plugin, theme & core scans · Email alerts ### Pricing FAQ Q: What counts as a "site"? A: One unique domain or subdomain running a CMS. example.com and blog.example.com count as two. Q: Can I switch tiers mid-month? A: Yes. Whether you upgrade or downgrade, your existing licence key stops working immediately and a new key is issued with the remaining days carried over. Q: What happens if I exceed my site count? A: Your licence key will refuse to register any new domain once your site limit is reached. Existing sites continue scanning uninterrupted. You just won't be able to add more until you upgrade. Q: Do you install anything on my server? A: Just install the vScan plugin for your CMS like WordPress, Joomla, or Drupal. That's it. No server access, no SSH, no custom configuration required. Q: Is the free tier really free forever? A: Yes. One site, a scan every 24 hours, email alerts on critical CVEs. No card required, no trial timer. Q: What's the refund policy? A: We don't offer refunds. Instead, we encourage you to start with our fully featured free plan. Take your time, see if vScan is right for you, and only upgrade when you're confident. Cancel anytime; access continues until the end of the period you've paid for. Q: Do you support reseller / partner pricing? A: Agency and Hosting Provider tiers include reseller margin out of the box. For volumes over 25,000 sites, we offer custom contracts with custom margin — talk to sales. --- ## vScan documentation ### Docs index — https://askarlabs.com/docs/ Official documentation for vScan by AskarLabs. Get started, configure scans, manage your API key and understand your security score. Four sections: Get started (3 pages) · Using vScan (4 pages) · Configuration (3 pages) · Reference (2 pages) --- ### Overview — https://askarlabs.com/docs/vscan-overview/ What is vScan? vScan continuously monitors your WordPress site for known vulnerabilities — inventorying every plugin, theme, core file, and runtime, then cross-referencing against a live CVE feed. Level: Beginner · Read time: 4 min · Applies to: WordPress · Updated: June 22, 2026 #### What vScan does - Inventories your site — every active and inactive plugin, every theme, WordPress core, PHP runtime, web server software, and loaded PHP extensions. - Checks for CVEs — sends the inventory to the AskarLabs API, which cross-references it against a continuously updated vulnerability database. - Calculates a Security Score — a 0–100 score that reflects how many vulnerable items you have and how severe their CVEs are. - Shows actionable results — a filterable table listing every scanned item, its status (Vulnerable / Secure / Unknown), and direct links to CVE records on the National Vulnerability Database (NVD). - Scans automatically — runs on a schedule without you needing to remember to check (Free plan: once per day; Premium: up to 25 times per day). #### Key concepts - Inventory: The full list of software components collected from your site before each scan. - CVE: A public vulnerability record (Common Vulnerabilities and Exposures) with an ID, severity, and description. - Security Score: A 0–100 number that summarises your site's vulnerability posture. - API key: Your personal credential that connects the plugin to the AskarLabs vulnerability feed. - Domain binding: Your API key is permanently locked to the site it is first saved on. - Rate limit: The maximum number of scans you can trigger within a 24-hour window. #### How a scan works 1. The plugin collects your full site inventory. 2. The inventory is sent securely to the AskarLabs API over HTTPS. 3. The API enriches each item with status and CVEs fields and returns the result. 4. The plugin stores the enriched results and recalculates your Security Score. 5. The dashboard updates to show the latest findings. The whole process typically takes under 30 seconds. --- ### Installation — https://askarlabs.com/docs/vscan-installation/ Install vScan on your WordPress site. Installing vScan takes about two minutes. Upload the plugin zip, activate it, and you're ready to enter your API key. Level: Beginner · Read time: 3 min · Applies to: WordPress · Updated: June 22, 2026 #### Requirements | Requirement | Minimum | | WordPress | 5.0 or later | | PHP | 7.4 or later | | MySQL / MariaDB | 5.6 / 10.1 or later | | HTTPS | Recommended (required for production API keys) | | Outbound HTTP | Server must be able to reach the AskarLabs API | #### Install from the WordPress admin 1. Log in to your WordPress admin panel. 2. Go to Plugins → Add New Plugin. 3. Click Upload Plugin. 4. Choose the askarlabs-vscan.zip file you downloaded. 5. Click Install Now, then Activate Plugin. After activation you will be redirected automatically to the Settings page to enter your API key. #### Install via FTP / SFTP 1. Unzip askarlabs-vscan.zip on your local machine. 2. Upload the resulting askarlabs-vscan folder to /wp-content/plugins/ on your server. 3. In your WordPress admin go to Plugins → Installed Plugins. 4. Find AskarLabs vScan in the list and click Activate. #### Deactivating and uninstalling Deactivate (plugin stays installed, data is kept): Go to Plugins → Installed Plugins, find AskarLabs vScan, and click Deactivate. The cron job is removed but all scan data and options remain in the database. Uninstall (complete removal): Click Delete from the plugins list after deactivating. This permanently removes all scan history. Warning: Uninstalling is irreversible. Export any scan history you need before proceeding. --- ### Getting started — https://askarlabs.com/docs/vscan-getting-started/ Connect vScan and run your first scan. Once the plugin is installed, connecting it to the AskarLabs feed takes about two minutes — then you're ready to scan. Level: Beginner · Read time: 5 min · Applies to: WordPress · Updated: June 22, 2026 #### Step 1 — Get an API key If you do not have an API key yet: 1. Go to askarlabs.com/vscan and sign up for a free account. 2. After signing up, your API key will be emailed to you. 3. Copy the key — it is a 64-character string of letters and numbers. Keep the key safe. It is tied permanently to the first domain it is used on. #### Step 2 — Open the Settings page In your WordPress admin sidebar, click vScan → Settings. You will see the API configuration card showing a "Not connected" badge. #### Step 3 — Enter your API key 1. Paste your 64-character API key into the API Key field. 2. Enter the API Base URL from the same email that contained your API key. Domain binding warning: The first time you save your key it is permanently locked to this site's domain. Make sure you are on your production site, not a staging or development environment, before saving. 3. Click Connect. vScan will immediately verify the key against the AskarLabs API. This takes about two seconds. #### Step 4 — Wait for verification The plugin validates your key by checking: - That the key is a valid 64-character hexadecimal string. - That the key exists in the AskarLabs system and has not expired. - That the domain you are connecting from is not already bound to a different key. If validation succeeds, the settings card switches to the Connected (green) state and shows "Key validated · 64 chars." #### Step 5 — Run your first scan Once connected, navigate to vScan → Dashboard. Click the Scan Now button in the top-right corner. Results appear within about 20–30 seconds. --- ### Dashboard — https://askarlabs.com/docs/vscan-dashboard/ Reading the scan results dashboard. The dashboard is your daily command centre — security score, key stats, and a filterable table of everything running on your site. Level: Beginner · Read time: 5 min · Applies to: WordPress · Updated: June 22, 2026 #### Security score The large number at the top is your Security Score — a value from 0 to 100. Score tiers: - 80–100: Good - 60–79: Fair - 40–59: Poor - 0–39: Critical #### KPI cards - Items inventoried — total number of software components detected. - Vulnerable — items with at least one known CVE. Turns red when non-zero. - Secure — items with no known CVEs at the time of the last scan. - CVEs found — total number of distinct CVE records matched against your inventory. #### Results table Each row shows: component name and type, installed version, status (Vulnerable / Secure / Unknown), CVE count with expandable CVE IDs, CVSS scores, and descriptions. Filtering: filter chips (All / Vulnerable / Secure) and a search box (by component name, version, or CVE ID). #### Running a scan Click Scan Now in the top-right corner to trigger an immediate scan. After the scan completes, the score and table refresh automatically. --- ### Security score — https://askarlabs.com/docs/vscan-security-score/ How the security score is calculated. The Security Score is a single number from 0 to 100 that summarises your site's current vulnerability posture. A higher score means fewer and less severe vulnerabilities. Level: Intermediate · Read time: 4 min · Applies to: WordPress · Updated: June 22, 2026 #### Scoring factors - CVE severity (CVSS): Higher CVSS scores carry more weight. - Number of vulnerabilities: More CVEs lower the score. - Component exposure: Core files and actively-used plugins are weighted more heavily than inactive items. - Fix availability: Components with a known patched version available are flagged as higher-priority. #### Score tiers - 80–100 Good: No critical findings; any issues are low-severity. - 60–79 Fair: At least one medium-severity finding worth reviewing. - 40–59 Poor: High-severity vulnerabilities present; act within the week. - 0–39 Critical: One or more critical CVEs; act immediately. #### When the score changes The score updates after every scan. It can go up (you update a vulnerable component) or down (a new CVE is published for one of your installed components). Because the AskarLabs vulnerability feed is updated continuously, your score can change between scans even if you have not touched anything on your site. --- ### Scanning — https://askarlabs.com/docs/vscan-scanning/ Manual and scheduled scanning. vScan offers two ways to run a scan — on demand from the dashboard, and automatically on a schedule. Both collect the same full site inventory. Level: Beginner · Read time: 4 min · Applies to: WordPress · Updated: June 22, 2026 #### Manual scans Navigate to vScan → Dashboard and click Scan Now. The button becomes disabled during the scan and re-enables once results have been processed. Most sites complete a scan in under 30 seconds. #### Scheduled scans vScan uses WordPress's built-in WP-Cron system to run automatic scans on a schedule. - Free plan: Once per day - Premium plan: Up to 25 times per day Automatic scans run in the background — you do not need to be logged in to WordPress for them to fire. Note: WP-Cron is triggered by site visits. On low-traffic sites, scheduled scans may fire slightly later than expected. For reliable timing, consider a server-level cron calling wp-cron.php directly. #### Scan history vScan does not retain historical scan data. Each scan overwrites the previous results — the dashboard always reflects the most recent scan only. #### Rate limits The AskarLabs API limits how many scans you can trigger within a 24-hour window. If you hit the limit, the Scan Now button will be disabled and a notice will appear explaining when the limit resets. --- ### What gets scanned — https://askarlabs.com/docs/vscan-what-gets-scanned/ Everything vScan inventories. Every scan collects a complete inventory of your WordPress environment before sending it to the AskarLabs API. Level: Intermediate · Read time: 4 min · Applies to: WordPress · Updated: June 22, 2026 #### Plugins All plugins — both active and inactive — are inventoried. Each record includes plugin slug and display name, installed version, and active/inactive status. Inactive plugins are checked because they still exist on disk and can be exploited in certain attack scenarios. #### Themes All installed themes, including active and inactive themes. Records include name, slug, and installed version. Tip: Remove themes you are not using — inactive themes with known CVEs still count against your Security Score. #### WordPress core The installed version of WordPress core is detected and checked against the CVE database. #### PHP runtime The PHP version in use is detected and checked. Includes the major version (e.g. 8.1) and the full patch version (e.g. 8.1.29). Outdated PHP versions often carry known vulnerabilities. #### Web server The web server software and version (Apache, Nginx, LiteSpeed, etc.) is detected from PHP's $_SERVER superglobal and checked against the CVE database. Note: In some hosting environments, the web server version is masked and the component may show as Unknown. #### PHP extensions Loaded PHP extensions (e.g. openssl, curl, gd, mbstring) and their versions are collected via get_loaded_extensions(). Extensions with known CVEs are flagged in the results table. --- ### Settings — https://askarlabs.com/docs/vscan-settings/ The vScan Settings page. The Settings page is where you connect your API key and configure the plugin. The layout adapts based on whether an API key is currently saved. Level: Beginner · Read time: 3 min · Applies to: WordPress · Updated: June 22, 2026 #### API configuration card Navigate to vScan → Settings. When no API key is saved, the card shows two fields: - API Key — paste your 64-character hexadecimal key here. - API Base URL — the endpoint URL from the email that contained your API key. Click Connect to save the key and trigger an immediate validation check. Domain binding: The first time you save your key it is permanently locked to this site's domain. Use your production domain, not a staging or local environment. #### Connected state Once validated, the card shows: - A green Connected badge - "Key validated · 64 chars" confirmation text - The bound domain name - The plan tier (Free or Premium) In the connected state, you cannot edit the API key or base URL directly. Disconnect first to change the key. #### Disconnecting Click Disconnect to remove the saved API key from the database. This does not invalidate the key itself — it only removes it from this WordPress installation. Disconnecting does not affect your scan history. Scan results remain in the database unless you uninstall the plugin. --- ### API key — https://askarlabs.com/docs/vscan-api-key/ Getting and managing your API key. Your API key is the credential that connects vScan to the AskarLabs vulnerability feed. It is permanently bound to the first domain it is saved on. Level: Beginner · Read time: 4 min · Applies to: WordPress · Updated: June 22, 2026 #### Get a key API keys are issued when you sign up for vScan at askarlabs.com/vscan. After signing up: 1. Check your email for a message from AskarLabs containing your API key and the API Base URL. 2. If you are on a paid plan, you will also receive a portal access email where you can manage all of your keys. 3. Copy the key before closing the email, treat it like a password. #### Key format vScan API keys are 64-character lowercase hexadecimal strings, e.g.: c775e7b757ede630cd0aa1113bd102661ab38829ca52a6422ab782862f2686e1 #### Domain binding The first time you save an API key in the plugin settings, it is permanently bound to the domain of that WordPress installation. The binding is enforced server-side. Implications: - You cannot use the same key on a different domain. - Changing your domain (e.g. migrating from staging.example.com to example.com) requires a new key. - For agencies or freelancers managing multiple sites, each site needs its own key. Warning: Always connect your key on the production domain first. Binding to a staging or development URL will prevent you from using the key on production without contacting support to reset the binding. #### Key expiry Free plan keys expire periodically and can be regenerated from the website before they lapse. Premium plan keys stay valid for as long as your subscription is active. #### Renewing a key 1. Log in to the AskarLabs portal (link in your original signup email). 2. Navigate to Keys and generate a new key, or renew the existing one. 3. If replacing an old key, disconnect the old key from the plugin via vScan → Settings → Disconnect. 4. Enter the new key and click Connect. Your scan history is preserved across key changes as long as you do not uninstall the plugin. --- ### Plans — https://askarlabs.com/docs/vscan-plans/ Free vs Premium — what's the difference? Both plans use the same vulnerability scanner and CVE database. The difference is how often you can scan and how quickly you receive intelligence updates. Level: Beginner · Read time: 3 min · Applies to: WordPress · Updated: June 22, 2026 #### Plan comparison | Feature | Free | Premium | | Vulnerability scanner | Full | Full | | CVE database | Same | Same | | Manual scans | Yes | Yes | | Automatic scheduled scans | Once per day | Up to 25× per day | | CVE feed update frequency | Daily | Real-time | | Email alerts | No | Yes | | Priority support | No | Yes | #### Free plan Full access to the vulnerability scanner at no cost. Automatic scans run once per day. The CVE feed is updated daily. For most sites, daily scanning is sufficient. Limits: Up to 1 automatic scan per day. #### Premium plan Designed for agencies, e-commerce sites, or any site where a faster response to new vulnerabilities matters. Automatic scans run up to 25 times per day. The CVE feed is updated in real-time. Email alerts notify you immediately when a new vulnerability is found. Limits: Up to 25 automatic scans per day. #### Upgrading 1. Visit askarlabs.com/vscan/price and select a plan. 2. After purchase, a new Premium API key will be emailed to you. 3. In your WordPress admin, go to vScan → Settings, disconnect the existing key, and enter the new Premium key. Your scan history is preserved during the upgrade. --- ### Rate limiting — https://askarlabs.com/docs/vscan-rate-limiting/ Understanding rate limits. The AskarLabs API limits how many scans you can run within a 24-hour window. Level: Intermediate · Read time: 3 min · Applies to: WordPress · Updated: June 22, 2026 #### Limits by plan - Free: 1 scan per 24 hours - Premium: 25 scans per 24 hours Manual and automatic scans share the same pool. #### When you hit the limit - The Scan Now button on the dashboard is disabled. - A notice appears showing the exact time the limit resets. - Automatic scheduled scans are queued and will fire as soon as the window resets. - The restriction is only visible in the admin panel — not to site visitors. #### Reset window The scan quota resets at UTC midnight every day. Your full quota is available again at 00:00 UTC regardless of when during the day you used it. #### Avoiding rate limits 1. Rely on automatic scans — the scheduler is designed to run within your quota. Manual scans should be used for spot-checking after a deployment, not routine monitoring. 2. Don't click Scan Now repeatedly — each scan takes about 30 seconds; wait for one to complete before starting another. 3. Upgrade to Premium if your workflow genuinely requires more than 1 scan per day. --- ### Troubleshooting — https://askarlabs.com/docs/vscan-troubleshooting/ Troubleshooting common issues. Most vScan issues fall into three categories: connection problems, scan errors, and display issues. Level: Intermediate · Read time: 6 min · Applies to: WordPress · Updated: June 22, 2026 #### Connection errors Key validation fails — common causes and fixes: - "Invalid key format": Key contains non-hex characters or is not 64 chars. Fix: Copy the key again directly from the email. - "Key not found": Key does not exist in the AskarLabs system. Fix: Double-check you used the correct key; contact support if the issue persists. - "Key expired": Premium key with a lapsed subscription. Fix: Renew your subscription in the portal. - "Connection timeout": Server cannot reach the AskarLabs API. Fix: Check outbound HTTP is allowed; whitelist the AskarLabs API domain if necessary. Domain already bound — If you see "Domain already bound to a different key", the key was previously connected on a different domain. If you migrated domains, you will need a new API key. Contact support with your old and new domain names. #### Scan errors Scan stuck in progress: 1. Wait at least 2 minutes. 2. Refresh the page. 3. If still showing after 5 minutes, try triggering a new manual scan. 4. Check your PHP error log for vScan entries. Scan completes but no results: - Confirm the API responded successfully by checking the browser console for network errors. - Ensure the API key is still valid (settings page should show a green Connected badge). - Try disconnecting and reconnecting the API key, then run a new scan. #### Display issues Dashboard shows "No scan data yet" after a scan has run: Check that your WordPress database user has INSERT and UPDATE permissions on the wp_options table. Score shows 0 immediately after installing: A score of 0 before the first scan is expected. Click Scan Now to run the first scan. Results table is blank on mobile: Ensure your WordPress theme is not applying max-width: 0 or overflow: hidden to the admin page body. The results table requires a minimum width of approximately 360px. --- ## Contact — https://askarlabs.com/contact/ Talk to a human. We read every message and route it to the right team. No autoresponders pretending to be people, no ticket black holes. Median first reply: Under 4 working hours, Mon–Fri. Or skip the form: hello@askarlabs.com ### Contact routes Route 01 — Sales & demos Custom pricing, agency & host plans, migration help. Replies in: < 1 working day Option: Book a call (20-min Google Meet) Route 02 — Support Bugs, account questions, billing, can't-log-in. Replies in: < 4 working hours 3 humans on shift · Mon–Fri Route 03 — Security disclosure Found a vuln in vScan itself? Tell us. PGP supported. Acknowledgement: < 24 hours PGP key fingerprint: 3D92 · 056D · C27D Route 04 — Press & partnerships Journalists, investors, BD — and integrations. Replies in: < 2 working days Press kit available on request ### Office & trust AskarLabs HQ — AskarLabs Ltd. Mon–Fri · 09:00–18:00 UTC ### Partner programs Agencies, hosting providers, MSPs and regional distributors — we run two formal programs with real margin, co-marketing budget, and a named partner manager. Target partners: Agencies · Hosting providers · MSP / MSSP · Regional resellers · Tech alliances Program 01 — Partner program For agencies and MSPs onboarding their own client roster. Margin built in, co-marketing budget once you're ramped. From 20% margin · hello@askarlabs.com Program 02 — Official distributors For regional distributors and resellers selling vScan into specific markets. Localised invoicing, regional pricing, exclusive territory available. Custom territory · hello@askarlabs.com Program 03 — Tech alliances For platforms, hosts and CMS vendors wiring vScan into their product. Co-engineering, joint roadmap, deep API access. API-first · hello@askarlabs.com Program 04 — Become a partner If you're not sure which program fits, start here and we'll figure it out together on a 30-min call. 30 min · free ### Responsible disclosure Found a vulnerability in vScan? We take responsible disclosure seriously. You'll get an acknowledgement within 24 hours — including from our security lead, by name. - We never threaten or pursue good-faith researchers. - Public credit on our security page once the issue is patched. - Bug bounty for qualifying findings. - 90-day coordinated disclosure window, negotiable for complex bugs. Security email: hello@askarlabs.com PGP fingerprint: 3D92 056D C27D CD29 46C1 0665 · 269B 29F6 7065 BB55 Security.txt: https://askarlabs.com/.well-known/security.txt PGP key: https://askarlabs.com/.well-known/askarlabs-pgp.asc Hall of fame: 14 researchers credited. ### Pre-contact FAQ Q: I'm an agency / host — how fast is sales? A: Under one working day for the first reply. For Agency+ and Host plans, we'll set up a 30-min call before quoting. Q: Can I delete my account & data? A: Yes. Mail hello@askarlabs.com and we'll wipe everything within 30 days, GDPR-style. Q: Do you offer phone support? A: Scheduled calls — yes, via the booking widget. Always-on phone hotline — only for Hosting Provider Enterprise plans, where it comes with a named incident engineer. Q: Where's the press kit? A: A zipped folder with logos, product screenshots, founder bios and a one-pager is available on request from hello@askarlabs.com. We usually reply same-day if there's a deadline attached. --- ## CVE database — https://askarlabs.com/cve/ Every published CVE that affects a CMS, plugin, theme or page builder, indexed, scored and matched against the components running on your sites. Covers WordPress, Joomla, and Drupal. --- ## Legal Privacy Policy — https://askarlabs.com/privacy/ How AskarLabs collects, uses and protects your personal data. Cookie Policy — https://askarlabs.com/cookie/ What cookies AskarLabs uses, why, and how to manage them. GDPR Policy — https://askarlabs.com/gdpr/ Your rights under the General Data Protection Regulation and how AskarLabs handles them. Terms & Conditions — https://askarlabs.com/terms-conditions/ The rules for using AskarLabs products and website.