Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SITE-1500] Remove WPScan integration with launchcheck #9181

Merged
merged 3 commits into from
Aug 26, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -30,45 +30,6 @@ This mechanism does not actually perform requests on your site, and in doing so

WP Launch Check is a site audit extension for WP-CLI designed for Pantheon customers, although it is fully usable outside of Pantheon.

## WPScan (Recommended)

WP Launch Check uses the [WPScan API](https://wpscan.com/api) to check for outdated or vulnerable plugins. The service sends alerts when your plugins need to be updated. Follow the steps below to use this service.

1. Obtain an [API token](https://wpscan.com/wordpress-security-scanner) from the WPScan website by creating an account.

1. Add the token to your site's `wp-config.php` file using the following PHP code:

```php:title=wp-config.php
define( 'WPSCAN_API_TOKEN', '$your_api_token' );
```
1. Define the environment.

You'll also need to define which environment you want WPScan to run on using the `PANTHEON_WPSCAN_ENVIRONMENTS` constant. This constant is required to use the WPScan functionality, and allows you to decide whether or not scans are done on multiple environments, or just one.

To scan one environment:

```php:title=wp-config.php
define( 'PANTHEON_WPSCAN_ENVIRONMENTS', 'live' );
```

To scan multiple environments:

```php:title=wp-config.php
define( 'PANTHEON_WPSCAN_ENVIRONMENTS', ['dev', 'test', 'live'] );
```

To scan all environments:

```php:title=wp-config.php
define( 'PANTHEON_WPSCAN_ENVIRONMENTS', '*' );
```

<Alert title="Note" type="info" >

Scanning multiple or all environments exhausts your daily API request quota faster.

</Alert>

## Run Launch Check Manually

You can manually perform a site audit with WP Launch Check from the command line using [Terminus](/terminus).
Expand Down Expand Up @@ -120,10 +81,6 @@ The `wp_options` table stores several types of data for your site, including:

If your website is running slow and you receive the following message in the database stats: `consider autoloading only necessary options`, review [Optimize Your wp-options Table and Autoloaded Data](/optimize-wp-options-table-autoloaded-data).

### Probable Exploits

This check will display a list of exploited patterns in code, the file name that has the exploit, line number, and match.

### Object Cache

This tells you if Object Caching and Redis are enabled.
Expand All @@ -139,11 +96,11 @@ Performance and Elite WordPress site(s) that are currently running WP Redis are

### Plugins

This check lists all your enabled plugins and alerts you when they need to be updated. It also checks for any vulnerabilities.
This check lists all your enabled plugins and alerts you when they need to be updated.

- **Green:** All of your plugins are up-to-date
- **Yellow:** Highlighted plugins need to be updated
- **Red:** Displays all vulnerabilities and unsupported plugins
- **Red:** Displays unsupported plugins

#### Unsupported Plugins

Expand Down
12 changes: 12 additions & 0 deletions source/releasenotes/2024-08-14-launchcheck-0-8-0.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---
title: WP Launch Check and WordPress Status Page Update
published_date: "2024-08-15"
categories: [wordpress]
---

WP Launch Check has been updated to remove outdated security checks, including WP Scan integration. The platform's WP Scan integration was removed in 2022, and removed from WP Launchcheck's plugin/theme output in 2023.

* The outdated "Probable exploits" section of the Site Status page within the Pantheon Dashboard has been removed.
* The WP Launch Check `secure` command is no longer available

We are actively developing a new WordPress vulnerability monitoring and notification service powered by [Patchstack](https://patchstack.com/). Stay tuned for more details soon.
Loading