EU Cyber Resilience Act (CRA), GDPR, and NIS2 compliance dashboard for WordPress — scan your site, score its risk, and generate the documents regulators will ask for.
WordPress.org Listing · Changelog · Installation · Report a Bug
Two EU deadlines apply to most WordPress sites and plugins: a Vulnerability Disclosure Policy obligation on September 11, 2026, and full CRA compliance + CE marking on December 11, 2027 (penalties up to €15M or 2.5% of global turnover). Most site owners don't know where to start. Erdo CRA Compliance scans your site, tells you exactly where you stand against CRA, GDPR, and NIS2, and generates the documents you're expected to produce — a VDP, an SBOM, a security.txt, and a self-assessment checklist.
| Compliance dashboard | Scan results |
|---|---|
| Developer tools | PDF report |
|---|---|
Plugin Risk Scanner — checks every active plugin against CRA readiness criteria: last updated, WordPress version lag, PHP requirements, support health, and closed/removed plugin detection. Each plugin gets a LOW/MEDIUM/HIGH rating with specific reasons.
GDPR Scanner — detects third-party scripts and external resource connections loading on your site (Google Analytics, Facebook Pixel, HubSpot, Intercom, and others) so you can audit consent and data-processing agreements.
NIS2 Scanner — checks site-level security posture against NIS2 Article 21: HTTPS, MFA, backups, WAF, activity logging, and auto-updates.
Compliance Dashboard — animated score ring, per-framework risk counts, a score trend chart across your scan history, and actionable guidance on one screen.
PDF Compliance Report — a formatted, 5-section report with executive summary and prioritised recommendations, ready to hand to a client or auditor.
VDP Generator — a ready-to-publish Vulnerability Disclosure Policy pre-filled with your site details, auto-served at /.well-known/security.txt (RFC 9116).
SBOM Generator — a CycloneDX 1.5 JSON Software Bill of Materials covering WordPress core, active plugins, and the active theme.
Conformity Declaration Template — a structured self-assessment checklist covering CRA Articles 10/11/14, GDPR Articles 25/32/30, and NIS2 Articles 21/23.
Optional Patchstack integration — check installed plugins against known CVEs using your own Patchstack API key (opt-in, off by default).
WP-CLI support — wp erdo-craguard scan and wp erdo-craguard status for running scans from CI/CD pipelines or deployment scripts, no wp-admin required.
WordPress Abilities API — on WordPress 6.9+, exposes get-compliance-status, run-scan, and get-sbom as discoverable, permission-checked abilities, so AI agents and MCP adapters can query and act on compliance data through a standard interface. No-op on older WordPress.
- WordPress site owners in the EU — or anyone with EU users — who need to know what the CRA actually requires before the 2026/2027 deadlines
- Agencies and freelancers — generate a client-ready compliance report and VDP/SBOM in minutes instead of piecing them together by hand
- Plugin and theme developers — audit your own dependency stack for abandoned or vulnerable plugins before they become someone else's compliance problem
- WordPress 6.5+
- PHP 7.4+
- Upload the
erdo-cra-compliancefolder to/wp-content/plugins/, or install directly from Plugins → Add New by searching "Erdo CRA Compliance" - Activate the plugin through the Plugins screen
- Navigate to CRA Compliance in the WordPress admin sidebar
- Click Run Scan to perform your first compliance scan
Full FAQ and changelog are on the WordPress.org plugin page.
Runs entirely in your browser, no server or account needed.
composer install
composer lint # phpcs
composer lint-fix # phpcbf- WordPress.org Plugins API (
api.wordpress.org/plugins/info/) — queried during every scan to retrieve plugin metadata (last updated, tested WP version, PHP requirements). Only plugin slugs are sent, no user data. Responses are cached for 12 hours via WordPress transients. - Patchstack Vulnerability Database (optional, off by default) — if you enter your own Patchstack API key in Settings, the plugin checks installed plugin slugs/versions against known CVEs. Nothing is sent unless you configure this yourself.
See the WordPress.org privacy policy and Patchstack's privacy policy.
Issues and pull requests are welcome — see CONTRIBUTING.md. This repository mirrors the plugin shipped on WordPress.org; releases are cut from the Stable tag in readme.txt.
If you find a security issue, please open an issue or contact the author directly rather than disclosing it publicly — see SECURITY.md.
This plugin provides automated analysis and document templates to help assess and document compliance posture. It does not guarantee regulatory compliance and is not legal advice. All assessments and generated documents should be reviewed by a qualified legal or compliance professional before regulatory use.
GPL-2.0-or-later — see LICENSE.