DebugTeam checks public WordPress evidence, known security advisories and the availability of your registered websites. Find your results by choosing Sign in under My websites.
Components and version evidence
Generator metadata, comments and resource paths in public HTML may indicate WordPress, plugins or themes. A resource path does not automatically prove the installed version. An arbitrary version parameter is therefore not treated as a confirmed product version. Evidence locations, version evidence and remaining uncertainty stay visible.
Match CVE advisories
Our own CVE catalogue contains NVD/CVE advisories explicitly mapped to WordPress Core, plugins or themes. Detectable components are compared using these product mappings and comparable version evidence. Unmapped components remain unassessed. The public CVE catalogue lists original sources, affected version ranges and available information on fixes, the CVE ID and CVSS.
- Version-based match: The detected version is within an advisory's affected range. Exploitability has not been tested.
- Possibly affected: The component is detectable, but its version is unknown, contradictory or not reliably comparable.
- No unresolved matches: The available data contains no unresolved match for the mapped, comparable observations. This is not a declaration that the website is secure.
You can assess a detection and add your own version declaration. Your details remain separate from the scan finding and are available for the operator to review. They neither overwrite the public observation nor automatically change product mappings or CVE results.
Availability and TLS
Regular checks at varying times, roughly once daily, record the HTTP(S) response and, for HTTPS, the certificate status. A suspected outage triggers another check. Confirmed outages, recovery and certificate problems may trigger notices. An expiry date that cannot be determined remains marked as such.
Brief outages between checks may go unnoticed. A blocked request such as HTTP 403 is not evidence that the website is down for all visitors.
Check again before alerts
Before a CVE alert, the crawler checks the website's current state again. If an update detected in the meantime shows that the original version evidence is no longer affected, the obsolete alert is dropped. A failed request or disappearing version evidence does not prove a fix.
Less email with the weekly digest
During registration or under Notifications in Manage you choose individual notices or a weekly summary. The digest groups less severe and unconfirmed vulnerability notices for your websites. High and critical version-based matches continue to be reported without waiting for the summary. Availability and TLS notices, and webhooks, remain unbatched.
Setup and limitations
Register a DebugTeam account with your email address and password, and verify your email. No customer plugin, host agent or WordPress administrator account is required. Hidden components may remain undetected. DebugTeam does not perform automatic updates, exploitation attempts or penetration tests.
Add website to monitoring · Secure your account with an authenticator app
Your software inventory
You can also record applications, server services and operating systems with their versions in your private Software inventory . We use our broader NVD/CVE data for this. Mapping is based on the selected vendor and product; unclear version ranges remain marked as possible exposure. Your declarations do not become website scan evidence and do not change externally observed check results.
You can optionally receive targeted, reviewed notices from our own security research. This is a separate, optional choice.