by Dragon Core 0 (0 reviews)

Dragon Compliance – CRA & NIS2 Compliance, SBOM Export & Vulnerability Scanner

Name: Dragon Compliance – CRA & NIS2 Compliance, SBOM Export & Vulnerability Scanner
Author: Dragon Core

CRA and NIS2 compliance for WordPress: software inventory, SBOM export, vulnerability scanning, readiness checklist and a timestamped evidence log.

Dragon Compliance ranks #61,660 among WordPress.org plugins with 0+ active installations, is #3,855 of 5,058 in the Security category, and was last updated Oct 10, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v1.1.0 Current Version v1.1.0

Updated 4 weeks ago Last Update on 10 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#3,855 of 5,058 in Security Actively maintained

View on WordPress.org

Rank

#61,660

— No change

Active Installs

-100%

KW Avg Position

— No change

Downloads

519

+1 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 10

Total Progress 20%

0+ 10+

34,092

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 8 more installs to reach 10+

Rank Changes

Current #61,660

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.1.0
Last Updated: Oct 10, 2026
Requires WP: 6.2+
Tested Up To: 7.1.4
PHP Version: 8.0 or higher
Author: Dragon Core

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

compliance nis2 sbom security vulnerability scanner

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about Dragon Compliance – CRA & NIS2 Compliance, SBOM Export & Vulnerability Scanner

Not necessarily. The CRA covers products with digital elements placed on the EU market, and NIS2 covers organisations in certain sectors above certain sizes; many websites fall under neither. Whether either applies to your business is a legal question. This plugin gives you the technical evidence base either way - it is not legal advice.

By default from WPVulnerability, a free public database, without an account. The plugin sends it the slugs of your installed plugins and themes and your WordPress version, and compares the answers with your installed versions on your server. You can switch to the Wordfence Intelligence Community Edition feed with your own free token, in which case the whole feed is downloaded and nothing about your site is sent.

That component is listed as "not checked" on the Dashboard, Findings and Inventory tabs and in the evidence log, and its open findings stay open. It is never reported as free of vulnerabilities. The next scan tries again. A plugin or theme whose folder name cannot be a WordPress.org slug (for example one with a space, a plus sign or brackets in it), one WPVulnerability

in the plugins folder) are not failures: they are shown as "Checked - not in the database". A pre-release of WordPress (a beta or release candidate) is checked against the release it leads up to.

New critical findings, and new findings whose severity the data source has not published yet. The email lists the critical ones first, then the others, each marked "severity not published - review it". Findings of high, medium or low severity are shown on the Findings tab but not emailed.

Only open findings with a published critical severity. A finding whose severity has not been published does not make the check fail, so review those on the Findings tab. The check also fails while any component could not be checked.

At the next scan, findings from the old source get the status "Closed: data source changed", never "Resolved", and the new source's findings are recorded. An issue both sources report (same component and CVE) is not alerted again, and stays ignored if you had ignored it. The switch is recorded in the evidence log. A site updated from an earlier version that had vulnerability data but no saved Wordfence token moves to WPVulnerability, and that switch

The site admin email by default. Under Settings you can enter several addresses, one per line or separated by commas; each gets its own email.

CycloneDX 1.6 JSON.

A Software Bill of Materials lists every software component you run, with versions and licenses - like an ingredients label for your site. Auditors, enterprise customers and EU regulation increasingly ask for one. This plugin exports yours in the standard CycloneDX format in one click.