by Patrick Schlesinger 0 (0 reviews)

CMS ADMINS Security Check Report

Name: CMS ADMINS Security Check Report
Author: Patrick Schlesinger

Read-only security audit for WordPress: 60 checks, an A to F grade, and a short list of what to fix first.

CMS ADMINS Security Check Report ranks #13,410 among WordPress.org plugins with 100+ active installations, is #812 of 4,499 in the Security category, and was last updated Sep 9, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v2.3.2 Current Version v2.3.2

Updated 1 week ago Last Update on 09 Sep, 2026

Refreshed 10 hours ago Last Refreshed on

#812 of 4,499 in Security Top 25% by installs Downloads +56.7% this week Actively maintained

View on WordPress.org

Rank

#13,410

+2 this week

Active Installs

100+

-67%

KW Avg Position

59.8

34.2 better

Downloads

495

+3 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 200

Total Progress 91%

100+ 200+

370

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 9 more installs to reach 200+

Rank Changes

Current #13,410

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Security History

Source: WPVulnerability

No known vulnerabilities on record for CMS ADMINS Security Check Report. Checked 22 hours ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.3.2
Last Updated: Sep 09, 2026
Requires WP: 7.0+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: Patrick Schlesinger

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

audit hardening scanner security site health

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,756

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security - Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners and admins who want a read-only security audit of their installation. It runs 60 checks across core files, configuration, file permissions, accounts, and network settings, then produces a graded report with a prioritized fix list.

60 security checks
A to F grading
Priority list of top fixes
Comparison with previous run
Muting for accepted findings
"Not determined" outcome status
Exports to TXT, JSON, CSV
WP-CLI command support

Frequently Asked Questions

Common questions about CMS ADMINS Security Check Report

No. Every check reads state and reports on it. There is one exception, and it is deliberate. To find out whether your server would execute a PHP file dropped into the uploads folder, the plugin has to try. It writes one file with a random name, requests it once over HTTP and deletes it in the same request. A shutdown handler removes the file even if PHP dies in between, and anything left behind by an earlier interrupted run is cleaned up before the next one starts.

Only to api.wordpress.org, and only through the WordPress functions that already talk to it for update checks: https://api.wordpress.org/core/version-check/1.7/ to learn the current WordPress version https://api.wordpress.org/plugins/update-check/1.1/ and https://api.wordpress.org/themes/update-check/1.1/ for pending updates https://api.wordpress.org/plugins/info/1.2/ to see whether a plugin listing is still open and when it was last released https://api.wordpress.org/core/checksums/1.0/ for the official core file hashes WordPress.org privacy policy and terms of service. The remaining requests go to your own site, because several checks can only be answered from the outside: whether a file is served, whether a header is sent, whether a directory is listed. There is no telemetry and no reporting back to the plugin author.

Four options in your database, all removed when you delete the plugin: the last run and the one before it, so the report can show what changed

a baseline recorded on the first run, holding plugin authors, role definitions and the list of must-use plugins and drop-ins, so later runs can spot changes It also records a login timestamp for each account, in user meta, because WordPress keeps no login history of its own and the administrator check would otherwise have nothing to say about dormant accounts. That is deleted on uninstall too.

Neither. It finds configuration weaknesses and exposure, which is what most WordPress sites are actually taken over through. It does not block traffic and it does not clean an infected site. It will notice several things that point at a compromise: core files that differ from the official release, executable files in the uploads folder, must-use plugins or drop-ins that appeared out of nowhere, roles that gained administrator capabilities, injected scripts in the options table. If any of those turn up, treat it as a starting point for an investigation, not as a verdict.

A, excellent: nothing of substance outstanding B, good: minor improvements available C, moderate: several things worth addressing D, poor: significant weaknesses, act soon F, critical: act now

Every check carries an urgency, and the urgency sets how much a finding weighs: Critical, weight 3.0: authentication, code execution, exposed secrets High, weight 2.0: updates, transport security, important configuration Medium, weight 1.5: headers, permissions, policies Low, weight 1.0: fingerprinting and good practice The score is the weighted risk as a percentage of the worst possible outcome. Checks that could not be determined are left out of both sides of that calculation, so a blocked outbound request never moves the grade in either direction. A failing critical check pulls the result down to at least a D, which is what stops one serious problem from being averaged away. A few checks are informational and carry no weight at all.

Because it could not get an answer, usually a blocked outbound request or a file it is not allowed to read. That is deliberately not treated as a finding. An unreachable endpoint says nothing about your site, and reporting it as a problem would teach you to ignore the report.

Mute it. The plugin hides the finding and stores a fingerprint of what it was reporting. As soon as the content changes, for instance one more affected file, it comes back on its own. That is the difference between accepting a known state and going blind to it, and it is why muting is offered instead of a permanent dismissal by default.

Monthly is a reasonable baseline, plus a run after any larger change: a migration, a new plugin, a server move. From the second run onwards the report opens with what changed since the previous one.