Daily security scan
Checks six configuration items every 24 hours and scores the result out of 100, so drift gets caught before it becomes a problem.
What it does
Six checks, one score
Daily security scan is a Vectro security feature that checks six WordPress configuration items every 24 hours and reports a score out of 100, so configuration drift is caught close to when it happens.
Once every 24 hours Vectro runs a scan against six configuration items and gives you a score out of 100. It checks the permissions on wp-config.php, whether WP_DEBUG is switched on, whether an account named “admin” exists, whether SSL is active, whether your database table prefix is still the default, and whether the file editor is disabled.
The score and a list of any issues found appear at the top of Vectro > Security, and the score also shows on the Vectro dashboard, so you can see what needs fixing rather than only that the number changed.
This is a configuration audit, not a malware scanner. It tells you whether your site is set up sensibly. It does not inspect file contents for malicious code.
Why it matters
Configuration drifts, quietly
Sites are rarely misconfigured on day one. WP_DEBUG gets switched on to chase a bug and never switched off, leaving error output visible to visitors. A migration resets file permissions. An SSL certificate lapses. A developer creates an “admin” account for convenience during a handover. Each of these is small, none of them announces itself, and all of them make you easier to attack.
A daily check catches drift close to when it happens. A single score makes it obvious at a glance whether anything moved, and the list of issues tells you what to fix rather than leaving you to hunt.
How to use it
Enable it and read the first result
Technical detail
What each check looks at
The scan is scheduled with WP-Cron, which is triggered by site traffic rather than a real system timer. On a very low traffic site, a scan can therefore run later than exactly 24 hours. If you need precise timing, disable WP-Cron and drive wp-cron.php from a real server cron job.
Each check is a direct inspection: file permissions are read from the filesystem, constants from the runtime configuration, and the table prefix from the database configuration.
WP_DEBUG statusCompatibility
Vectro detects these and steps aside
You can override any automatic deferral from the Compatibility panel in Vectro’s dashboard if you would rather Vectro handle it.
Questions
Frequently asked
What does the Vectro daily security scan check?
The scan checks six items every 24 hours: wp-config.php permissions, WP_DEBUG status, whether a default admin username exists, whether SSL is active, whether the database table prefix is still default, and whether the file editor is disabled. It reports a score out of 100 and lists every issue it finds.
Does the Vectro security scan work with Really Simple SSL?
Yes – if Really Simple SSL is active, Vectro skips its own SSL check and defers to it. All five other checks still run and are included in your score.
How do I run a security scan in Vectro?
Go to Vectro > Security in wp-admin and toggle Daily Security Scan on. The first scan runs shortly afterwards and the result appears at the top of Vectro > Security. Click Run Scan Now to rescan at any time.
Is the Vectro daily security scan free or Pro?
Yes, The Vectro daily security scan is free. It is included in the free Vectro plugin on WordPress.org with no account required.
Is the Vectro security scan a malware scanner?
No – it is a configuration audit that checks how your site is set up, not a malware scanner. It does not inspect file contents for malicious code, so pair it with a dedicated malware scanner if you need that.
Related features
Fix what the scan flags
Vectro Pro adds file change monitoring and a malware scanner for continuous file-level protection. See Pro plans
Download Vectro free on WordPress.org
27 features across Security, Performance and Maintenance. No account required, no expiry, unlimited sites.