AI scan reports, plain-English explanation for every finding.
Plain-English reports that explain what each flagged piece of code does, why it is risky, and the exact step to fix it. No CVSS decoding required.
Availability: included from Pro upwards, via the Premium add-on · Plain-English AI explanations on every finding
Security score
- FirewallProtected
- Backdoor detectionClean
- Malware scanClean
- Audit logMonitored
- Login securityProtected
- Vulnerability scanClean
The plugin view: findings, severity and next steps inside the WordPress admin
AI Reports at a glance
Threat summary
One-line plain-English description: "Obfuscated PHP backdoor that grants remote code execution when a specific cookie is present."
Severity level
Critical · High · Medium · Low · Info. Calibrated to threat type, exploitability and reachability; a backdoor in mu-plugins/ is Critical regardless of what it does.
Technical details
File path, line numbers, the exact code snippet that triggered the finding, the hash of the file, and the version of the host plugin/theme if applicable.
A file path and a severity score are not an explanation
Most scanner output is written for somebody who already knows what it means. A path, a rule name, a number between one and ten. To an experienced developer that is enough. To the person who actually runs most WordPress sites it is a sentence in a language they do not speak, attached to something frightening.
The consequence is predictable and expensive. Findings get ignored because they cannot be assessed, or acted on far too aggressively: a legitimate file deleted, a plugin removed, a site broken in the course of fixing a problem that may not have existed.
Neither outcome is a detection failure. The scanner was right. It simply did not communicate in a way that let anybody make a good decision.
What it does, why it was flagged, what to do
Each finding on Pro is explained in plain language: what the code actually does, why it was flagged, what an attacker would use it for, and what your options are.
That last part is the one that changes behaviour. Knowing a file contains an obfuscated remote shell tells you it is bad. Knowing whether to quarantine it, remove it, or check the hosting account first is what turns knowledge into a resolved incident, and it is the part that is usually missing.
The explanation also makes disagreement possible, which matters more than it sounds. A finding that shows its reasoning can be evaluated and rejected. A finding that shows only a score can only be believed or ignored, and most people ignore it.
For clients, for insurers, and for the conversation afterwards
Explanations also make reports worth sending. On Agency, white-label client reports carry your branding and are written for a non-technical reader, which is the difference between security being an invisible cost you absorb and a service you can show and charge for.
That is the honest commercial reason agencies ask about reports before they ask about detection. Retainers get cut when the client cannot see what they pay for, and a monthly summary of what was scanned, found, blocked and fixed makes the line item defensible.
The same document does work after an incident, when a client, an insurer or a payment processor wants to know what happened and what was done. A written record beats a recollection, and it is much easier to produce one when the findings were legible in the first place.
Common questions
Works with
AI Detection →
Catches what has never been catalogued.
Notifications →
Alerts that matter, digests for the rest.
Audit Log →
Who did what, and when.
See it on your own site
The free scan takes under five minutes and tells you the truth.