Jetpack Acquires WordPress Security Company

By Taylor Davis On Nov 5, 2021

Jetpack, a division of the commercial arm of WordPress, Automattic, announced that it is acquiring the popular WPScan WordPress security suite company. WPScan provides resources that enable the WordPress and WordPress security ecosystem to fight back against security issues quickly. Jetpack is a suite of WordPress tools that also includes a security component.

WordPress security is an important area for WordPress because it’s what competitors cite as a weakness in WordPress. So on that level it makes sense for Jetpack to acquire a company with a proactive stance on WordPress security.

Jetpack promised to keep the products free for non-commercial use while also noting that some of WPScan will be absorbed into the security offering within the Jetpack suite of tools.

Continue Reading Below

Why WPScan is Important

WPScan is a database of vulnerabilities.

WPScan also provides:

An API for accessing the database
WPScan Security Scanner, a Command Line Interface (CLI) scanner
A WordPress security plugin

WPScan Database

WPScan is first and foremost an openly available database that records WordPress vulnerabilities and makes the information available via an API.

The information about WordPress vulnerabilities is hand curated by WPScan and contributors.

WPScan is also an official CVE Numbering Authority (CNA), which means they can assign the numbers that vulnerabilities are referenced by in the security community.

WPScan WordPress Plugin

Lastly, WPScan offers a free plugin that scans a website to determine if the WordPress installation itself and/or installed themes and plugins have vulnerabilities. The plugin uses the WPScan database API to check for vulnerabilities. The daily scan is said to fall within the free tier of API usage.

The plugin also scans for common weaknesses that could make a website vulnerable:

“Check for debug.log files
Check for wp-config.php backup files
Check if XML-RPC is enabled
Check for code repository files
Check if default secret keys are used
Check for exported database files
Weak passwords
HTTPS enabled”

Continue Reading Below

Jetpack announced:

“…our goal for this acquisition is to make malware data and APIs more open source. We want to ensure that WPScan continues to be a high-quality security resource for the entire WordPress community. To that effect, we’ll be exploring ways to make the API completely free for non-commercial sites.

…WPScan will continue to operate independently in the near term and may be integrated into Jetpack Scan in the future.

Current WPScan customers won’t be impacted by the acquisition in the near-term and will receive the same high-quality WordPress security service they’ve come to expect.”

Jetpack Acquires WordPress Security Company

Why WPScan is Important

WPScan also provides:

WPScan Database

WPScan WordPress Security Scanner

WPScan WordPress Plugin

Why Did Jetpack acquire WPScan?

Jetpack announced:

Citations

Read the Jetpack Announcement of the WPScan Acquisition:

Visit the Official WPScan Plugin Page