Vulnerability Checker Policy Ability

Use mainwp/get-vulnerability-policy-v1 to read the Vulnerability Checker policy for your Dashboard. It reads saved settings without scanning sites, contacting a provider, or changing settings.

Access

Activate Vulnerability Checker on a Dashboard with WordPress Abilities API support. Your authenticated user must pass the Dashboard Abilities API permission check and have both access to the extension and its view_vulnerabilities right. Team Control users with that view right can read this policy when their site access is restricted. The response contains no site findings. Users without the view right cannot run the ability. Use an Application Password over HTTPS, or an authenticated WordPress session with a REST nonce. See Abilities API authentication.

Read the Policy

The ability accepts no parameters. Extra input fields are rejected.

curl -u 'USERNAME:APPLICATION_PASSWORD' \
  'https://your-dashboard.example/wp-json/wp-abilities/v1/abilities/mainwp/get-vulnerability-policy-v1/run'

Example response:

{
  "credential_configured": false,
  "job_state": "unavailable",
  "notification_enabled": false,
  "provider": "wpvulndb",
  "scan_on_sync": false,
  "schedule": "disabled",
  "policy_generation": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
}

Field	Meaning
`provider`	Saved provider: `wpvulndb`, `nvd_nist`, or `wordfence`.
`credential_configured`	Whether a WPVulnerability credential is stored. Other providers return `true` because this policy does not require that credential for them. This does not test a credential with a provider.
`schedule`	Saved schedule: `daily`, `weekly`, `monthly`, or `disabled`.
`scan_on_sync`	Whether scanning on sync is enabled in the saved settings.
`notification_enabled`	Whether notifications are enabled in the saved settings. This does not confirm delivery.
`job_state`	`unavailable` while the typed observation and job infrastructure is absent. This ability does not create that infrastructure.
`policy_generation`	An opaque HMAC of the non-secret policy, bound to your installation. It changes when the returned policy changes.

This response is policy information, not a scan result or a claim that your sites are free of vulnerabilities. Credentials, API tokens, and notification recipients are never returned.

Discover the Schema

curl -u 'USERNAME:APPLICATION_PASSWORD' \
  'https://your-dashboard.example/wp-json/wp-abilities/v1/abilities/mainwp/get-vulnerability-policy-v1'

The category is mainwp-vulnerability-checker. Both schemas reject extra fields. The ability is read-only and idempotent.

Errors

Anonymous execution returns HTTP 401. An authenticated caller without the required access receives 403. Invalid input receives 400. If Dashboard authorization, the saved provider, or the existing installation binding is unavailable, the ability returns an error rather than a policy result.

Getting Started

Understanding MainWP

Dashboard

Sites

Backups

Users

Updates

Plugins

Themes

Content Operations

Clients

MCP Server

API Reference

Troubleshooting

Customization

Advanced

Resources

Vulnerability Checker Policy Ability

Access

Read the Policy

Discover the Schema

Errors