Full-scale security auditing for WordPress plugins and themes
secure by design
Eliminate hidden security flaws and unsafe coding practices.
first to secure 600 plugins' users
we manage security for 600 plugins
Elementor
WP Bakery
MainWP
Clicky by Yoast
Slider Revolution
Visual Composer
WP Rocket
Elementor
WP Bakery
MainWP
Clicky by Yoast
Slider Revolution
Visual Composer
WP Rocket
Elementor
WP Bakery
MainWP
Clicky by Yoast
Slider Revolution
Visual Composer
WP Rocket
Elementor
WP Bakery
MainWP
Clicky by Yoast
Slider Revolution
Visual Composer
WP Rocket
Elementor
WP Bakery
MainWP
Clicky by Yoast
Slider Revolution
Visual Composer
WP Rocket
Elementor
WP Bakery
MainWP
Clicky by Yoast
Slider Revolution
Visual Composer
WP Rocket
For plugin and theme vendors
Launch secure plugins with confidence, reduce risk of plugin suspensions and build user trust.
For agencies and SLA providers
Secure custom plugin builds and integrations before client hand-offs.
For enterprises and in-house teams
Audit partner-delivered code or internal tools with an audit trail for compliance.
“We highly recommend Patchstack to other companies looking to enhance their security posture. For us, Patchstack is a true partner in our security efforts, and we're more than satisfied with their services.”
Miriam Schwab
Head of WordPress Relations
How to and why request an audit
Proactive security is up to 70% more cost-effective than dealing with consequences (Ponemon Institute).
1
Define the scope
Submit your project and details for a custom tailored quote
2
Manual code-review
Our certified security team is highly specialized in WordPress software
3
Actionable results
Receive a detailed audit with remediation recommendations
4
Patching guidance
Our team provides post-audit support to confirm sufficient fixes
“Working with Patchstack felt like giving our plugin a top-tier security tune-up. They combed through our code for weak spots, offered straightforward guidance with lightning-fast responses, and now it's locked down tighter than my grandma's cookie jar.”
Dirk Gavor
Co-founder of Slider Revolution
What the FAQ?
Yes, we require access to the source code as our audits are not black box based. Having access to the source code allows us to find deeper and more complex vulnerabilities. The source code can be provided to us through email, through an invitation to your repository, a secure transfer link or your own preferred method of transferring files.
It is possible that we are not able to find any vulnerabilities if the source code follows all the code conventions and standards. Keep in mind that the audit is manual labor and is based on a certain amount of hours spent, not based on the number of vulnerabilities we may or may not find.
Although we do not fix vulnerabilities for you, we do provide information on how to patch the vulnerabilities that we have identified and will also assist with the patching process if needed.
As each software is vastly different when it comes to the structure, code complexity, lines of code and number of files, each audit will have a different cost attached to it. Reach out to us for an estimate for an audit of your software.
Patchstack will only disclose that information for publicly available software and after the vulnerabilities have been successfully resolved.
Patchstack will only audit software that belongs to or has been created solely for the request author. Still unsure? Just ask us.
Request a full-scale security audit
Reduce security risks and compliance gaps.
Security disclosure and CRA compliance with Patchstack
In Q4 2024, The Cyber Resilience Act (CRA) introduced obligatory software support and vulnerability disclosure guidelines for all commercial software with users in the European Union.
Patchstack solves this by acting as an expert intermediary and streamlines vulnerability disclosure for plugin and theme developers.
CRA REQUIREMENTS
- Vulnerability Disclosure Policy (VDP) template
- A process to report security vulnerabilities
- Document dependencies and libraries used
- Share data with EU authorities
- Notify users about vulnerability exploits
- Provide security updates (separately) - Patchstack helps with patch validation
