Description
Proofwright is the on-site agent for the EU Cyber Resilience Act (CRA). It builds the provable evidence behind a CRA due-diligence posture — and the foundation is free: a rigorous Software Bill of Materials, a deterministic readiness score, and the CRA paperwork.
Inventory & SBOM. Inventories every component — core, plugins, must-use plugins, drop-ins, themes (and parents), the PHP runtime, and Composer dependencies (direct vs transitive) — and emits a machine-readable Software Bill of Materials in both SPDX 2.3 and CycloneDX 1.5, with package URLs (PURLs).
Immutable, hash-chained snapshots. Each SBOM is stored as a dated, tamper-evident snapshot with diff-over-time, so you can prove how your component graph changed.
CRA readiness, in your dashboard. A deterministic posture score; an on-site readiness engine mapped to CRA Annex I (no external calls — no data leaves your server); a scope-classification wizard; a CRA document generator (Vulnerability Disclosure Policy, EU Declaration of Conformity, risk assessment, technical-documentation outline); a consolidated compliance calendar with iCal export; a cross-framework crosswalk (ISO/IEC 27001, SOC 2, NIS2); and a /.well-known/security.txt + Vulnerability Disclosure Policy publisher.
Tamper-evident evidence log. An append-only, cryptographically verifiable log of the material actions taken on your site.
Not legal advice. A « not legal advice » disclaimer appears on every generated document and report.
Related plugin
This plugin is complete and fully functional on its own. Some further capabilities — continuous vulnerability monitoring, the SRP incident workflow, the supplier-conformity register, exportable evidence packs, a cross-site fleet console and team review — are provided by a separate plugin, Proofwright Pro, available from proofwright.eu. They are not part of, and not required by, the plugin in this directory.
Disclaimer
Proofwright is a workflow and evidence tool, not legal advice and not a guarantee of compliance. It helps you build and maintain the documentation and evidence that support a Cyber Resilience Act due-diligence posture; it does not make any product or site compliant. Consult qualified counsel for your obligations under Regulation (EU) 2024/2847.
Captures d’écrans
FAQ
Does this make my site CRA-compliant?
No. Proofwright provides the workflow and the provable evidence; compliance is your legal responsibility. The « not legal advice » disclaimer appears on every generated document and report.
What does this plugin include?
Everything it needs to be useful on its own: component inventory, the SPDX 2.3 / CycloneDX 1.5 SBOM, immutable hash-chained snapshots with diff, the posture score and on-site readiness engine, the scope wizard, the CRA document generator, the compliance calendar, the cross-framework crosswalk, the security.txt / VDP publisher, and the tamper-evident evidence log — all fully functional, with no restrictions. Continuous vulnerability monitoring, the SRP incident workflow, the supplier register, exportable evidence packs and a cross-site fleet console are provided by a separate plugin, Proofwright Pro (see « Related plugin »).
Does the plugin send my data anywhere?
No. This plugin runs entirely on your server — the readiness engine and SBOM make no external calls, and there is no licence check or phone-home of any kind.
Avis
Il n’y a aucun avis pour cette extension.
Contributeurs/contributrices & développeurs/développeuses
« Proofwright » est un logiciel libre. Les personnes suivantes ont contribué à cette extension.
Contributeurs
Traduisez « Proofwright » dans votre langue.
Le développement vous intéresse ?
Parcourir le code, consulter le SVN dépôt, ou s’inscrire au journal de développement par RSS.
Journal des modifications
0.23.12
- Fixed the software inventory listing build tools (npm dev dependencies) as if they were part of your site. Re-scan after updating.
0.23.11
- Fixed a fatal error when exporting CRA documents. Now translated into all 23 EU languages plus Arabic.
0.23.10
- Now available in 14 European languages. Bundled translations are loaded correctly.
0.23.9
- Added the full GPL-2.0 licence text to the package; removed an unused generated file.
0.23.8
- The posture-score breakdown, the SBOM change-since-last-snapshot view, and the attestation-renewal check now run on every install with no restrictions. Served pages load their stylesheet via the WordPress style API.
0.23.7
- Minor packaging fix.
0.23.6
- Housekeeping: removed unused image files from the package.
0.23.5
- Pages the plugin serves now link a packaged stylesheet instead of embedding CSS; documents you download keep their styles inline so the saved file works on its own.
0.23.4
- The plugin is fully functional with no restrictions of any kind: all feature gating removed, no licence checks, and the plugin no longer defines global WordPress constants. Further capabilities are provided by a separate plugin.
0.23.3
- Packaging refresh for the plugin directory; no functional changes since 0.23.2.
0.23.2
- Every feature in the plugin is fully functional, with no restrictions of any kind.
0.23.0
- CRA readiness roadmap, a compliance calendar with iCal export, a cross-framework control crosswalk (ISO/IEC 27001, SOC 2, NIS2), and the on-site readiness engine mapped to CRA Annex I.
0.20.0
- Annex II « Information and Instructions to the User » document generator; front-end (npm/yarn) dependency scanning folded into the SBOM.
0.13.0
- Readiness engine: deterministic, on-site security-posture detection mapped to CRA Annex I (no external calls). Detected controls are shown as evidence; gaps are shown with copy-paste remediation guidance.
0.9.0
- Inventory + SBOM (SPDX 2.3 / CycloneDX 1.5) with PURLs and direct/transitive depth; immutable, hash-chained SBOM snapshots with diff-over-time and EOL flagging; deterministic posture score; scope wizard; CRA document generator; tamper-evident evidence log. Pre-flight secret + PII scan on every export.
0.1.0
- Initial release: SBOM spine + compliance posture score.