Proofwright
EU Cyber Resilience Act toolkit: component inventory, SPDX & CycloneDX SBOM, hash-chained snapshots, a posture score, and a CRA document generator.
Use with caution
Proofwright works, but test it on a staging site before relying on it in 2026. Was last updated 2 months ago, and scores 55/100 on our health check.
- Small user base (<10 active installs)
- Very few reviews so far
- Needs PHP 8.1 or newer
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Proofwright stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| compliance | >100 |
| cra | #6 |
| cyber resilience act | #7 |
| sbom | #5 |
| security | >100 |
About Proofwright
From the official readme · v0.23.12Description
Proofwright is the on-site agent for the EU Cyber Resilience Act (CRA). It builds the provable evidence behind a CRA due-diligence posture — and the foundation is free: a rigorous Software Bill of Materials, a deterministic readiness score, and the CRA paperwork.
Inventory & SBOM. Inventories every component — core, plugins, must-use plugins, drop-ins, themes (and parents), the PHP runtime, and Composer dependencies (direct vs transitive) — and emits a machine-readable Software Bill of Materials in both SPDX 2.3 and CycloneDX 1.5, with package URLs (PURLs).
Immutable, hash-chained snapshots. Each SBOM is stored as a dated, tamper-evident snapshot with diff-over-time, so you can prove how your component graph changed.
CRA readiness, in your dashboard. A deterministic posture score; an on-site readiness engine mapped to CRA Annex I (no external calls — no data leaves your server); a scope-classification wizard; a CRA document generator (Vulnerability Disclosure Policy, EU Declaration of Conformity, risk assessment, technical-documentation outline); a consolidated compliance calendar with iCal export; a cross-framework crosswalk (ISO/IEC 27001, SOC 2, NIS2); and a /.well-known/security.txt + Vulnerability Disclosure Policy publisher.
Tamper-evident evidence log. An append-only, cryptographically verifiable log of the material actions taken on your site.
Not legal advice. A “not legal advice” disclaimer appears on every generated document and report.
Related plugin
This plugin is complete and fully functional on its own. Some further capabilities — continuous vulnerability monitoring, the SRP incident workflow, the supplier-conformity register, exportable evidence packs, a cross-site fleet console and team review — are provided by a separate plugin, Proofwright Pro, available from proofwright.eu. They are not part of, and not required by, the plugin in this directory.
Disclaimer
Proofwright is a workflow and evidence tool, not legal advice and not a guarantee of compliance. It helps you build and maintain the documentation and evidence that support a Cyber Resilience Act due-diligence posture; it does not make any product or site compliant. Consult qualified counsel for your obligations under Regulation (EU) 2024/2847.
Frequently asked questions
Does this make my site CRA-compliant?
No. Proofwright provides the workflow and the provable evidence; compliance is your legal responsibility. The “not legal advice” disclaimer appears on every generated document and report.
What does this plugin include?
Everything it needs to be useful on its own: component inventory, the SPDX 2.3 / CycloneDX 1.5 SBOM, immutable hash-chained snapshots with diff, the posture score and on-site readiness engine, the scope wizard, the CRA document generator, the compliance calendar, the cross-framework crosswalk, the security.txt / VDP publisher, and the tamper-evident evidence log — all fully functional, with no restrictions. Continuous vulnerability monitoring, the SRP incident workflow, the supplier register, exportable evidence packs and a cross-site fleet console are provided by a separate plugin…
Does the plugin send my data anywhere?
No. This plugin runs entirely on your server — the readiness engine and SBOM make no external calls, and there is no licence check or phone-home of any kind.
Changelog
0.23.12
- Fixed the software inventory listing build tools (npm dev dependencies) as if they were part of your site. Re-scan after updating.
0.23.11
- Fixed a fatal error when exporting CRA documents. Now translated into all 23 EU languages plus Arabic.
0.23.10
- Now available in 14 European languages. Bundled translations are loaded correctly.
0.23.9
- Added the full GPL-2.0 licence text to the package; removed an unused generated file.
0.23.8
- The posture-score breakdown, the SBOM change-since-last-snapshot view, and the attestation-renewal check now run on every install with no restrictions. Served pages load their stylesheet via the WordPress style API.
0.23.7
- Minor packaging fix.
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Proofwright alternatives
All compliance plugins →
FAQ
Proofwright: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 10, 2026
Is Proofwright free?
Yes. Proofwright is free to download and use from the official WordPress.org plugin directory.
Is Proofwright safe to use in 2026?
Proofwright works, but test it on a staging site before relying on it in 2026. Was last updated 2 months ago, and scores 55/100 on our health check.
How many websites use Proofwright?
Proofwright is active on <10 WordPress websites and has been downloaded 268 times since it launched in August 2026. It was downloaded 69 times in the last 30 days.
Does Proofwright work with WordPress 7.1?
Proofwright is officially tested up to WordPress 7.0.7, while the latest release is 7.1.3. It may still work, but try it on a staging site first.
What PHP version does Proofwright need?
Proofwright requires PHP 8.1 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Proofwright last updated?
The latest version, 0.23.12, was released on August 6, 2026 (2 months ago).
Who makes Proofwright?
Proofwright is developed and maintained by 1click2open.
What are the best alternatives to Proofwright?
The most popular alternatives to Proofwright are Cookie Compliance for WordP… (800K+ installs), WP Consent API (200K+ installs) and Cookiez (40K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
