# Automated security checks for new plugin releases on WordPress.org

**URL:** <https://forum.wpbay.com/t/automated-security-checks-for-new-plugin-releases-on-wordpress-org/329>\
**Category:** 🧩 WordPress Development\
**Created:** [September 11, 2026, 11:17am UTC](https://forum.wpbay.com/t/automated-security-checks-for-new-plugin-releases-on-wordpress-org/329 "2026-09-11T11:17:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![CodeRevolution](https://forum.wpbay.com/user_avatar/forum.wpbay.com/coderevolution/32/7_2.png) [@CodeRevolution](https://forum.wpbay.com/u/CodeRevolution)\
**Post date:** [September 11, 2026, 11:17am UTC](https://forum.wpbay.com/t/automated-security-checks-for-new-plugin-releases-on-wordpress-org/329/1 "2026-09-11T11:17:19Z")

</div>

[WordPress.org](http://WordPress.org) is adding automated security checks for every plugin release.

During the current 6-hour release cooldown, updates are scanned by several AI models together with Jetpack Scan. If a release gets a high-risk security score, distribution through the [WordPress.org](http://WordPress.org) update API is automatically blocked until the issue is fixed.

This already stopped a compromised plugin update with around 20,000 active installs from reaching users.

Pretty good move in my opinion, especially considering how much damage a compromised plugin update can cause.

This feature will come also to WPBay in the future, in one form or another.

More details:  
[https://make.wordpress.org/plugins/2026/09/09/automated-security-review-for-plugin-releases/](https://make.wordpress.org/plugins/2026/09/09/automated-security-review-for-plugin-releases/)

---

<div class="post-metadata">

**Author:** ![tibi\_diablo](https://forum.wpbay.com/user_avatar/forum.wpbay.com/tibi_diablo/32/48_2.png) [@tibi\_diablo](https://forum.wpbay.com/u/tibi_diablo)\
**Post date:** [September 11, 2026, 1:49pm UTC](https://forum.wpbay.com/t/automated-security-checks-for-new-plugin-releases-on-wordpress-org/329/2 "2026-09-11T13:49:51Z")

</div>

> [@CodeRevolution](#):
>
> Pretty good move in my opinion, especially considering how much damage a compromised plugin update can cause.

Yes this is very good!
