Sucuri Security Plugin NONCE Value

I didn’t understand your question. Can you clarify? You want to use sitecheck on your own plugin?

Hi look i made a plugin that launch other plugin to do a scan on my wordpress website

To check if there is a vulnerabilities…

User only will click on start button

My plugin will send form and start scan before

A window will popup with sucuri scan results

I will add picture later on of my plugin

here is an image of my plugin

https://hpics.li/045c8e7

We do not use a custom function to generate the nonce, we use the WordPress built-in function “wp_create_nonce” [1] as you can see here [2] we use this to generate a semi-unique random string that changes with certain interval and depending on the user session.

Providing a method to retrieve that value to use it outside the scope of the Sucuri Scanner opens a security hole because malicious people could use that method to execute a CSRF attack [3]. If you are interested to execute a scan using our plugin I suggest you to follow a different approach or make your plugin communicate with SiteCheck [4] which is the API service we use for one of the six scanners implemented in the code.

[1] https://codex.www.ads-software.com/Function_Reference/wp_create_nonce
[2] https://github.com/Sucuri/sucuri-wordpress-plugin/blob/master/sucuri.php#L6649
[3] https://en.wikipedia.org/wiki/Cross-site_request_forgery
[4] https://github.com/Sucuri/sucuri-wordpress-plugin/blob/master/sucuri.php#L6037-L6045

ya i figure that on WP websites i thought that too CSRF measures..i did revise your plugins code almost all files … i will search more how to make my plugin send request ..start scan ?? thanks again guys good luck