Sources and licences
Last changed 15 October 2026.
Last changed 15 October 2026.
Outpost combines what it sees from outside a site with data from the sources below. None of them is told anything about Outpost’s customers beyond what each section says.
Known vulnerabilities in WordPress, its plugins and its themes come from the Wordfence Intelligence vulnerability database, downloaded whole once a day. Wordfence is not told which sites Outpost watches. Each vulnerability Outpost shows links to its record at Wordfence.
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
Wordfence Intelligence Terms and Conditions
Where a vulnerability has a CVE identifier, its record contains material from the CVE list, maintained by The MITRE Corporation.
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Whether a vulnerability is being used in attacks comes from the Known Exploited Vulnerabilities catalog of the US Cybersecurity and Infrastructure Security Agency, downloaded whole once a day. It is published under the Creative Commons Zero licence. Its use here does not mean CISA endorses Outpost.
When a release of PHP, nginx or Apache stops getting security fixes comes from endoflife.date, downloaded once a day. It is told nothing about the sites Outpost watches.
Copyright 2020 endoflife.date contributors.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Known vulnerabilities in JavaScript libraries, and the patterns that recognise a library’s version in a file’s address, come from the Retire.js repository, downloaded once a day. Outpost keeps only the address patterns and the advisories, and never fetches a script to look inside it. The repository is licensed under the Apache License, Version 2.0, and is provided on an “as is” basis, without warranties or conditions of any kind.
Whether Google lists a site as dangerous comes from Google’s Web Risk API. Google is asked about the site’s public addresses, and nothing else.
Current WordPress and plugin versions come from the WordPress.org API, and which network a site’s address belongs to from Team Cymru’s IP-to-ASN service.