Troubleshooting
Troubleshooting The issues that come up most, with the fix for each. If yours isn’t here, email [email protected] with what you tried and what you saw. License won’t activate Copy the whole key including dashes. If you see Could not reach license server, the host is blocking outbound HTTPS — confirm it can reach mmplugs.com […]
Activate your license
Activate your MM CRA Toolkit license Pro features — multi-plugin support, the Plugin Scanner, OSV.dev monitoring, and Compliance Bundle export — unlock with a license key. The free tier needs no license. After purchase You’ll get an email with your license key, a link to the plugin zip, and a link to set a password […]
Getting started
Getting started with MM CRA Toolkit Three steps take you from a fresh install to a complete CRA technical file for your first plugin: install, run the Setup Wizard, then generate your artifacts. What the toolkit does The EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to any product with digital elements placed on the […]
Enable weekly vulnerability monitoring
Enable weekly vulnerability monitoring CRA Article 14 requires manufacturers to monitor their products for new vulnerabilities post-release, not just at release time. The toolkit's Monitor automates this with a weekly OSV.dev check across every plugin you have a saved SBOM for. Enable Go to CRA Toolkit → Settings → Monitor. Toggle Enable weekly monitoring. Enter […]
Changelog
Changelog MMCRA Toolkit (free) 1.1.0 — Parity release The free tier now covers the full set of CRA artifacts a WordPress product author needs. Compliance Checklist — article-mapped, five-category checklist with live status from the toolkit’s own signals. Auto items resolve themselves; manual items are yours to confirm. Drives the Compliance Score. security.txt — served […]
License watermarking explained
License watermarking explained Every artifact MM CRA Toolkit generates (SBOM, DoC HTML, Compliance Bundle) is embedded with a 16-character fingerprint derived from your license key and site domain. This is an anti-piracy measure that makes leaked artifacts traceable back to the buyer they came from. What the fingerprint is A 16-character hexadecimal string. Specifically: substr( […]
Updates and Ed25519 signature verification
Updates and Ed25519 signature verification MM CRA Toolkit updates come from mmplugs.com over the standard WordPress update channel. Every package is cryptographically signed with Ed25519 and verified by the toolkit against a bundled public key before WordPress installs it. How it works A daily cron event (mmcra_daily_update_check) calls the mmplugs.com /update endpoint with your license […]
Audit log
Audit log Every artifact the toolkit produces and every significant event it observes is recorded to a tamper-evident audit log. This is your CRA Article 31 record-keeping evidence — proof you generated what you generated, when you generated it. Where it lives A custom WordPress database table: wp_mmcra_audit_log (the prefix matches your install). One row […]
Export a Compliance Bundle
Export a Compliance Bundle The Compliance Bundle is the single ZIP you hand to a regulator under CRA Article 31 or to an EU customer asking for your "technical file." Everything the toolkit has generated for the plugin in one archive, with a README manifest naming every file. Build a bundle Two ways: Per plugin […]
MM CRA Toolkit documentation
MM CRA Toolkit documentation Everything you need to use MM CRA Toolkit on your WordPress site. Each topic below is one focused article — install, configure, generate, monitor, and export your CRA technical file. Getting started Install MM CRA Toolkit Activate your license Run the Setup Wizard Core features Generate a CycloneDX SBOM Run the […]