Troubleshooting

The issues that come up most, with the fix for each. If yours isn’t here, email [email protected] with what you tried and what you saw.

License won’t activate

Copy the whole key including dashes. If you see Could not reach license server, the host is blocking outbound HTTPS — confirm it can reach mmplugs.com on port 443. If you’re at your plugin cap, add the plugin to your covered list or upgrade. See Activate your license.

SBOM has zero components

The plugin ships no dependency lockfiles where the generator looked. Confirm composer.lock and/or package-lock.json are present in the plugin folder or the zip you scanned. A plugin that genuinely vendors no third-party code will correctly produce an SBOM describing only the plugin itself.

Zip upload is blocked or times out

Some hosts cap upload size or block zip MIME types. Raise upload_max_filesize and post_max_size, or scan the plugin as an installed plugin instead of an upload. A security plugin that blocks zip uploads to wp-admin will also stop this.

OSV.dev check returns an error

The check needs outbound HTTPS to osv.dev. If it times out, confirm the host allows it and isn’t rate-limiting. Large dependency sets are batched automatically; a partial result usually means one batch timed out — re-run it.

Weekly monitoring runs late or not at all

Monitoring runs on WP-Cron, which fires on site traffic, so a low-traffic site can drift. For punctual runs, define DISABLE_WP_CRON in wp-config.php and trigger wp-cron.php from a real system cron. Check CRA Toolkit → Monitoring for the next and last run.

An update was refused

That’s Ed25519 signature verification doing its job — don’t sideload to force it. Confirm the site can reach mmplugs.com over HTTPS and retry; if it persists, contact support.

A generated artifact returns 403

The toolkit hardens wp-content/uploads/mmcra/ with deny rules and serves artifacts only through its signed admin download handler, so a direct file URL returning 403 is expected — download from the dashboard instead. The directory self-heals its .htaccess on admin load if it goes missing.