Search notification plugins transmit site URLs to indexing services when content is created, updated, or removed. IndexNow Plugin version 1.0.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65718. The review focused on submission permissions, API key handling, automatic publishing events, URL exclusions, manual requests, submission history, and external communication.
| Name of | IndexNow Plugin |
| Version | 1.0.4 |
| Active installations | 100,000+ |
| Description | Automatically submits changed WordPress URLs to participating IndexNow search engines and provides manual submission, retry, history, and exclusion controls. |
| Security | Successfully tested for: SQL Injection (SQLi) Cross-Site Scripting (XSS) – Stored and Reflected Cross-Site Request Forgery (CSRF) Authentication Vulnerabilities Authentication Bypass Exploits Privilege Escalation Buffer Overflow Denial-of-Service (DoS) vectors Data Leakage Vulnerabilities Insecure Dependency Usage Remote Code Execution (RCE) Risks Unauthorized File Access Insufficient Injection Protection Information Disclosure via Misconfigured Endpoints |
| CleanTalk Certification | Awarded PSC-2026-65718 through the CleanTalk Plugin Security Certification program for version 1.0.4. |
| Additional Information | Review search visibility settings and excluded paths before enabling automatic requests. Inspect recent submissions after content workflow changes and keep the plugin updated for current provider behavior. |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkMake security review part of your plugin development process and give WordPress site owners a clear certification reference.
Key Features
IndexNow Plugin generates and hosts a site API key, then sends content change notifications to the IndexNow endpoint in the background. Administrators can toggle automatic submission, submit an individual URL, retry failures, and download recent submission data. URL paths can be excluded with wildcard patterns. The current directory description also documents checks for noindex markup, X-Robots-Tag headers, and the WordPress search visibility setting.
Security Assurance
The review addressed access to submission settings and actions, key generation and exposure for service verification, and the validation of URLs sent to the external endpoint. Automatic content events, excluded paths, recent submission output, retries, and downloads were included in the certification scope. Indexing decisions remain with the participating search engines.
The plugin has been successfully tested for:
✅ Information Leakage Vulnerabilities
✅ SQL Injection Vulnerabilities
✅ Cross-Site Scripting (XSS) Attacks
✅ Cross-Site Request Forgery (CSRF) Attacks
✅ Authentication and Authentication Bypass Vulnerabilities
✅ Privilege Escalation Vulnerabilities
✅ Buffer Overflow Vulnerabilities
✅ Denial-of-Service (DoS) Vulnerabilities
✅ Data Leakage Vulnerabilities
✅ Insecure Dependencies
✅ Code Execution Vulnerabilities
✅ File Unauthorized Access Vulnerabilities
✅ Insufficient Injection Protection
Conclusion
IndexNow Plugin version 1.0.4 is certified as PSC-2026-65718. The review covers the WordPress controls that manage its key, collect eligible URLs, send notifications, and present submission history. Use the history to confirm expected activity and remember that notifying an indexing service does not guarantee inclusion in search results.
Note: The date and certification information may change over time. It is advisable to verify the latest details on the plugin developer’s website.
