Security Guard

Developer Tools

A read-only malware scan for WordPress that finds ClickFix and EtherHiding loaders, web shells and new admins, on your own server.

by Mugees Ahmed

👏0claps. Sign in to clap.sign in to clap

Security Guard is a WordPress security plugin for the kind of infection that no longer sits in a file you can spot by name. It is a few lines of script injected into a page, a post, an option or a must-use plugin. Often only visitors see it. We wrote it after that kind of infection hit a production WordPress site. The scan is read-only. It checks plugin, theme and must-use code, the uploads folder (PHP hidden in images included), the database, administrator accounts and core files. It works in short steps, one request at a time, so it doesn't hit a time limit on slow hosting. What it looks for and what it does: - Blockchain loaders (EtherHiding), fake "Verify you are human" boxes (ClickFix), web shells and obfuscated loaders. - A baseline you save on a clean site, so later scans flag any added or changed code file, new must-use plugin or new administrator, even when nothing matches a known pattern. - Remove injected scripts takes known loader scripts out of your pages before they reach the visitor and logs each removal. - A Content-Security-Policy that starts in Report only mode, then moves to Enforce once the log is clean, so an injected loader can't reach a blockchain endpoint. - Six hardening switches, all on by default, among them no PHP in uploads, no theme and plugin file editor and hidden user names. What it won't do: it never deletes or edits a file it flags. It sends no site files anywhere, and findings stay in a private, randomly named folder on your server. On a test site we planted an EtherHiding-style loader and a ClickFix clipboard script. Both came out of the page with Remove injected scripts on. Each left a High line in the event log, and the theme's own scripts stayed. Pricing: $49 a year for one site, $89 for five and $149 for unlimited sites, with a 14-day money-back guarantee.

// launched on CLAPSTORM — a free Product Hunt alternative with a level weekly round · Developer Tools