How It Operates
Every core, plugin, and theme file is SHA-256 hashed on each scan and diffed against the last
known-good baseline, with core files additionally cross-checked against the official WordPress.org
checksum manifest. In parallel, and completely independent of the hash diff, file content is scanned
for known malicious-code patterns (obfuscated eval()/base64_decode() chains, webshell request
patterns) so a webshell is caught even if it predates monitoring.
WordPress Management
Benefits
- Compromise Detection From Day
One: Core files are checked against the official WordPress.org manifest, catching
tampering even on the very first scan.
- Catches What Hash Diffing
Can’t: Content-pattern scanning flags malicious code that was already present before
monitoring started.
- Hardened Uploads Directory, Actively Verified: A
server rule denies execution of PHP and other script extensions in wp-content/uploads β the most
common place a dropped webshell hides. Rather than just writing the rule and assuming it works, WP Warden
confirms it daily with a real self-test request, so you see whether it’s actually enforced on your specific
host, not just present in a config file.
High-Impact Use Cases
- Post-Update Peace of Mind:
Confirm no core or plugin files were tampered with after every update cycle.
- Fleet-Wide Brute-Force
Correlation: If the same IP targets multiple sites in your fleet within an hour, WP
Warden raises one alert instead of one per site.
Competitive Advantages &
Differentiators
- Dual-Layer Detection: Hash
diffing and content-pattern scanning run independently, so a compromise is caught whether it shows
up as a file change or as code that was never technically a change at all.
- Verified-Clean Backups: A
backup taken right after a fully clean scan is marked Verified Clean β the safest restore point to
roll back to after a compromise.
—
