Ensomedia Security powered by shieldwave.io

Description

Ensomedia Security, powered by shieldwave.io, scans your site from the inside and tells you, in plain language, what is wrong and how to fix it. It is built around one idea: an alert has to be worth your attention. Every check, the scheduled scans and the email alerts are free, work without an account and have no limits.

Why owners switch to it

• Official checksums first. Every WordPress core file, every plugin from the WordPress.org directory and every directory theme is compared with the exact files WordPress.org published for your version. A file that matches is trusted and never “looks suspicious”. A file that differs is reported with the reason.
• Malware detection that needs real evidence. One weak signal, such as base64 in a file, is never a finding. The scanner looks for code that runs what a visitor sends, decodes and executes hidden payloads, hides function names, fetches remote code or creates hidden administrators. Findings ShieldWave is not sure about are listed under “Ask your developer to check” and never send email.
• Change monitoring for everything WordPress.org cannot verify. Premium plugins, custom themes, must-use plugins and drop-ins are recorded as a baseline. Changes that come with an update are accepted on their own; a new PHP file that appears without one is reported.
• Alerts that do not cry wolf. One email per scan, only for problems that are new or got worse, never twice for the same one, at most four a day. A check that could not run (for example because WordPress.org did not answer) never sends an email and never marks anything as fixed.
• Locks out password guessers. Too many failed logins lock an address out for a while, and your user names stay private. New installs are protected out of the box, and the address that turns it on is never locked out.
• A stolen password is not enough. Turn on two-factor login and ShieldWave asks for a one-time code from your authenticator app after the password. It is opt-in and per person, with recovery codes and a shell rescue, so you can never lock yourself out.
• Two common ways in, closed with one switch each. Turn off the plugin and theme file editor and XML-RPC in ShieldWave’s settings, without touching wp-config.php. The scan tells you when each one is worth it.
• Light on your server. Scans never run while a visitor’s page loads: they run in the background in short steps that fit hosts with a 30-second limit, and files that did not change since the last scan are not analyzed again.
• Never rewrites your site. The plugin never edits, moves or deletes your files, users or settings. It explains each fix. The only things it ever refuses are a bad login, a stranger asking for your user list, and the file editor and XML-RPC if you switch them off.

The checks

Malware and files:

• Malware and backdoors: analyzes every PHP, JavaScript and .htaccess file that WordPress.org cannot vouch for, with rules for web shells, request-to-execute code, decode-and-execute chains, obfuscated function names, remote code loaders, PHP hidden in images, spam mailers, hidden administrators, injected JavaScript and malicious redirects.
• WordPress core files: every core file against the WordPress.org checksums for your version and language, plus PHP files in wp-admin, wp-includes or the site root that are not part of WordPress.
• Plugin files: plugins from the WordPress.org directory against the checksums of the installed version, plus PHP files the release does not contain.
• Theme files: themes from the WordPress.org directory against their release package.
• File changes: new and changed files outside those releases (premium plugins, custom themes, must-use plugins, drop-ins, the site root) against the recorded baseline, and plugin or theme folders that appear without going through the WordPress installer.
• PHP files in uploads: web shells, PHP files and .htaccess or .user.ini rules that make the server run uploads as PHP.

Vulnerabilities and software:

• Known vulnerabilities (opt-in): plugins, themes and WordPress versions with published vulnerabilities, premium ones included, with the version that fixes each one. Uses the ShieldWave vulnerability lookup, which is free and needs no account; see External services.
• Closed and abandoned plugins: plugins closed on WordPress.org (a security reason is flagged high) and plugins without an update for two years.
• Unused plugins and themes: installed but switched off, so you can delete what you do not need.
• WordPress, plugin and theme updates, and PHP version support.

Live protection (all opt-in, all off until you turn them on):

• Live threat feed: when ShieldWave publishes new malware rules or confirmed file signatures, your site picks them up within about three hours, verified by signature, so detection can improve between plugin updates. It sends nothing about your site.
• AI second opinion: for a file the local rules cannot judge, a redacted excerpt is sent for a language-model verdict in plain words. Site address, emails and anything key-like are removed first; wp-config.php is never sent. See External services.
• User list exposure and suspicious scheduled tasks: whether the REST API hands your user names to anyone, and scheduled tasks that no plugin owns and carry code or a web address.

Content and exposure:

• Injected content: scripts, hidden iframes and spam links that attackers add to posts, widgets and options. Ordinary embeds and tracking codes are recognised and left alone.
• Exposed files: readable copies of wp-config.php with the database password, database dumps, backup archives, .git folders, .env files and logs that your web server hands out to anyone, confirmed by requesting them from your own site; leftover migration installers and database tools; folder listings.

Accounts and configuration:

• Administrator accounts, user registration, wp-config.php, debug output, file editor, XML-RPC and HTTPS.

Each issue has a severity, what it means, how to fix it and the files, plugins or settings involved. Problems of the same kind are grouped, so a site never faces hundreds of lines. You can ignore a problem; an ignored file comes back if it changes again. The score starts at 100 and loses points for the most serious open issue of each check.

Login protection

• Stops brute-force logins: after five failed logins from one address (you choose), that address waits a cooldown you set. The lock is always temporary, and trusted addresses, including the one that turned the feature on, are never locked.
• Keeps user names private: the login form stops confirming them, and visitors who are not logged in get none from the ?author=N trick, the REST API user list, embeds or the users sitemap. Logged-in requests work as before.
• Every lockout goes to History and can raise an alert. On by default for new installs, off after an upgrade until you turn it on. It uses only the connection’s own address, never a header a request can fake.

Two-factor login

• A second step at sign-in: a one-time code from any authenticator app (Google Authenticator, Authy, 1Password and others) after the password, for each administrator who turns it on.
• No lock-outs: the code is only required after you confirm your app makes the right one; ten single-use recovery codes cover a lost phone, and wp shieldwave two-factor disable <user> rescues an account from the shell.
• Every sign-in with the password asks for the code, from the login page or any other login form, such as a shop’s account page. Apps and integrations sign in with an application password; the plain password is refused over XML-RPC and the REST API for an account with two-factor on. Codes cannot be replayed, and wrong codes are rate-limited.

Hardening

• Turn off the file editor: the plugin and theme code editor leaves the dashboard, so a stolen administrator password cannot plant code through it. Updates keep working.
• Turn off XML-RPC: xmlrpc.php stops offering WordPress methods, which closes bulk password guessing and pingback floods. ShieldWave warns you first if a plugin you use, such as Jetpack, needs it.
• Both are off until you turn them on, and neither edits wp-config.php or any other file.

Alerts

• After scheduled scans: new or more serious issues at or above your threshold (critical only, high and above, or medium and above).
• In real time: when an account becomes administrator, naming who did it, and flagging it as urgent when nobody was signed in.
• A weekly summary, if you want one.

ShieldWave dashboard (optional)

With a ShieldWave Pro or Enterprise account at shieldwave.io you can connect the plugin with an API key: every connected site, its score and open issues in one list next to ShieldWave’s outside scan (TLS, security headers, exposed files, email spoofing protection). The connection only sends results: the dashboard cannot change a setting on the site or start anything there. A free account can be connected too, but its results stay on your site. Without a connection, nothing goes to ShieldWave except the opt-in features listed under External services.

What this plugin does not do

It is not a full web application firewall (it does not inspect and block every request), and it does not remove malware for you. It finds, explains, alerts, stops brute-force logins, adds two-factor login and can switch off the file editor and XML-RPC; you, your developer or your host make the rest of the change. It adds nothing to the pages visitors see.

Credits

The admin screens use the Inter typeface by The Inter Project Authors, licensed under the SIL Open Font License 1.1 (assets/fonts/inter-license.txt). It is loaded from the plugin itself, only on the ShieldWave screens.

External services

The plugin makes no outside requests when it is activated or when admin pages load. Requests happen when a scan runs (by hand or on the schedule), when you use the account actions, and, with an account connected, in an hourly check-in. Requests to WordPress.org and to your own site use the WordPress HTTP API’s default user agent, which includes your WordPress version and site address, exactly as WordPress itself does for its update checks. Requests to ShieldWave send a neutral user agent (ShieldWave-Security and the plugin version) and never your site address in their headers. Like any web request, each one comes from your server’s IP address.

WordPress.org core checksums (api.wordpress.org/core/checksums/1.0/)
Used by the “WordPress core files” check. Sent: your WordPress version and package language. Cached for a day.

WordPress.org plugin checksums (downloads.wordpress.org/plugin-checksums/)
Used by the “Plugin files” check. Sent: the folder name and version of each installed plugin, one request per plugin. Cached for a week.

WordPress.org theme packages (downloads.wordpress.org/theme/)
Used by the “Theme files” check. The release package of each installed directory theme is downloaded to a temporary file, hashed and deleted at once. Sent: the theme’s folder name and version. The result is cached for a week.

WordPress.org plugin information (api.wordpress.org/plugins/info/1.2/)
Used by the “Closed and abandoned plugins” check. Sent: the folder name of each installed plugin. Cached for a week.

All four are provided by WordPress.org: privacy policy.

Your own site
The XML-RPC, debug output and exposed files checks request a few URLs of your own site (xmlrpc.php, the debug.log URL, backup files found on disk, the uploads folder). While a scan runs, the plugin also calls your own admin-ajax.php to continue the scan in the background.

ShieldWave vulnerability lookup (shieldwave.io, endpoint /api/plugin/vulnerabilities), off until you turn it on
Used by the “Known vulnerabilities” check. Sent when that check runs: your WordPress version and the folder name, product name and version of each installed plugin and theme, premium ones included. A premium plugin or theme is matched to a vulnerability by its folder and product name. No site address, no account, no personal data. The answer lists the vulnerabilities that apply to those versions; the data comes from Wordfence Intelligence, and each result links to its record with its copyright notice. Cached for a few hours.

ShieldWave threat feed (shieldwave.io, endpoint /api/plugin/intel), off until you turn it on
Used by the “Live threat feed” option. The plugin downloads a signed file of extra malware rules and known-bad and known-good file signatures, roughly every three hours, so detection improves between plugin updates. Sent: nothing about your site; the only thing that leaves is your plugin version, which every request already carries. The file is verified with a cryptographic signature before it is used.

ShieldWave AI second opinion (shieldwave.io, endpoint /api/plugin/ai/review), off until you turn it on
Used by the “AI second opinion” option, and only for a file the local rules cannot judge on their own. Sent: a short excerpt of that file (the lines around the suspicious code), with your site address, email addresses and anything that looks like a password, key or token removed first; configuration files such as wp-config.php are never sent. ShieldWave asks a language model hosted by Groq, Inc. and returns a plain-language verdict, which is cached by the file’s fingerprint and shared across sites. No site address, no account, no personal data.

ShieldWave account (shieldwave.io), only after an administrator pastes an API key under ShieldWave > Settings and presses Connect

• When you connect, or press “Check account again”: the API key goes to the endpoint /api/license/verify on shieldwave.io to find the account and plan, and /api/plugin/connect receives this site’s id, address, and the plugin, WordPress and PHP versions. (These endpoints answer only a request that carries an API key; they are not pages.)
• After each scan (if sending is on) or when you press “Send latest results”: the endpoint /api/plugin/sync receives the scan summary, the score, the open and ignored issues (severity, title, message, fix, and the file, plugin or setting involved) and the list of installed plugins and themes with versions.
• Hourly and after each scan, on Pro and Enterprise: the endpoint /api/plugin/heartbeat receives the scan status, the score and issue counts. Nothing in the answer changes the site: the plugin takes no settings and no commands from ShieldWave.
• Never sent: posts, pages, comments, user names, email addresses or passwords. Issues about accounts are sent without the account names.
• For a free account ShieldWave answers that the plan does not include the dashboard, stores nothing, and the plugin pauses these calls for 12 hours.

ShieldWave terms of service and privacy policy.