Description

Blueternal BOLT Security Toolkit (BOLT) scans your WordPress site and hosting environment for security issues, surfaces plain-English findings in wp-admin, and gives you step-by-step fix instructions for every check.

BOLT is designed for the gap between generic WordPress security plugins and full server access: it helps site owners, agencies, and hosting teams see what is actually misconfigured on the current host, which issues matter most, and which ones BOLT can safely fix from WordPress plugin context.

Free features:

31-point security scan across Server Environment, WordPress Core, Authentication, Site Exposure, Security Headers, Updates, and Writable Directories
Checks PHP version, MySQL version, OPcache, dangerous PHP functions, directory listing, PHP override effectiveness, loopback request health, WP-Cron health, WP_DEBUG, wp-config.php permissions, DISALLOW_FILE_EDIT, database prefix, XML-RPC, REST API exposure, application passwords, user registration, default admin username, administrator account sprawl, debug log exposure, readme.html exposure, public backup or dump artifacts, HTTPS, HSTS, core/plugin/theme updates, uploads permissions, and executable files in uploads
Server/PHP profile detection for Apache, Apache with PHP-FPM/FastCGI, LiteSpeed/LSAPI, Nginx with PHP-FPM, IIS, and unknown/shared-host stacks
“How to fix” accordion with manual instructions for every check
Recommendations summary of all failing and warning items
Host-aware action states so supported fixes show as actionable and unsupported ones stay manual
Dedicated Hardening tab with supported one-click hardening actions and manual priorities
One-click auto-fixes for WP_DEBUG, File Editor, Directory Listing, HSTS, executable files in uploads, XML-RPC, and REST API restriction when the current host supports them
One-click removal for public readme.html exposure and public backup, dump, environment, installer, and diagnostic artifacts
Persistent fix history with grouped sessions and full undo for all BOLT-applied changes, including restoring original wp-config.php and .htaccess content
REST public-route allowlist manager for intentional unauthenticated REST endpoints
Application Password Governance inventory with stale, unused, and administrator-owned API credential review
Attack Path Analysis: identifies realistic compromise chains based on your current configuration and shows the fastest way to break them
Near-Miss Detection: highlights conditions that are close to forming an attack path before they become exploitable
AI Security Briefing panel is visible in the Overview tab; generation and AI Settings require BOLT Pro
Weekly scheduled scan reports by email
Optional BOLT-branded PDF attachment on scheduled scan emails using dompdf when available, with a built-in plain PDF fallback
Reports tab status panel showing whether the BOLT WP-Cron event is registered, when it will run next, the last delivery/PDF status, and a manual test-send button
Email only when new issues appear
Alerts tab shows the Slack and generic webhook controls; delivery and test alerts require BOLT Pro
Activity tab with the last 7 days of security timeline entries for logins, user changes, software changes, scans, reports, alerts, and auto-fixes
Baseline drift detection with one active baseline, save/update/clear baseline actions, regressions since the approved scan, and finding-level before/after value diffs
Vulnerability Intelligence rows can show pass/fail status and CVE IDs when advisory findings are present; full advisory detail requires BOLT Pro
Accepted Risk Register with owner, reason, expiration date, reopen controls, and action-queue suppression for documented unresolved findings

Available through the separate BOLT Pro add-on/service (learn more at blueternalsolutions.com/bolt-pro):

BOLT Pro adds more coverage and less manual work through hosted checks, automation, and reporting controls.

Domain/IP reputation scan through the BOLT platform endpoint, with normalized results from Spamhaus DBL, SURBL, URIBL, Spamhaus ZEN, SpamCop, and SORBS
On-demand reputation re-checks from the Reputation tab
WordPress core file integrity monitoring against official checksums
Unexpected-file detection inside wp-admin and wp-includes
PHP malware-pattern scanning across plugins, themes, mu-plugins, and uploads, with Malware Triage Center support for hash-based expected-file decisions
Vulnerability intelligence for WordPress core, plugins, and themes through a configurable BOLT advisory feed
Full vulnerability advisory detail, including affected version range, CVSS score, and patch link when supplied by the advisory feed
AI Security Briefings and AI Settings
Daily and monthly scheduled scan cadences
Multiple report recipients and custom report branding
Slack and generic webhook alerts, including critical-only and baseline-regression-only filters
Full Activity timeline
Named baseline snapshots

External Services

BOLT only sends data to an external service when the corresponding feature is configured or explicitly used by an administrator.

Blueternal Solutions

When a site has BOLT Pro active and an administrator generates the AI Security Briefing without saving their own OpenAI API key, BOLT sends a compact, redacted JSON payload of selected fail/warn scan findings to the Blueternal Solutions BOLT API for hosted analysis. Free installs show the AI panel but cannot generate briefings. The payload can include finding labels, statuses, severities, messages, recommendations, remediation guide URLs, limited environment notes, baseline drift summaries, a payload hash, plugin version, site/home URL, and a random install identifier used for service quota. It does not send raw files, database contents, passwords, secret keys, or arbitrary page content.

The hosted AI service uses Blueternal Solutions server-side credentials and may process the redacted payload through an AI provider to return the structured briefing. The separate BOLT Pro add-on/service may also contact Blueternal Solutions endpoints for license validation, reputation checks, vulnerability intelligence, and upgrade pages. Depending on the Pro feature used, requests may include the site URL, plugin version, license key, domain, IP address, and installed WordPress core/plugin/theme version metadata needed to return the requested service response.

Service endpoint: https://blueternalsolutions.com
Terms: https://blueternalsolutions.com/bolt-terms-of-service/
Privacy policy: https://blueternalsolutions.com/bolt-privacy-policy/

OpenAI

If BOLT Pro is active and an administrator saves an OpenAI API key in BOLT settings or defines BOLT_OPENAI_API_KEY, the AI Security Briefing sends the compact, redacted JSON payload directly from the site to OpenAI instead of using the hosted BOLT service. The payload can include finding labels, statuses, severities, messages, recommendations, remediation guide URLs, limited environment notes, and baseline drift summaries. It does not send raw files, database contents, passwords, secret keys, or arbitrary page content.

Service endpoint: https://api.openai.com
Terms: https://openai.com/policies/terms-of-use/
Privacy policy: https://openai.com/policies/privacy-policy/

Google Safe Browsing

If BOLT Pro is active and an administrator saves a Google Safe Browsing API key, the Browser Blocklist reputation check sends the site’s home URL and domain URL to the Google Safe Browsing Lookup API v4 when a reputation check runs. This is used only to determine whether the site is flagged for malware, phishing, unwanted software, or potentially harmful applications. The request also includes the saved API key, a BOLT client identifier, and the plugin version. BOLT does not send scan findings, files, database contents, passwords, license keys, or arbitrary page content to Google Safe Browsing.

Service endpoint: https://safebrowsing.googleapis.com/v4/threatMatches:find
Terms: https://developers.google.com/terms
Privacy policy: https://policies.google.com/privacy

Slack

If BOLT Pro is active and an administrator saves a Slack incoming webhook URL in BOLT Alerts, scheduled alerts or the manual test alert send alert text to the configured Slack webhook. The payload can include the site name, site URL, BOLT admin URL, scan score, score label, score delta, baseline score delta, issue count, issue labels, issue severities, issue statuses, issue messages, baseline drift summaries, capture time, and whether the alert is a test. It does not send raw files, database contents, passwords, secret keys, license keys, or arbitrary page content.

Service endpoint: the Slack incoming webhook URL configured by the administrator, usually https://hooks.slack.com/services/...
Webhook documentation: https://api.slack.com/incoming-webhooks
Terms: https://slack.com/terms-of-service/api
Privacy policy: https://slack.com/privacy-policy

Generic Webhook

If BOLT Pro is active and an administrator saves a generic webhook URL in BOLT Alerts, scheduled alerts or the manual test alert send a JSON alert payload to the exact URL configured by that administrator. The payload can include the site name, site URL, BOLT admin URL, scan score, score label, score delta, critical-only and baseline-only alert flags, baseline score delta, issue count, issue labels, issue severities, issue statuses, issue messages, recommendations, baseline drift summaries, capture time, and whether the alert is a test. It does not send raw files, database contents, passwords, secret keys, license keys, or arbitrary page content.

Service endpoint: the generic webhook URL configured by the administrator.
Terms and privacy policy: determined by the administrator-configured destination service.

Installation

Upload the plugin to the /wp-content/plugins/ directory, or install through the WordPress Plugins screen.
Activate the plugin through the Plugins menu.
Go to BOLT Security in the WordPress admin menu.
Run a scan and review the findings.

FAQ

Does this plugin require root or shell access?

No. BOLT works entirely through PHP and the WordPress filesystem API — the same permissions your site already runs under.

Can this plugin perform full sysadmin tasks from WordPress?

No. BOLT can detect many server and WordPress security issues, automate some changes that are reachable from plugin context, and guide the rest. It cannot honestly replace root or sudo from inside WordPress. Some fixes are always one-click, some are host-dependent, some are manual only, and some would require a future companion agent or external integration.

What does the scanner check?

The free tier covers 31 checks across PHP and database versions, PHP resource limits, local PHP override effectiveness, OPcache, dangerous PHP functions, directory listing, loopback request health, WP-Cron health, uploads permissions and executable files, WP_DEBUG, wp-config.php permissions, DISALLOW_FILE_EDIT, database prefix, XML-RPC, REST API, application passwords, user registration, default admin username, administrator account sprawl, debug log exposure, readme file exposure, public backup or dump artifact exposure, HTTPS, HSTS, and core/plugin/theme update status. Pro adds server-side domain/IP reputation scanning, WordPress core file integrity monitoring, suspicious PHP malware-pattern detection, and vulnerability intelligence for WordPress core, plugins, and themes. Free displays vulnerability status and CVE IDs when advisory findings are present; Pro shows the full advisory detail.

How do Attack Paths, Near Misses, and Amplifiers work?

BOLT separates chained risk into three layers. Attack Paths are realistic compromise chains where multiple findings combine into a practical risk. Near Misses are partial chains where one important condition exists, but another required condition is missing. Amplifiers are findings that do not create an attack path by themselves, but increase the impact of a real path.

For example, writable wp-config.php is not treated as remote compromise by itself. Alone, it appears as a near miss because it could support persistence if a write-capable foothold appears later. Combined with a real write-capable compromise path, it appears as a persistence amplifier.

How does file integrity monitoring work?

BOLT Pro can verify WordPress core files against official checksum data and detect unexpected files inside wp-admin and wp-includes. If the checksum service is temporarily unavailable, the integrity checks fall back to a warning instead of failing the whole scan.

How does malware scanning work?

BOLT Pro can scan PHP files in plugins, themes, mu-plugins, and uploads for suspicious combinations of malware-like patterns such as obfuscation, hidden iframe payloads, encoded blobs, and dangerous execution chains. The scan is heuristic and should be treated as an investigation starting point rather than definitive malware attribution.

How does vulnerability intelligence work?

BOLT Pro can query a configurable advisory feed and compare installed WordPress core, plugin, and theme versions against known affected version ranges. Successful responses are cached locally for 6 hours, and the last good cache is reused if the endpoint is temporarily unavailable.

How do one-click fixes work?

Auto-fixes write the correct configuration change directly where WordPress has a safe capability path, such as wp-config.php, .htaccess, or an mu-plugin. BOLT logs fix metadata in the database, but it does not store backup copies of config or code files. Undo is available only for files BOLT creates itself, such as its XML-RPC and REST API mu-plugin files. Changes to existing files should be reviewed before applying and rolled back through your host backup or version control if needed. BOLT distinguishes between fixes that are verified immediately, fixes that are pending the next request, and fixes that are manual only on the current host.

BOLT does not auto-write disable_functions; PHP treats that as system-level configuration that must be changed in php.ini, PHP-FPM pool config, LiteSpeed/PHP selector, or a hosting control panel. Uploads execution blocking is one-click only when the current stack is Apache/LiteSpeed-style and can use an uploads .htaccess rule. REST API restriction uses an mu-plugin instead of a blanket web-server block so logged-in WordPress requests and detected routes selected in the allowlist manager can keep working. Developers can also extend the allowlist with bolt_rest_api_allowed_public_routes. Nginx/PHP-FPM and FastCGI-only stacks receive manual server-rule guidance where server rules are required.

Does BOLT store rollback copies?

BOLT does not store rollback copies of config files, code files, public artifacts, or executable uploads. It stores fix history metadata in the WordPress database and relies on your normal host backup, staging workflow, or version control for rollback of existing files.

Does PDF reporting work out of the box?

Yes, when PDF attachment is enabled. Free reports use BOLT branding and one recipient. BOLT uses dompdf if WordPress already loads it; otherwise it attaches a built-in plain PDF report. BOLT Pro adds multiple recipients and custom report branding.

How does Pro licensing work?

BOLT Pro is distributed separately from WordPress.org. The Pro add-on validates its license against the Blueternal Solutions platform and caches successful responses locally.

What does the Activity tab record?

BOLT records authentication events, password resets, user creation and role changes, plugin and theme activation/update activity, WordPress core updates, and BOLT-native events such as scans, reports, alerts, and auto-fixes. Free shows the last 7 days. BOLT Pro shows the full retained timeline. Failed-login entries show whether the attempted login maps to an existing account; matched accounts link to recent successful and failed login history with source IPs where available.

How does baseline drift detection work?

BOLT can save one known-good scan as the active baseline, compare each new scan against that approved state, and summarize new failures, new warnings, resolved issues, improvements, and detail-level finding changes since the baseline. The Baseline tab also lets you run a fresh scan or reset the active baseline after host/runtime changes so drift markers and safe-fix eligibility are recalculated immediately. BOLT Pro adds multiple named baseline snapshots.

What is the Hardening tab for?

The Hardening tab groups BOLT’s supported one-click protections into one place. It shows what this host can fix automatically right now, offers one safe hardening action, and includes a manual hardening checklist pulled from the latest scan.

How does the AI analysis feature work?

BOLT Pro can optionally send a compact redacted JSON payload of actionable fail/warn findings for interpretation. Without a saved OpenAI API key, the request goes to the Blueternal Solutions BOLT API after hosted BOLT AI consent is enabled in AI Settings. With a saved key or BOLT_OPENAI_API_KEY, the request goes directly to OpenAI from the site. Free installs show the AI Security Briefing panel but cannot generate a briefing or configure AI Settings. BOLT does not send raw files, full database contents, or arbitrary page content. The Overview tab AI Security Briefing is explicit and manual; it does not generate anything automatically on page load.

What are the Pro plan options?

Current plan details are listed at blueternalsolutions.com/bolt-pro.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Blueternal BOLT Security Toolkit” is open source software. The following people have contributed to this plugin.

jfgamsby

Translate “Blueternal BOLT Security Toolkit” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

0.6.9

Extended auto-fix undo to cover modifications to existing files: wp-config.php and .htaccess originals are now saved to the database before BOLT changes them and restored on undo.
Added cleanup of legacy bolt-backups and sasa-backups upload directories on plugin activation and uninstall.
Added sasa_auto_fix_history and bolt_rest_api_custom_public_routes to the uninstall option cleanup list.

0.6.8

Removed filesystem copy storage from the WordPress.org build.
Changed public readme and public artifact fixes to delete exposed files instead of storing copies.
Changed fix history to database-only metadata with undo limited to files BOLT creates itself.

0.6.7

Documented Google Safe Browsing in External Services.
Removed an unnecessary WordPress admin theme include from scan update checks.

0.6.6

Added Attack Paths, a deterministic local rules engine that turns current scan findings into practical chained compromise scenarios.
Added an Overview panel showing the top three attack paths with evidence, required conditions, baseline-new status, shortest fix path, and break-chain actions.
Added a highlighted best break-chain action and near-miss detection for partially formed attack paths.
Added a Most effective fix right now section that highlights the single action that breaks the most visible attack paths.
Added wp-config.php persistence context so unsafe permissions appear as a near miss when alone or as a subtle amplifier on real write-capable attack paths.
Added Free vs Pro gates for report cadence, multiple report recipients, custom branding, alerts, AI briefings, full activity history, on-demand reputation checks, advisory detail, and named baseline snapshots.

0.6.5

Added Malware Triage Center for structured suspicious PHP file review.
Added hash-based expected-file decisions so unchanged known-good malware-pattern hits stay out of Priority Actions while changed files are flagged again.

0.6.4

Added Application Password Governance: BOLT now inventories actual WordPress application passwords, highlights stale, unused, and administrator-owned credentials, and links administrators to the relevant user profiles for review and revocation
Changed the Application Passwords scan from a generic feature-availability warning into a credential-aware local governance check
Added an Accepted Risk Register so administrators can document intentional unresolved findings with an owner, reason, and expiration date
Suppressed unexpired accepted risks from Top Actions, overview hardening action queues, new-issue report sections, alerts, and AI action payloads while keeping the underlying score unchanged

0.6.3

Removed public landing-page hooks so BOLT no longer alters front-end pages based on page slugs
Removed review-blocking HEREDOC/NOWDOC syntax from generated hardening rules and BOLT-created mu-plugin code
Documented Slack incoming webhook and generic webhook alert deliveries in the External Services section
Removed the New/Changed/Improved/Resolved baseline-drift badges from the Overview tab category tables and from the Hardening tab; drift markers belong on the Baseline tab where they have proper saved-baseline context
Standardized drift badge width on the Baseline tab so all four pill labels render at the same size regardless of text length
Hardened the public install-proof endpoint: non-matching install identifiers now return HTTP 200 with ok:false instead of 403, so the endpoint is no longer an existence oracle for guessed install ids
Added a 60/hour per-IP rate limit to install-proof requests to throttle brute-force attempts
Tightened the loopback-probe nonce window from roughly two hours to roughly five to ten minutes (5-minute bucket with current and previous accepted), reducing replay surface while still tolerating bucket boundaries
Hardened the auto-fix undo and bulk-session-undo handlers so missing or invalid fix entries redirect with a generic notice instead of wp_die‘ing on a reflected query parameter; the per-fix nonce action is preserved so an admin cannot be CSRF’d into undoing a different fix than they intended

0.6.2

Added a conditional one-click HSTS Header fix for HTTPS Apache/LiteSpeed-style .htaccess stacks
Refreshed the stored scan snapshot after verified individual Fix Now actions so cleared findings disappear immediately
Added a one-click removal fix for WordPress Readme File findings
Made Domain Blacklist warning recommendations context-aware so Pro reputation warnings no longer say “Upgrade to Pro”
Linked Overview Recommendations to the current Priority Actions so resolved findings no longer linger there
Forced manual scans to refresh WordPress update data before ranking plugin/theme update priority actions
Added a one-click removal fix for Public Backup / Dump Files findings
Scoped Core File Integrity to runtime WordPress application files so bundled theme/plugin updates and removed package docs do not trigger critical core failures
Routed Pro blacklist checks through the BOLT platform reputation endpoint, with direct DNSBL only as a labeled fallback
Required license verification to match an active site seat, reacquired saved seats on plugin reactivation, and serialized platform seat assignment
Detected and backed up wp-config.php when WordPress stores it one directory above ABSPATH
Cleaned uninstall data more completely, including report status, tracked AI cache transients, REST allowlist options, and BOLT-created REST/XML-RPC mu-plugin files
Removed unused legacy scanner/admin prototype files from the distribution tree
Fixed DNSBL parsing so blocked/refused blacklist lookup responses are reported as inconclusive instead of listed
Added an Overview Fix Plan that separates one-click fixes from server-limited and manual priorities
Reworked the Hardening server profile card for clearer server/PHP handler context
Added explicit diagnostics when PHP reports apache2handler while host settings claim PHP-FPM
Bumped admin assets so the refreshed profile UI is not hidden by browser cache
Simplified the AI Security Briefing by keeping detailed fix guidance in the scan table
Increased AI structured-output headroom, added a retry for incomplete OpenAI responses, and invalidated older cached briefings
Added BOLT hosted AI briefing support, optional direct OpenAI override, guide links, and a smaller fail/warn payload
Added a REST API Fix Now action that writes a BOLT mu-plugin to restrict unauthenticated REST requests
Preserved BOLT license, reputation, hosted AI, webhook, and vulnerability-feed REST routes when REST hardening is enabled
Added persistent fix history for auto-fixes
Added grouped fix sessions and a REST public-route allowlist manager to the Hardening tab
Added finding-level baseline drift value diffs to the Baseline tab, reports, alerts, and AI payload evidence
Added detected REST route selection to the REST public-route allowlist manager
Hardened Loopback Requests and WP-Cron Health with a signed BOLT loopback probe, overdue-event diagnostics, cron-lock detection, and Reports tab health visibility

0.6.1

Added central server/PHP profile detection for capability decisions
Removed misleading one-click fix for disable_functions
Restricted uploads execution auto-fix to Apache/LiteSpeed-style .htaccess stacks
Removed adjacent auto-fix .bak files
Updated PHP/database scan recommendations to a safer current production baseline

0.6.0

Added MVP AI Security Briefing for the Scan tab with explicit manual generation
Added structured AI security summary and prioritized action plan using the OpenAI Responses API
Added AI settings page for API key, model, cache hours, and maximum findings
Bumped plugin version to 0.6.0

0.5.2

Added a dedicated Hardening tab in wp-admin
Added a one-click hardening action using the existing auto-fix engine
Added grouped one-click hardening controls and manual hardening priorities
Bumped plugin version to 0.5.2

0.5.1

Added active baseline drift detection against a saved scan baseline
Added baseline save, update, and clear actions on the scan tab
Added regressions, improvements, and resolved issue summaries since baseline
Added optional alert mode for baseline regressions only
Added a manual test alert action for configured alert destinations
Bumped plugin version to 0.5.1

0.5.0

Added a dedicated Activity tab with filterable security timeline entries
Added audit logging for authentication events, software changes, and BOLT actions
Added activity cleanup during uninstall
Bumped plugin version to 0.5.0

0.4.1

Added Pro malware-pattern scanning for suspicious PHP files
Added malware guidance in the admin UI and docs
Bumped plugin version to 0.4.1

0.4.0

Added Pro WordPress core file integrity monitoring using official checksum verification
Added detection for unexpected files inside wp-admin and wp-includes
Added file integrity guidance in the admin UI and docs
Bumped plugin version to 0.4.0

0.3.1

Added a dedicated Alerts tab for outbound Slack and generic webhook destinations
Added Pro alert delivery for newly detected scheduled-scan issues
Added critical-only filtering for outbound alerts
Bumped plugin version to 0.3.1

0.3.0

Added Pro vulnerability intelligence for WordPress core, plugins, and themes
Added configurable cached vulnerability feed support with advisory version matching
Added vulnerability documentation for feed configuration and payload shape
Bumped plugin version to 0.3.0

0.2.4

Added new hardening checks for database prefix, user registration, default admin username, debug log exposure, readme.html exposure, and application passwords
Expanded scan categories with Authentication and Site Exposure sections
Synced plugin version metadata with the current codebase

0.2.0

Refactored plugin bootstrap and lifecycle hooks
Rebuilt admin UI around consistent scan/report data model
Wired scheduled scans and email reports end-to-end
Replaced prototype license handling with remote HTTPS license validation
Added seat-based license enforcement via the Blueternal platform
Added Stripe-integrated license issuance (checkout.session.completed webhook)
Added Pro plans: Single ($49), Agency ($99), Developer ($199) — annual
Added one-click auto-fixes for WP_DEBUG, File Editor, Directory Listing, Executable Files in Uploads, and XML-RPC; dangerous PHP functions remain host-level guidance
Fixed deprecated current_time(‘timestamp’) in cron scheduler
Removed class collision risk from stale admin class file
Added /bolt and /bolt-pro landing pages

Description

External Services

Blueternal Solutions

OpenAI

Google Safe Browsing

Slack

Generic Webhook

Installation

FAQ

Does this plugin require root or shell access?

Can this plugin perform full sysadmin tasks from WordPress?

What does the scanner check?

How do Attack Paths, Near Misses, and Amplifiers work?

How does file integrity monitoring work?

How does malware scanning work?

How does vulnerability intelligence work?

How do one-click fixes work?

Does BOLT store rollback copies?

Does PDF reporting work out of the box?

How does Pro licensing work?

What does the Activity tab record?

How does baseline drift detection work?

What is the Hardening tab for?

How does the AI analysis feature work?

What are the Pro plan options?