Lockgate Exposure Scanner

Description

AI assistants are increasingly connected to WordPress sites — to triage comments, summarise form entries, or check orders. When that happens, the assistant reads your stored content directly.

Most of that content was written by people you have never met. Comments, contact form entries, profile biographies and product reviews are, by design, things strangers can write without an account and without review. None of it was written with an assistant in mind, and some of it may have been written specifically to steer one.

This plugin reads what is already stored on your site and tells you what an assistant would be handed.

What it reads

Every comment, including the spam and trash queues nobody reviews. Every user profile. Every post, page and public custom post type.

Entries held by contact form, membership or e-commerce plugins in their own database tables are not read. Each of those stores its data differently, and guessing at their table layouts would mean either missing entries or reporting on the wrong rows.

What it looks for

• Invisible characters — zero-width and bidirectional control characters, and the Unicode TAG block, which can hide readable instructions inside text that looks perfectly ordinary to you.
• Instructions aimed at an assistant — chat-template control tokens, fake system messages, and text asking an assistant to conceal something from you.
• Content hidden with CSS — text set to display:none, zero font size, or positioned off-screen. Invisible when you review the comment; fully readable to an assistant.
• Ways of sending data out — image links to external servers, and instructions to post data to a URL. The comment author’s website field is read along with the body: it is attacker-controlled, it is handed to an assistant with everything else, and it is the oldest link-smuggling field WordPress has.
• Tool-call syntax — the markup an assistant uses to call a tool or to receive a result, written into a comment. A forged result is rated above a forged call: a call can be refused, while a result claims something already happened and an assistant cannot tell it from its own tool output.
• Mentions of your own site’s tools — if the Abilities API is present, content naming a tool registered on your site is flagged. Nobody types those names into a comment box by accident.

Who wrote it matters

Every item is resolved to its author, and the author’s capabilities decide how carefully it is examined. An administrator’s own words are not scanned. A comment from someone with no account is always scanned.

That distinction is only possible from inside WordPress. Tools that sit between your site and an assistant see a block of text and have to guess.

Honest limitations

Prompt injection is an unsolved problem and this plugin does not solve it.

These are pattern-based checks. They find techniques that are currently common and that a person reviewing content cannot see. They will miss things. A clean result means these checks found nothing — not that your site is safe.

The plugin reports; it does not protect. It does not block anything, does not change how your site behaves, and does not sit between an assistant and your data.

Read-only and entirely local

• Runs SELECT queries only. Nothing is modified, moderated or deleted.
• Makes no external connections. No analytics, no phoning home, no account.
• Nothing about your content leaves your server.
• Results are stored in a single option and removed when you deactivate the plugin.

Continuous protection

This scanner looks at content that is already stored. If you want content checked at the moment an assistant reads it, with provenance tagging and an audit trail, that is Lockgate, a separate commercial plugin from the same authors. This one works on its own and always will.