Title: Lockgate Exposure Scanner Author: oddeveninfotech Published: September 6, 2026 Last modified: September 7, 2026 --- Search plugins ![](https://ps.w.org/lockgate-exposure-scanner/assets/banner-772x250.png?rev=3683940) ![](https://ps.w.org/lockgate-exposure-scanner/assets/icon-256x256.png?rev=3683940) # Lockgate Exposure Scanner By [oddeveninfotech](https://profiles.wordpress.org/oddeveninfotech/) [Download](https://downloads.wordpress.org/plugin/lockgate-exposure-scanner.1.1.0.zip) * [Details](https://wordpress.org/plugins/lockgate-exposure-scanner/#description) * [Reviews](https://wordpress.org/plugins/lockgate-exposure-scanner/#reviews) * [Installation](https://wordpress.org/plugins/lockgate-exposure-scanner/#installation) * [Development](https://wordpress.org/plugins/lockgate-exposure-scanner/#developers) [Support](https://wordpress.org/support/plugin/lockgate-exposure-scanner/) ## Description AI assistants are increasingly connected to WordPress sites — to triage comments, summarise form entries, or check orders. When that happens, the assistant reads your stored content directly. Most of that content was written by people you have never met. Comments, contact form entries, profile biographies and product reviews are, by design, things strangers can write without an account and without review. None of it was written with an assistant in mind, and some of it may have been written specifically to steer one. This plugin reads what is already stored on your site and tells you what an assistant would be handed. #### What it reads Every comment, including the spam and trash queues nobody reviews. Every user profile. Every post, page and public custom post type. Entries held by contact form, membership or e-commerce plugins in their own database tables are **not** read. Each of those stores its data differently, and guessing at their table layouts would mean either missing entries or reporting on the wrong rows. #### What it looks for * **Invisible characters** — zero-width and bidirectional control characters, and the Unicode TAG block, which can hide readable instructions inside text that looks perfectly ordinary to you. * **Instructions aimed at an assistant** — chat-template control tokens, fake system messages, and text asking an assistant to conceal something from you. * **Content hidden with CSS** — text set to `display:none`, zero font size, or positioned off-screen. Invisible when you review the comment; fully readable to an assistant. * **Ways of sending data out** — image links to external servers, and instructions to post data to a URL. The comment author’s website field is read along with the body: it is attacker-controlled, it is handed to an assistant with everything else, and it is the oldest link-smuggling field WordPress has. * **Tool-call syntax** — the markup an assistant uses to call a tool or to receive a result, written into a comment. A forged _result_ is rated above a forged call: a call can be refused, while a result claims something already happened and an assistant cannot tell it from its own tool output. * **Mentions of your own site’s tools** — if the Abilities API is present, content naming a tool registered on _your_ site is flagged. Nobody types those names into a comment box by accident. #### Who wrote it matters Every item is resolved to its author, and the author’s capabilities decide how carefully it is examined. An administrator’s own words are not scanned. A comment from someone with no account is always scanned. That distinction is only possible from inside WordPress. Tools that sit between your site and an assistant see a block of text and have to guess. #### Honest limitations Prompt injection is an unsolved problem and this plugin does not solve it. These are pattern-based checks. They find techniques that are currently common and that a person reviewing content cannot see. They will miss things. **A clean result means these checks found nothing — not that your site is safe.** The plugin reports; it does not protect. It does not block anything, does not change how your site behaves, and does not sit between an assistant and your data. #### Read-only and entirely local * Runs `SELECT` queries only. Nothing is modified, moderated or deleted. * Makes **no external connections**. No analytics, no phoning home, no account. * Nothing about your content leaves your server. * Results are stored in a single option and removed when you deactivate the plugin. #### Continuous protection This scanner looks at content that is already stored. If you want content checked at the moment an assistant reads it, with provenance tagging and an audit trail, that is [Lockgate](https://oddeveninfotech.com/plugins/lockgate/), a separate commercial plugin from the same authors. This one works on its own and always will. ## Screenshots [⌊The scan screen before running.⌉⌊The scan screen before running.⌉[ The scan screen before running. [⌊Progress while scanning.⌉⌊Progress while scanning.⌉[ Progress while scanning. [⌊Results, with findings and escaped excerpts.⌉⌊Results, with findings and escaped excerpts.⌉[ Results, with findings and escaped excerpts. ## Installation 1. Install and activate the plugin. 2. Go to **Tools Agent Exposure**. 3. Click **Scan my site**. The scan runs in batches while the page is open. Closing the tab pauses it; reopening the screen carries on from where it stopped. Nothing runs in the background and nothing is scheduled. ## FAQ ### Does this change or delete any of my content? No. It only reads. There is no code path in this plugin that writes to your posts, comments or users. ### Does it send my content anywhere? No. The plugin makes no external connections of any kind. Everything happens on your own server. ### Will it slow down my site? No. Nothing runs on the front end. The scan only runs while you are on its admin screen, in small batches so it does not exhaust your host’s limits. ### I have thousands of comments. Is that a problem? No. The scan is batched and resumable. You can stop it at any time, and reopening the page picks up where it left off. ### It found nothing. Am I safe? It means these checks found nothing in your stored content. It does not mean your site is safe. No pattern-based tool catches every technique, and this one is deliberately conservative to avoid flagging ordinary comments. ### It flagged a comment that looks harmless. That happens most often with content _about_ prompt injection — a post explaining the attack, or a support thread quoting an example. The checks cannot always distinguish writing about a technique from using it. Findings are information for you to judge, not a verdict. ### Does this need the Abilities API or an MCP plugin? No. It is useful on any site. If the Abilities API is present, one extra check becomes available: content naming a tool registered on your site. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Lockgate Exposure Scanner” is open source software. The following people have contributed to this plugin. Contributors * [ oddeveninfotech ](https://profiles.wordpress.org/oddeveninfotech/) [Translate “Lockgate Exposure Scanner” into your language.](https://translate.wordpress.org/projects/wp-plugins/lockgate-exposure-scanner) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/lockgate-exposure-scanner/), check out the [SVN repository](https://plugins.svn.wordpress.org/lockgate-exposure-scanner/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/lockgate-exposure-scanner/) by [RSS](https://plugins.trac.wordpress.org/log/lockgate-exposure-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 * New check: tool-call syntax. Reports content carrying the markup an assistant uses to invoke a tool or to receive a result — forged tool results, invocation blocks, MCP tool ids and tool-call structures. * Naming an assistant is never a finding on its own. The check looks for the syntax, not for the word “ChatGPT”, so ordinary writing about AI is not flagged. * Tool-call syntax now corroborates an ambiguous phrase. “Ignore all previous instructions” stays medium on its own and is raised beside a tool call. #### 1.0.0 * First release. ## Meta * Version **1.1.0** * Last updated **21 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [AI](https://wordpress.org/plugins/tags/ai/)[assistant](https://wordpress.org/plugins/tags/assistant/) [comments](https://wordpress.org/plugins/tags/comments/)[security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/lockgate-exposure-scanner/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/lockgate-exposure-scanner/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/lockgate-exposure-scanner/reviews/) ## Contributors * [ oddeveninfotech ](https://profiles.wordpress.org/oddeveninfotech/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/lockgate-exposure-scanner/)