Title: TeraServer Clinic Scan & Repair Kit Author: famelhaut Published: July 28, 2026 Last modified: July 28, 2026 --- Search plugins ![](https://ps.w.org/teraserver-clinic/assets/banner-772x250.png?rev=3626145) ![](https://ps.w.org/teraserver-clinic/assets/icon-256x256.png?rev=3626145) # TeraServer Clinic Scan & Repair Kit By [famelhaut](https://profiles.wordpress.org/famelhaut/) [Download](https://downloads.wordpress.org/plugin/teraserver-clinic.0.6.3.zip) * [Details](https://wordpress.org/plugins/teraserver-clinic/#description) * [Reviews](https://wordpress.org/plugins/teraserver-clinic/#reviews) * [Installation](https://wordpress.org/plugins/teraserver-clinic/#installation) * [Development](https://wordpress.org/plugins/teraserver-clinic/#developers) [Support](https://wordpress.org/support/plugin/teraserver-clinic/) ## Description TeraServer Clinic is the on-site agent for the TeraServer Clinic service (wpclinic. ai). It connects your WordPress installation to a TeraServer Clinic account and, depending on your plan, scans for malicious code, keeps WordPress core/plugins/themes updated, backs up your files, and applies AI-assisted cleanup when a threat is found. The **free scan works standalone** with just a connection token — no payment required. Paid plans add faster/scheduled autoscan, automatic updates, off-site backups, AI- assisted repair of infected files, and monitoring across more sites. #### Features * **Malware scan**: walks `wp-content` (uploads first) looking for PHP dropped in the uploads folder, double file extensions, known webshell/backdoor signatures, obfuscated eval() calls, and cryptomining scripts. Also checks the database for recently created administrator accounts and posts/options containing injected/ obfuscated code. * **Security hardening**: one-click, reversible fixes for common misconfigurations ( missing security headers, XML-RPC exposure, user enumeration, exposed readme/ info files, file editor access, directory listing) plus a built-in login-URL cloak. * **Automatic updates** (paid plans): keeps plugins, themes and WordPress core current, each update guarded by an automatic backup, a post-update health check, and a rollback if anything breaks. A manual scan/update can also be triggered from the dashboard. * **Autoscan**: periodic scanning (daily or weekly depending on plan) via WordPress cron. * **Backups** (paid plans): a small “repair set” backup before any automated fix, an on-demand full-site backup, and an opt-in weekly full backup — all stored off-site on TeraServer Clinic’s backup storage, not on your own hosting. * **PHP compatibility report**: analyzes the plugins and themes actually in use to recommend the highest PHP version your site can safely run. * **AI-assisted cleanup** (paid plans): when malware is found, a proposed fix is generated off-site and applied through the plugin’s own audited code — never as a remote shell — always preceded by a backup and followed by a health check with automatic rollback if anything breaks. This WordPress.org edition receives its own updates exclusively through the WordPress. org plugin directory, like any other listed plugin — it does not use a custom update mechanism for itself. ### External services This plugin is a thin client: on its own, without a connection, it does nothing. To do anything useful it must be connected — via a one-time connection token generated in your TeraServer Clinic account — to the TeraServer Clinic service, using an API key issued to your site. No data described below is sent anywhere until you complete that connection step, which itself shows this same disclosure and links to the Terms and Privacy Policy before you submit a token. Once connected, this plugin communicates with the TeraServer Clinic backend for the following, each described with what is sent and when: * **Connecting/licensing.** When you paste a connection token, the plugin sends your site’s home URL and the plugin version to exchange that token for a per- site API key and your plan’s entitlements. This happens once at connection time, and again if you move the site to a different TeraServer Clinic account. * **Periodic sync.** Roughly twice daily (WordPress cron) and right after connecting, the plugin sends your site URL, WordPress version, PHP version, plugin version, the current login URL, and a full inventory of installed plugins/themes (name, version, active/inactive, available updates) so the service can tell you what needs attention and, on plans that include it, apply updates. * **Scan reports.** After every scan (free tier included), the plugin sends the list of findings — file paths/locations, finding type, and severity/detail text, not full file contents — so they show up in your TeraServer Clinic dashboard and can trigger email alerts. * **Malware-signature confirmation.** During any scan (free tier included), if a small, bounded set of files (at most 25 files, 1 MB each) already matches a local suspicious-pattern check, the plugin sends the **full contents of just those flagged files to the TeraServer Clinic service for a second, server-side confirmation pass. Files that don’t match a local pattern first are never sent this way. * **Off-site backups (paid plans).** Manual and scheduled full-site backups, and the small “repair set” backup taken automatically before any destructive action( delete, repair, update), are uploaded as a zip to TeraServer Clinic’s backup storage, kept for a limited retention window so a site can be restored. * **AI-assisted repair (paid plans).** When you request a fix for detected malware, the **full contents of the specific flagged file(s)** (never your whole site) are sent to the TeraServer Clinic service, which returns a proposed cleaned version. That content is used only to produce the fix and is not retained afterwards. The plugin applies the returned patch itself, using its own code — the fix is never executed as a remote script — and always backs up first and rolls back automatically if a post-fix health check fails. * **Admin email breach check.** On a connected site, the plugin sends your WordPress admin email address to the TeraServer Clinic service, which checks it against known public data breaches and returns whether/how many breaches matched (not the breach data itself). * **Plugin/theme alternative & compatibility suggestions.** The plugin sends the slugs and versions of installed plugins/themes so the service can suggest actively- maintained alternatives or flag PHP/WordPress compatibility issues — no file contents are sent for this. Separately, and independent of the TeraServer Clinic connection above: * **Cloudflare Turnstile (opt-in, your own keys).** If you choose to turn on the optional captcha/bot-protection feature on the Security tab, you paste your own free Cloudflare Turnstile sitekey and secret key (obtained directly from Cloudflare, not from TeraServer Clinic). From then on, the login/comment/registration pages you enabled it for load Cloudflare’s Turnstile script (challenges.cloudflare. com), and each submission’s response token is sent to Cloudflare’s siteverify endpoint for validation. No data goes to TeraServer Clinic for this feature — only to Cloudflare, using your own account. See Cloudflare’s Privacy Policy ( https://www.cloudflare.com/privacypolicy/) for their handling of this data. If left off (the default), no data is ever sent to Cloudflare. All of the above only happens after you connect the plugin with a valid API key; a disconnected/inactive install sends nothing. See the TeraServer Clinic Terms of Service (https://wpclinic.ai/legal/terminos) and Privacy Policy (https://wpclinic. ai/legal/privacidad) for the full data-handling and retention terms. ## Screenshots [⌊Dashboard overview: plan, auto-update status, autoscan cadence, site health, and last scan result.⌉⌊Dashboard overview: plan, auto-update status, autoscan cadence, site health, and last scan result.⌉[ Dashboard overview: plan, auto-update status, autoscan cadence, site health, and last scan result. [⌊Cleanup: finds files, folders and database junk that nothing on your site references anymore, and moves them to a reversible quarantine (nothing is ever deleted outright).⌉⌊ Cleanup: finds files, folders and database junk that nothing on your site references anymore, and moves them to a reversible quarantine (nothing is ever deleted outright) .⌉[ Cleanup: finds files, folders and database junk that nothing on your site references anymore, and moves them to a reversible quarantine (nothing is ever deleted outright). [⌊Alerts / findings list with severity and file/location detail.⌉⌊Alerts / findings list with severity and file/location detail.⌉[ Alerts / findings list with severity and file/location detail. [⌊Harden: one-click, reversible WordPress security hardening (headers, XML-RPC, user enumeration, and more).⌉⌊Harden: one-click, reversible WordPress security hardening( headers, XML-RPC, user enumeration, and more).⌉[ Harden: one-click, reversible WordPress security hardening (headers, XML-RPC, user enumeration, and more). ## Installation 1. Upload the plugin to `/wp-content/plugins/teraserver-clinic`, or install it through the WordPress plugin screen directly. 2. Activate the plugin through the “Plugins” screen in WordPress. 3. Go to the new “TeraServer Clinic” menu item in your WordPress admin. 4. Create (or sign in to) a TeraServer Clinic account at wpclinic.ai, go to your account’s Plugin page, and copy the connection token. 5. Paste the token into the “Connect your site” form and submit. ## FAQ ### Is this plugin free? The plugin itself is free and licensed under the GPL. What it can do on your site depends on your TeraServer Clinic account plan: some features (autoscan cadence, auto-update, off-site backups, AI-assisted cleanup) are limited to paid plans; a scan is available on the free tier. ### Do I need an account? Yes. The plugin requires a TeraServer Clinic account and a connection token to do anything — without a valid connection, it stays inert and sends no data anywhere. ### What data does it send, and where? See “External services” above for the itemized list. In short: once connected, site identity/version/inventory and scan-finding metadata are always sent to the TeraServer Clinic service; full file contents are only sent for a bounded, already-flagged set of suspicious files (signature confirmation, on any tier) or for paid backup/ AI-cleanup features, and are not retained beyond producing that backup or fix. ### What runs on TeraServer Clinic’s server versus on my site? Scanning for malware, running WordPress/plugin/theme updates, and building backups all run locally on your own site (this plugin does the work). The TeraServer Clinic server keeps track of your entitlements/plan, stores scan history and off-site backups, confirms suspicious files against its own signature database, and — for AI-assisted cleanup — analyzes a flagged file and returns a proposed patch, which this plugin then applies locally using its own audited code (never a remote shell). ### How does this plugin update itself? This WordPress.org edition updates exactly like any other plugin listed on WordPress. org — through the WordPress.org plugin directory, using WordPress’s normal update mechanism. It does not check any other server for its own updates. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “TeraServer Clinic Scan & Repair Kit” is open source software. The following people have contributed to this plugin. Contributors * [ famelhaut ](https://profiles.wordpress.org/famelhaut/) [Translate “TeraServer Clinic Scan & Repair Kit” into your language.](https://translate.wordpress.org/projects/wp-plugins/teraserver-clinic) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/teraserver-clinic/), check out the [SVN repository](https://plugins.svn.wordpress.org/teraserver-clinic/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/teraserver-clinic/) by [RSS](https://plugins.trac.wordpress.org/log/teraserver-clinic/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.4.72 * Fixed: the “PHP still executes in uploads” fix instructions now detect your actual web server (Apache, nginx, LiteSpeed, or OpenLiteSpeed) and control panel instead of assuming nginx and Plesk — OpenLiteSpeed (common with CyberPanel) does not read .htaccess at all and needs a different fix, which is now shown. * Added: the Dashboard now always shows your detected web server (with version, when your server discloses it) and control panel, even when there is no problem to report. #### 0.4.70 * Cleanup: fixed a memory exhaustion that could stall restoring a large quarantined database item — restore now streams the snapshot row-by-row instead of loading it all at once. #### 0.4.64 * Cleanup: fixed the quarantine list not refreshing after an action, and failures now show as failures instead of a false “Done”. * Cleanup: database cleanup no longer requires a paid off-site backup — it works on all plans using a local, reversible snapshot. * Cleanup: warns if the quarantine folder is reachable from the internet on Nginx. #### 0.4.63 * Auto-updates, cleanup, and local backups are now free on all plans. * Consistent plugin naming throughout the admin UI. * Assets/scripts are now properly enqueued, and plugin writes moved to the uploads directory. #### 0.4.62 * Fixed the Cleanup tab not opening when clicked (it fell back to the Dashboard). #### 0.4.61 * WordPress.org submission build: the self-hosted update mechanism (used only by the direct-download edition of this plugin) is fully disabled in this edition; updates for this edition come only from the WordPress.org plugin directory. * Added an in-plugin external-services disclosure notice on the Dashboard tab, and this readme’s “External services” section. ## Meta * Version **0.6.3** * Last updated **24 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.0.2** * PHP version ** 7.2 or higher ** * Tags * [backup](https://wordpress.org/plugins/tags/backup/)[malware](https://wordpress.org/plugins/tags/malware/) [scanner](https://wordpress.org/plugins/tags/scanner/)[security](https://wordpress.org/plugins/tags/security/) [updates](https://wordpress.org/plugins/tags/updates/) * [Advanced View](https://wordpress.org/plugins/teraserver-clinic/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/teraserver-clinic/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/teraserver-clinic/reviews/) ## Contributors * [ famelhaut ](https://profiles.wordpress.org/famelhaut/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/teraserver-clinic/)