{"id":364579,"date":"2026-09-06T20:31:48","date_gmt":"2026-09-06T20:31:48","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/lockgate-exposure-scanner\/"},"modified":"2026-09-07T22:26:10","modified_gmt":"2026-09-07T22:26:10","slug":"lockgate-exposure-scanner","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/lockgate-exposure-scanner\/","author":23554852,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.1.0","stable_tag":"1.1.0","tested":"7.1","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"Lockgate Exposure Scanner","header_author":"Oddeven Infotech Private Limited","header_description":"Scans the comments, profiles and posts already on your site and reports what an AI assistant would be handed if it read them. Read-only: nothing is modified, moderated or deleted.","assets_banners_color":"393e42","last_updated":"2026-09-07 22:26:10","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/oddeveninfotech.com\/plugins\/lockgate-exposure-scanner\/","header_author_uri":"https:\/\/oddeveninfotech.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":71,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"oddeveninfotech","date":"2026-09-06 20:31:35","revision":3683940},"1.1.0":{"tag":"1.1.0","author":"oddeveninfotech","date":"2026-09-07 22:26:10","revision":3685683}},"upgrade_notice":{"1.1.0":"<p>Adds a check for tool-call syntax in stored content. Still read-only, still no external connections.<\/p>","1.0.0":"<p>First release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3683940,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3683940,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3683940,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3683940,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3683940,"resolution":"1","location":"assets","locale":"","width":1120,"height":298},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3683940,"resolution":"2","location":"assets","locale":"","width":1120,"height":361},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3683940,"resolution":"3","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"The scan screen before running.","2":"Progress while scanning.","3":"Results, with findings and escaped excerpts."}},"plugin_section":[],"plugin_tags":[2353,1320,107,279462,600],"plugin_category":[44,54],"plugin_contributors":[279035],"plugin_business_model":[],"class_list":["post-364579","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-assistant","plugin_tags-comments","plugin_tags-prompt-injection","plugin_tags-security","plugin_category-discussion-and-community","plugin_category-security-and-spam-protection","plugin_contributors-oddeveninfotech","plugin_committers-oddeveninfotech"],"banners":{"banner":"https:\/\/ps.w.org\/lockgate-exposure-scanner\/assets\/banner-772x250.png?rev=3683940","banner_2x":"https:\/\/ps.w.org\/lockgate-exposure-scanner\/assets\/banner-1544x500.png?rev=3683940","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/lockgate-exposure-scanner\/assets\/icon-128x128.png?rev=3683940","icon_2x":"https:\/\/ps.w.org\/lockgate-exposure-scanner\/assets\/icon-256x256.png?rev=3683940","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/lockgate-exposure-scanner\/assets\/screenshot-1.png?rev=3683940","caption":"The scan screen before running."},{"src":"https:\/\/ps.w.org\/lockgate-exposure-scanner\/assets\/screenshot-2.png?rev=3683940","caption":"Progress while scanning."},{"src":"https:\/\/ps.w.org\/lockgate-exposure-scanner\/assets\/screenshot-3.png?rev=3683940","caption":"Results, with findings and escaped excerpts."}],"raw_content":"<!--section=description-->\n<p>AI assistants are increasingly connected to WordPress sites \u2014 to triage comments, summarise form entries, or check orders. When that happens, the assistant reads your stored content directly.<\/p>\n\n<p>Most of that content was written by people you have never met. Comments, contact form entries, profile biographies and product reviews are, by design, things strangers can write without an account and without review. None of it was written with an assistant in mind, and some of it may have been written specifically to steer one.<\/p>\n\n<p>This plugin reads what is already stored on your site and tells you what an assistant would be handed.<\/p>\n\n<h4>What it reads<\/h4>\n\n<p>Every comment, including the spam and trash queues nobody reviews. Every user profile. Every post, page and public custom post type.<\/p>\n\n<p>Entries held by contact form, membership or e-commerce plugins in their own database tables are <strong>not<\/strong> read. Each of those stores its data differently, and guessing at their table layouts would mean either missing entries or reporting on the wrong rows.<\/p>\n\n<h4>What it looks for<\/h4>\n\n<ul>\n<li><strong>Invisible characters<\/strong> \u2014 zero-width and bidirectional control characters, and the Unicode TAG block, which can hide readable instructions inside text that looks perfectly ordinary to you.<\/li>\n<li><strong>Instructions aimed at an assistant<\/strong> \u2014 chat-template control tokens, fake system messages, and text asking an assistant to conceal something from you.<\/li>\n<li><strong>Content hidden with CSS<\/strong> \u2014 text set to <code>display:none<\/code>, zero font size, or positioned off-screen. Invisible when you review the comment; fully readable to an assistant.<\/li>\n<li><strong>Ways of sending data out<\/strong> \u2014 image links to external servers, and instructions to post data to a URL. The comment author\u2019s website field is read along with the body: it is attacker-controlled, it is handed to an assistant with everything else, and it is the oldest link-smuggling field WordPress has.<\/li>\n<li><strong>Tool-call syntax<\/strong> \u2014 the markup an assistant uses to call a tool or to receive a result, written into a comment. A forged <em>result<\/em> is rated above a forged call: a call can be refused, while a result claims something already happened and an assistant cannot tell it from its own tool output.<\/li>\n<li><strong>Mentions of your own site's tools<\/strong> \u2014 if the Abilities API is present, content naming a tool registered on <em>your<\/em> site is flagged. Nobody types those names into a comment box by accident.<\/li>\n<\/ul>\n\n<h4>Who wrote it matters<\/h4>\n\n<p>Every item is resolved to its author, and the author's capabilities decide how carefully it is examined. An administrator's own words are not scanned. A comment from someone with no account is always scanned.<\/p>\n\n<p>That distinction is only possible from inside WordPress. Tools that sit between your site and an assistant see a block of text and have to guess.<\/p>\n\n<h4>Honest limitations<\/h4>\n\n<p>Prompt injection is an unsolved problem and this plugin does not solve it.<\/p>\n\n<p>These are pattern-based checks. They find techniques that are currently common and that a person reviewing content cannot see. They will miss things. <strong>A clean result means these checks found nothing \u2014 not that your site is safe.<\/strong><\/p>\n\n<p>The plugin reports; it does not protect. It does not block anything, does not change how your site behaves, and does not sit between an assistant and your data.<\/p>\n\n<h4>Read-only and entirely local<\/h4>\n\n<ul>\n<li>Runs <code>SELECT<\/code> queries only. Nothing is modified, moderated or deleted.<\/li>\n<li>Makes <strong>no external connections<\/strong>. No analytics, no phoning home, no account.<\/li>\n<li>Nothing about your content leaves your server.<\/li>\n<li>Results are stored in a single option and removed when you deactivate the plugin.<\/li>\n<\/ul>\n\n<h4>Continuous protection<\/h4>\n\n<p>This scanner looks at content that is already stored. If you want content checked at the moment an assistant reads it, with provenance tagging and an audit trail, that is <a href=\"https:\/\/oddeveninfotech.com\/plugins\/lockgate\/\">Lockgate<\/a>, a separate commercial plugin from the same authors. This one works on its own and always will.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate the plugin.<\/li>\n<li>Go to <strong>Tools \u2192 Agent Exposure<\/strong>.<\/li>\n<li>Click <strong>Scan my site<\/strong>.<\/li>\n<\/ol>\n\n<p>The scan runs in batches while the page is open. Closing the tab pauses it; reopening the screen carries on from where it stopped. Nothing runs in the background and nothing is scheduled.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20change%20or%20delete%20any%20of%20my%20content%3F\"><h3>Does this change or delete any of my content?<\/h3><\/dt>\n<dd><p>No. It only reads. There is no code path in this plugin that writes to your posts, comments or users.<\/p><\/dd>\n<dt id=\"does%20it%20send%20my%20content%20anywhere%3F\"><h3>Does it send my content anywhere?<\/h3><\/dt>\n<dd><p>No. The plugin makes no external connections of any kind. Everything happens on your own server.<\/p><\/dd>\n<dt id=\"will%20it%20slow%20down%20my%20site%3F\"><h3>Will it slow down my site?<\/h3><\/dt>\n<dd><p>No. Nothing runs on the front end. The scan only runs while you are on its admin screen, in small batches so it does not exhaust your host's limits.<\/p><\/dd>\n<dt id=\"i%20have%20thousands%20of%20comments.%20is%20that%20a%20problem%3F\"><h3>I have thousands of comments. Is that a problem?<\/h3><\/dt>\n<dd><p>No. The scan is batched and resumable. You can stop it at any time, and reopening the page picks up where it left off.<\/p><\/dd>\n<dt id=\"it%20found%20nothing.%20am%20i%20safe%3F\"><h3>It found nothing. Am I safe?<\/h3><\/dt>\n<dd><p>It means these checks found nothing in your stored content. It does not mean your site is safe. No pattern-based tool catches every technique, and this one is deliberately conservative to avoid flagging ordinary comments.<\/p><\/dd>\n<dt id=\"it%20flagged%20a%20comment%20that%20looks%20harmless.\"><h3>It flagged a comment that looks harmless.<\/h3><\/dt>\n<dd><p>That happens most often with content <em>about<\/em> prompt injection \u2014 a post explaining the attack, or a support thread quoting an example. The checks cannot always distinguish writing about a technique from using it. Findings are information for you to judge, not a verdict.<\/p><\/dd>\n<dt id=\"does%20this%20need%20the%20abilities%20api%20or%20an%20mcp%20plugin%3F\"><h3>Does this need the Abilities API or an MCP plugin?<\/h3><\/dt>\n<dd><p>No. It is useful on any site. If the Abilities API is present, one extra check becomes available: content naming a tool registered on your site.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>New check: tool-call syntax. Reports content carrying the markup an assistant uses to invoke a tool or to receive a result \u2014 forged tool results, invocation blocks, MCP tool ids and tool-call structures.<\/li>\n<li>Naming an assistant is never a finding on its own. The check looks for the syntax, not for the word \"ChatGPT\", so ordinary writing about AI is not flagged.<\/li>\n<li>Tool-call syntax now corroborates an ambiguous phrase. \"Ignore all previous instructions\" stays medium on its own and is raised beside a tool call.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release.<\/li>\n<\/ul>","raw_excerpt":"Scans the comments, profiles and posts already on your site and reports what an AI assistant would be handed if it read them. Read-only.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/364579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=364579"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/oddeveninfotech"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=364579"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=364579"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=364579"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=364579"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=364579"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=364579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}