Plugin renamed to Hanu Malware Guard (slug change) to comply with WordPress.org naming rules; adds bulk quarantine\/block actions for handling large numbers of findings at once.<\/p>","1.1.0":"
Adds login brute-force protection, a lightweight firewall, security headers, core file integrity checking, and an activity log. No breaking changes.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3707074,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3707074,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3707074,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3707074,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3707074,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.3","1.2.8"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3707074,"resolution":"1","location":"assets","locale":"","width":1622,"height":1118},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3707074,"resolution":"2","location":"assets","locale":"","width":1666,"height":2914},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3707074,"resolution":"3","location":"assets","locale":"","width":1622,"height":1991},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3707074,"resolution":"4","location":"assets","locale":"","width":1675,"height":650}},"screenshots":{"1":"Dashboard \u2014 scan summary, quick actions, and core integrity status.","2":"Scan Results \u2014 findings with severity, snippet, and quarantine\/ignore\/delete actions.","3":"Cron Monitor \u2014 flagged cron hooks with block\/trust actions.","4":"Login Security \u2014 active lockouts and recent failed attempts."}},"plugin_section":[],"plugin_tags":[8646,1174,1229,55021,600],"plugin_category":[54],"plugin_contributors":[282011],"plugin_business_model":[],"class_list":["post-369755","plugin","type-plugin","status-publish","hentry","plugin_tags-backdoor","plugin_tags-firewall","plugin_tags-login-security","plugin_tags-malware-scanner","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-hanuitsolutions","plugin_committers-hanuitsolutions"],"banners":{"banner":"https:\/\/ps.w.org\/hanu-malware-guard\/assets\/banner-772x250.png?rev=3707074","banner_2x":"https:\/\/ps.w.org\/hanu-malware-guard\/assets\/banner-1544x500.png?rev=3707074","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/hanu-malware-guard\/assets\/icon.svg?rev=3707074","icon":"https:\/\/ps.w.org\/hanu-malware-guard\/assets\/icon.svg?rev=3707074","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/hanu-malware-guard\/assets\/screenshot-1.png?rev=3707074","caption":"Dashboard \u2014 scan summary, quick actions, and core integrity status."},{"src":"https:\/\/ps.w.org\/hanu-malware-guard\/assets\/screenshot-2.png?rev=3707074","caption":"Scan Results \u2014 findings with severity, snippet, and quarantine\/ignore\/delete actions."},{"src":"https:\/\/ps.w.org\/hanu-malware-guard\/assets\/screenshot-3.png?rev=3707074","caption":"Cron Monitor \u2014 flagged cron hooks with block\/trust actions."},{"src":"https:\/\/ps.w.org\/hanu-malware-guard\/assets\/screenshot-4.png?rev=3707074","caption":"Login Security \u2014 active lockouts and recent failed attempts."}],"raw_content":"\n
Hanu Malware Guard is a self-contained WordPress security plugin covering eight areas:<\/p>\n\n
Malware Scanner<\/strong> \u2014 recursively scans themes, plugins, mu-plugins and uploads for a curated set of regex heuristics matching common backdoor\/webshell patterns (obfuscated eval(), webshell string signatures, command execution of user input, arbitrary file writes, etc). Any executable PHP-family file found inside File Integrity Monitor<\/strong> \u2014 hashes every scanned file and records a baseline. Later scans report files that are new, modified, or deleted since the previous pass, so you can see exactly what changed and when.<\/p><\/li>\n Cron Guard<\/strong> \u2014 catches cron-based persistence. WordPress fires whatever hook name is stored in its Login Brute-Force Lockout<\/strong> \u2014 locks out an IP\/username combination after too many failed logins within a configurable window. Runs as an early Firewall<\/strong> \u2014 blocks the handful of request patterns that account for most automated WordPress attacks: XML-RPC pingback amplification abuse (optional full XML-RPC disable), Security Headers<\/strong> \u2014 sends Core File Integrity Check<\/strong> \u2014 compares Activity Log<\/strong> \u2014 records logins (success\/failure\/lockout), new admin users and role escalations, plugin\/theme activation and switching, core\/plugin\/theme updates, and use of the built-in file editor, so you have a timeline of what changed and by whom.<\/p><\/li>\n<\/ol>\n\n Additional hardening options (Settings page): block PHP execution inside This plugin makes one outbound HTTP request, only when you run \"Check Core File Integrity\" (manually or via the daily scheduled scan): it calls the official WordPress.org checksums API at No security scanner can guarantee that, and you should be skeptical of any that claims to. The signature scanner and core-integrity checker produce heuristic matches for you to review \u2014 they are a strong starting point, not a certified clean bill of health. Always keep offline backups regardless.<\/p><\/dd>\n Inspect the snippet shown in Scan Results. Several signatures (obfuscated Not in real time \u2014 no WordPress plugin can intercept a file write at the PHP-engine level; that requires a hosting-level security layer. What it does is control cron scheduling<\/em> (block a hook so WordPress refuses to re-run it) and detect<\/em> file changes that happened around the same time as a suspicious cron run, so you can act quickly.<\/p><\/dd>\n Yes. XML-RPC authentication goes through the same core The query-string pattern check always exempts logged-in administrators, specifically so normal plugin\/editor use can never trigger a self-lockout. Only unauthenticated requests are checked against the SQLi\/path-traversal\/PHP-injection patterns.<\/p><\/dd>\n No. The only outbound request the plugin makes is to WordPress.org's own official checksums API, and only your WordPress version + locale are sent (see \"External services\" above). Everything else \u2014 scanning, hashing, cron auditing, login tracking \u2014 runs entirely on your own server.<\/p><\/dd>\n Nothing is left on disk. Quarantining a file reads its content into the database (base64-encoded, in the plugin's own scan_results table) and deletes the original \u2014 the file is gone from the filesystem the moment it's quarantined, not just hidden behind a protected folder. Uninstalling the plugin removes that table along with everything else, so if you want to keep a quarantined file's content for forensics, restore or export it before uninstalling.<\/p><\/dd>\n Use the plugin's support forum on WordPress.org, or email herry@hanuitsolutions.com.<\/p><\/dd>\n\n<\/dl>\n\n\nwp-content\/uploads<\/code> is flagged outright, since WordPress never legitimately places runnable code there.<\/p><\/li>\ncron<\/code> option regardless of whether any currently-loaded code registers a handler for it. Malware commonly schedules a job under an unfamiliar hook name and re-adds its own callback dynamically, so the job keeps firing even after the plugin\/theme file that \"owns\" it is deleted. Hanu Malware Guard snapshots every scheduled cron event on each page load, flags any hook with no currently registered callback<\/strong> (\"orphan\") or a randomly-generated-looking name, and lets you:<\/p>\n\n\n
pre_schedule_event<\/code> filter).<\/li>\nauthenticate<\/code> filter, so it covers both wp-login.php and XML-RPC logins (both authenticate through the same core wp_authenticate()<\/code> call). Manage active lockouts and view recent failed attempts on the Login Security page.<\/p><\/li>\n?author=N<\/code> and REST \/wp\/v2\/users<\/code> username enumeration, and requests whose URL contains obvious SQL-injection \/ path-traversal \/ PHP-injection strings. Logged-in administrators are always exempt from the query-string check so normal site use is never at risk of self-lockout. Blocked requests are logged on the Firewall page.<\/p><\/li>\nX-Content-Type-Options<\/code>, X-Frame-Options<\/code>, Referrer-Policy<\/code>, and a Content-Security-Policy: frame-ancestors 'self'<\/code> (clickjacking protection only \u2014 no script-src policy, since that reliably breaks themes\/page builders unless hand-tuned per site).<\/p><\/li>\nwp-admin<\/code>\/wp-includes<\/code> against the official checksums WordPress.org publishes for your exact version, and additionally flags any PHP file physically present in those folders that isn't part of the official manifest at all (a classic place to hide a backdoor, since admins assume \"core\" never changes). Findings appear in Scan Results alongside everything else.<\/p><\/li>\nwp-content\/uploads<\/code> (.htaccess\/web.config, with an Nginx snippet shown for reference), and disable the built-in wp-admin file editor.<\/p>\n\nExternal services<\/h4>\n\n
https:\/\/api.wordpress.org\/core\/checksums\/1.0\/?version={your WP version}&locale={your locale}<\/code> to fetch the known-good hash list for your exact WordPress version. No site data, file contents, or personal information is sent \u2014 only your WordPress version number and locale, which is required for the API to return the right checksum set. See the WordPress.org API documentation and privacy policy: https:\/\/wordpress.org\/about\/privacy\/. No other external service is contacted by this plugin.<\/p>\n\n\n\n
hanu-malware-guard<\/code> folder to \/wp-content\/plugins\/<\/code>, or install directly from the WordPress Plugin Directory.<\/li>\n\n
Will this definitely find every piece of malware on my site?<\/h3><\/dt>\n
I got a \"critical\" finding but I'm sure the file is legitimate \u2014 what now?<\/h3><\/dt>\n
eval()<\/code>, create_function()<\/code>, long base64 blobs) can legitimately appear in caching layers, minified vendor code, or some page builders. If you're confident it's a false positive, click \"Ignore\" rather than deleting the file. Auto-quarantine of critical findings is off by default for exactly this reason.<\/p><\/dd>\nCan it stop a malicious cron job from ever writing a file?<\/h3><\/dt>\n
Does the login lockout affect XML-RPC too?<\/h3><\/dt>\n
wp_authenticate()<\/code> function as the normal login form, so the same failed-attempt counter and lockout apply to both.<\/p><\/dd>\nWill the firewall lock me out of my own site?<\/h3><\/dt>\n
Does this send any of my data to a third party?<\/h3><\/dt>\n
What happens to quarantined files if I uninstall the plugin?<\/h3><\/dt>\n
Where can I get support?<\/h3><\/dt>\n
1.2.8<\/h4>\n\n
\n
1.2.7<\/h4>\n\n
\n
1.2.6<\/h4>\n\n
\n
phpcs:ignore<\/code> comment sat on the wrong physical line of a multi-line prepare() call and so wasn't actually suppressing anything. %i requires WordPress 6.2+, so the minimum supported version is now 6.2 (previously 6.0).<\/li>\nphpcs:ignore<\/code> on the file-editor's $_POST['file'] read, and added a missing phpcs:ignore<\/code> (with rationale) to the read-only $_GET check behind the settings-saved admin notice.<\/li>\n<\/ul>\n\n1.2.5<\/h4>\n\n
\n
1.2.4<\/h4>\n\n
\n
1.2.3<\/h4>\n\n
\n
1.2.2<\/h4>\n\n
\n
1.2.1<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n