{"id":394838,"date":"2026-11-04T03:16:31","date_gmt":"2026-11-04T03:16:31","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/brix-security-monitor\/"},"modified":"2026-11-04T03:16:21","modified_gmt":"2026-11-04T03:16:21","slug":"aviiimageworks-security-monitor","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/aviiimageworks-security-monitor\/","author":23595189,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"4.1.2","stable_tag":"4.1.2","tested":"7.1.4","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Aviiimageworks Security Monitor","header_author":"AVII IMAGEWORKS","header_description":"Detection-first integrity and malware monitoring for WordPress with bounded local scans and optional core checksum verification.","assets_banners_color":"","last_updated":"2026-11-04 03:16:21","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/avii.jp\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":46,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"4.1.2":{"tag":"4.1.2","author":"aviiimageworks","date":"2026-11-04 03:16:21","revision":3783026}},"upgrade_notice":{"4.1.2":"<p>This directory edition is detection-only. Review the new consent settings after updating.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["4.1.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[17245,168808,55021,5603,600],"plugin_category":[54],"plugin_contributors":[290630],"plugin_business_model":[],"class_list":["post-394838","plugin","type-plugin","status-publish","hentry","plugin_tags-checksum","plugin_tags-file-integrity","plugin_tags-malware-scanner","plugin_tags-monitoring","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-aviiimageworks","plugin_committers-aviiimageworks"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/aviiimageworks-security-monitor.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Aviiimageworks Security Monitor is a detection-first security suite for WordPress. Its standalone Aviiimageworks Security menu brings together a dashboard, application-firewall monitoring, bounded integrity scanning, a local evidence vault, security reports, and granular module settings.<\/p>\n\n<p>The plugin does not delete, quarantine, rewrite, repair, or change scanned files. Findings are stored locally in the WordPress database and shown only to administrators. Retention can be set to 7, 30, 60, or 90 days.<\/p>\n\n<h4>Features<\/h4>\n\n<ul>\n<li>Non-destructive scans of PHP files in plugins, themes, and uploads.<\/li>\n<li>Conservative signatures for common web shells and encoded payloads.<\/li>\n<li>Bounded scans with file-count and file-size safety limits.<\/li>\n<li>Optional WordPress.org core checksum verification.<\/li>\n<li>Production configuration checks for debug output, file editing, and wp-config.php permissions.<\/li>\n<li>Monitor-only request inspection for high-confidence injection, script, traversal, and remote-file probes.<\/li>\n<li>Failed administrator-login and XML-RPC activity monitoring.<\/li>\n<li>New-user, role-change, plugin, theme, upload, and comment security signals.<\/li>\n<li>Selected database URL checks for unexpected off-site redirects.<\/li>\n<li>Standalone dashboard, Firewall &amp; WAF, Scanner &amp; Vault, Reports, and Settings screens.<\/li>\n<li>CSV security-evidence exports.<\/li>\n<li>Daily scheduled scans and manual scans.<\/li>\n<li>Optional email summaries through the site's configured WordPress mail system.<\/li>\n<li>Explicit data-removal option for uninstall.<\/li>\n<\/ul>\n\n<h4>Safety model<\/h4>\n\n<p>Aviiimageworks Security Monitor reports suspicious indicators for administrator review. A finding is not proof that a request, file, account, or site is malicious. The plugin never performs automatic remediation and does not promise that a site is secure or free from malware.<\/p>\n\n<p>Always review findings with a qualified administrator and create a verified backup before changing site files.<\/p>\n\n<h4>Privacy<\/h4>\n\n<p>By default, the plugin:<\/p>\n\n<ul>\n<li>Performs local scans only.<\/li>\n<li>Stores file-relative paths, signature identifiers, severity, details, and timestamps in the local WordPress database.<\/li>\n<li>Does not transmit findings, file contents, IP addresses, usernames, or site data to AVII IMAGEWORKS.<\/li>\n<li>Does not enable email notifications.<\/li>\n<\/ul>\n\n<p>Administrators may explicitly enable email summaries. Those messages are sent through the WordPress site's configured mail system to the address entered in plugin settings. AVII IMAGEWORKS does not receive them unless the administrator deliberately enters an AVII IMAGEWORKS address.<\/p>\n\n<p>Stored findings older than 30 days are removed automatically. Administrators can clear findings at any time. Plugin data is retained on uninstall by default; an administrator can opt in to deletion before uninstalling.<\/p>\n\n<h4>External services<\/h4>\n\n<p>The optional core checksum feature contacts the official WordPress.org checksum API at <code>https:\/\/api.wordpress.org\/core\/checksums\/1.0\/<\/code>.<\/p>\n\n<p>This request sends the installed WordPress version, site locale, normal HTTP connection metadata, and a user-agent containing the plugin version and site URL. WordPress.org returns expected checksums for WordPress core files. No file contents or scan findings are sent. The feature is disabled by default and runs only after an administrator enables it.<\/p>\n\n<p>WordPress.org privacy policy: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>aviiimageworks-security-monitor<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install the ZIP through Plugins &gt; Add New &gt; Upload Plugin.<\/li>\n<li>Activate Aviiimageworks Security Monitor.<\/li>\n<li>Open the standalone Aviiimageworks Security menu.<\/li>\n<li>Review the consent-based settings and run the first non-destructive scan.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20the%20plugin%20remove%20malware%20automatically%3F\"><h3>Does the plugin remove malware automatically?<\/h3><\/dt>\n<dd><p>No. It records indicators for administrator review and never modifies scanned files.<\/p><\/dd>\n<dt id=\"does%20the%20firewall%20%26%20waf%20screen%20block%20visitors%3F\"><h3>Does the Firewall &amp; WAF screen block visitors?<\/h3><\/dt>\n<dd><p>No. The WordPress.org edition is deliberately monitor-only. It records a small set of high-confidence request indicators and avoids automatic blocking that could lock out legitimate visitors.<\/p><\/dd>\n<dt id=\"does%20avii%20imageworks%20receive%20my%20scan%20results%3F\"><h3>Does AVII IMAGEWORKS receive my scan results?<\/h3><\/dt>\n<dd><p>No. Findings remain in your WordPress database. Email summaries are disabled by default and use your site's configured mail system only after you opt in.<\/p><\/dd>\n<dt id=\"why%20is%20core%20checksum%20verification%20optional%3F\"><h3>Why is core checksum verification optional?<\/h3><\/dt>\n<dd><p>It requires a request to the official WordPress.org checksum service. The setting is opt-in so administrators can decide whether that external request is appropriate for their site.<\/p><\/dd>\n<dt id=\"can%20a%20finding%20be%20a%20false%20positive%3F\"><h3>Can a finding be a false positive?<\/h3><\/dt>\n<dd><p>Yes. Security signatures identify suspicious patterns, not intent. Review the file and its source before taking action.<\/p><\/dd>\n<dt id=\"does%20this%20plugin%20replace%20backups%20or%20professional%20incident%20response%3F\"><h3>Does this plugin replace backups or professional incident response?<\/h3><\/dt>\n<dd><p>No. Maintain tested backups and use a qualified professional when compromise is suspected.<\/p><\/dd>\n<dt id=\"is%20a%20license%20key%20required%3F\"><h3>Is a license key required?<\/h3><\/dt>\n<dd><p>No. Every feature in this WordPress.org edition works without a license key. Future paid services or add-ons may be distributed separately, but they do not disable the features included here.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>4.1.2<\/h4>\n\n<ul>\n<li>Renamed the WordPress.org edition to Aviiimageworks Security Monitor and adopted the distinctive AVIIIMAGEWORKS_SM code and data prefix.<\/li>\n<li>Rebuilt the public-directory edition around non-destructive monitoring.<\/li>\n<li>Removed automatic repair, deletion, quarantine, request blocking, and server-key inspection.<\/li>\n<li>Removed commercial licensing controls and all third-party alert defaults.<\/li>\n<li>Made WordPress.org checksum verification and email summaries explicit opt-ins.<\/li>\n<li>Added a standalone Aviiimageworks Security menu with Dashboard, Firewall &amp; WAF, Scanner &amp; Vault, Reports, and Settings screens.<\/li>\n<li>Added request, login, account, role, extension, upload, XML-RPC, comment, and database redirect monitors.<\/li>\n<li>Added bounded scanning, configurable local retention, CSV reports, privacy documentation, internationalization, and uninstall handling.<\/li>\n<\/ul>","raw_excerpt":"Monitor WordPress integrity, suspicious requests, login activity, users, extensions, uploads, and configuration from one security dashboard.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/394838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=394838"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/aviiimageworks"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=394838"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=394838"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=394838"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=394838"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=394838"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=394838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}