AiutoComputerHelp Persistence Audit
| 开发者 | aiutocomputerhelp |
|---|---|
| 更新时间 | 2026年10月13日 20:39 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
AiutoComputerHelp Persistence Audit is a read-only security auditing plugin focused on mechanisms that can maintain, restore or recreate persistent code in a WordPress installation.
The plugin examines multiple persistence-relevant layers and correlates related artifacts instead of treating an isolated indicator as proof of compromise.
Current audit areas include:
- bootstrap configuration and selected drop-ins;
- MU-plugins;
- database options and transients;
- WordPress Cron;
- the root .htaccess file;
- administrator account metadata;
- registered REST route metadata;
- targeted filesystem anomalies inside the current WordPress installation;
- cross-layer correlation of meaningful artifacts and identifiers.
安装:
- Upload the plugin ZIP from Plugins > Add New > Upload Plugin, or install it from the WordPress Plugin Directory when available.
- Activate AiutoComputerHelp Persistence Audit.
- Open the plugin audit screen in the WordPress administration area.
- Select the filesystem traversal depth and candidate budget.
- Run the audit and review findings in context.
常见问题:
Does the plugin remove malware or repair the site?
No. It is intentionally read-only. It identifies and correlates persistence-relevant evidence for manual review.
Does a Review or Warning mean the site is compromised?
No. Findings are heuristic and contextual. Legitimate plugins, hosting rules and administrative activity can produce similar indicators.
Does the plugin send data outside the site?
No. The audit runs locally and does not send scan results to external services.
Does Deep+ scan every file content?
No. Deep+ performs extensive directory traversal, while metadata rules select candidate files for bounded content inspection. The candidate budget limits candidate inspection, not traversal time.
Does the plugin follow symbolic links?
No.
Can I stop a filesystem scan?
Yes. The scan can be stopped from the audit interface. Partial results remain visible and the report is marked incomplete.
更新日志:
1.0.1
- Determine WordPress, content, plugin, MU-plugin and administration locations through WordPress APIs and plugin-relative helpers for broader installation compatibility.
- First public release.
- Read-only persistence audit across bootstrap, MU-plugins, options/transients, Cron, .htaccess, users, REST metadata and targeted filesystem anomalies.
- Cross-layer correlation of meaningful artifacts and identifiers.
- Safe bounded previews with secret redaction.
- Standard, Deep and Deep+ filesystem traversal modes with separate candidate budgets.
- User-controlled scan cancellation and live traversal counters.
- Conservative handling of normal feed transients, migration-style filenames and generic correlation artifacts.