ClarityGuard
| 开发者 |
RFDizon
freemius |
|---|---|
| 更新时间 | 2026年10月19日 18:46 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Most security plugins tell you that something is wrong. ClarityGuard tells you what it means and what to do about it.
Free features:
- Outdated WordPress core / plugin detection
- Known-vulnerability lookup (optional, bring your own WPScan API token)
- File permission checks on key WordPress files/folders
- Publicly exposed file detection (debug logs, backup files, .env, etc.)
- Default "admin" username detection
- Weekly automated scan with an email summary
- Plain-English explanation and fix steps for every finding
- "Explain with AI" per finding and an AI-generated incident report, once you add your own Anthropic API key under AI Settings (fully optional -- everything else works with zero API keys)
- One-click, reversible auto-remediation for safe fixes
- AI-generated, client-ready incident reports
- Malware / file-integrity diffing with AI-assisted triage
- Multi-site agency dashboard
安装:
- Upload the
clarityguardfolder to/wp-content/plugins/. - Activate the plugin through the "Plugins" menu in WordPress.
- Go to "ClarityGuard" in the admin menu and click "Run Scan Now".
屏幕截图:
常见问题:
Does this replace Wordfence/Sucuri?
No — this is not a firewall or malware scanner replacement. It's a plain-English triage and remediation layer, and works well alongside a firewall plugin.
Does the free version require any API keys?
No. Every free-tier check runs entirely locally. The known-vulnerability lookup is optional and only runs if you add your own WPScan API token in settings.
更新日志:
0.5.5
- Fixed: the outdated-plugins check could keep reporting "no findings" even when updates were genuinely available, because it relied on WordPress core's own throttled update check (wp_update_plugins()), which silently reuses whatever it found on its last run for up to 12 hours -- including a stale empty result. "Run Scan Now" now forces a fresh check every time via delete_site_transient('update_plugins') before checking, so results are always live.
- Added Freemius licensing integration scaffold: CG_License::is_pro() now checks a live Freemius license first (once the SDK is installed and configured — see FREEMIUS-SETUP.md), falling back to the existing developer constant / filter seam so nothing changes for sites that don't have it configured yet.
- No visible changes for existing installs until Freemius credentials are added; this lays the groundwork for real Pro purchases/renewals instead of the CG_FORCE_PRO developer-only override.
- Added one-click Auto-Fix for safe, narrowly-scoped findings: file permission fixes (fully reversible via an Undo button), deleting known-safe exposed files (stock readme.html, debug.log), and plugin auto-updates.
- Every applied fix is written to an audit log (new cg_fix_log table) with before/after state, whether or not it's revertible.
- Deliberately left unfixable from here: the default-admin-username finding, core version updates, and CVE findings, plus .env / wp-config.php.bak (too risky to auto-delete something that might be the only copy of a needed secret/backup).
- AI layer is now provider-agnostic: choose Anthropic (Claude) or OpenAI on the AI Settings page. Existing v0.2.0 Anthropic keys keep working automatically.
- Added optional AI layer: per-finding "Explain with AI" and a one-click AI-generated incident report, backed by the Anthropic Messages API.
- New AI Settings page for the API key/model (or define CG_AI_API_KEY in wp-config.php to keep it out of the database).
- AI responses are cached (30 days) per finding/report so repeat views don't re-spend API calls.
- Initial MVP: core scanner, five checks, admin report page, weekly email summary.