Forvault Security
| 开发者 | abocchetti |
|---|---|
| 更新时间 | 2026年7月12日 03:42 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Malware Scan — Heuristically inspects every PHP file for web-shell and backdoor indicators: encoded payloads passed to
eval, request input invoked as a function, OS command execution, known shell-family marker strings, packed/obfuscated blobs, executable PHP insidewp-content/uploads/, and more. Each suspicious file is scored and reported with the exact path and line numbers. Comments and docblocks are stripped before matching, and strong vs. supporting signals are separated to reduce false positives. Findings are advisory heuristics — review each flagged file. - Core Integrity — Verifies every WordPress core file against the official checksum manifest for your exact version and locale (from api.wordpress.org). Reports modified core files, missing core files, and unknown files hiding inside
wp-admin/orwp-includes/. No prior snapshot is required, so it works even on an already-compromised site. - File Baseline — Fingerprints your plugins, themes, mu-plugins and uploads with SHA-256 and stores the inventory. Re-check at any time to see exactly which files were added, modified or removed since the snapshot. This covers the code that has no official manifest.
安装:
- Upload the
forvault-securityfolder to/wp-content/plugins/, or install it from the Plugins screen in your WordPress dashboard. - Activate the plugin through the Plugins menu in WordPress.
- Open Forvault Security in the admin sidebar.
- Run a Malware Scan and Core Integrity check, and take a File Baseline while the site is clean so you can detect future changes.
屏幕截图:
常见问题:
Will this plugin modify or delete any of my files?
No. Every feature is strictly read-only. The scanner reads file contents to analyze them but never edits, moves, deletes or executes them. The baseline only stores hashes.
Are the malware findings definitive?
No. The Malware Scan uses scored heuristics, the same approach as tools like php-malware-finder or a YARA pass. A high score means a file deserves review, not that it is certainly malicious. Always inspect a flagged file before taking action.
Does it run scans automatically in the background?
No. The free plugin only scans when you click a button, and it does no work on public page loads. Scheduled/automatic scanning is offered by the separate premium add-on.
What WordPress versions can Core Integrity verify?
Any version published on WordPress.org. The check downloads the official manifest for your exact version and locale at the moment you run it.
Do I need the premium add-on?
No. All three scanners are complete and free. The premium add-on is optional and adds response/monitoring tooling.
更新日志:
- Initial release: Malware Scan (heuristic web-shell detection), Core Integrity (official checksum verification) and File Baseline (SHA-256 change detection).