Ironlatch Security Scanner & AI Agent Reviewer

Ironlatch Security Scanner & AI Agent Reviewer scans your site and shows what it found, with the evidence. Nothing changes until you approve it. Every protection is off when you install the plugin, so you choose what to turn on. Nothing runs in the background until you press Scan for the first time. After that, the scan repeats once a day. An optional connection, off by default, lets an outside AI agent review the findings through the plugin; it changes nothing until an administrator approves it. Scan One button runs the local hardening checks: HTTPS, WordPress updates, the admin login, debug display, the theme and plugin file editor, login monitoring, and more. Results are sorted into tabs, and each finding says what to open next. A passing check means that check didn't find the problem it looks for. It doesn't prove the site is clean. Malware scan. Every scan also looks for code shaped like web shells and injected malware. It reads plugins, themes, uploads and mu-plugins. It also reads folders WordPress doesn't list as a plugin or theme, plus loose PHP files in the site root and in wp-content. There are 63 local rules. 43 read the PHP code. The other 20 read the raw file, so files too big for the code rules still get checked, up to 2 MB. A bigger PHP file is listed as not checked. On a large site the scan keeps going in the background until it has read every file. A hit names the file, the line and the rule. Nothing gets deleted, and your files stay on your server. Files

• Integrity scan. Compares WordPress core and WordPress.org plugin files with the published checksums. Up to three WordPress.org themes are compared with their release ZIP. On a big site one pass may not reach them all, and the result says so. A changed file is different from the release, which doesn't make it malware. Custom and child themes stay "unknown".
• File scan. Reads PHP-like files in plugins, themes, and uploads with the same 63 local rules. A match shows the file, the line, and the rule, with a note on why it needs a look. A hit is suspected code, not proof of malware. Files never leave your server. The scan runs in short steps and picks up where it stopped. It stops for good after 50,000 files, 1 GiB, or 300 seconds of work.

Login and accounts All of these are off until you turn them on. Most are under Log In & Register. The hidden field and the breached-password check are turned on from Recommendations.

• Limit repeated sign-in attempts per address (record only, or limit).
• Turn off password sign-in through xmlrpc.php. Pingbacks are separate.
• Sign out signed-in users after 15, 30 or 60 minutes without activity.
• Hold new registrations until an administrator approves them.
• Email a six-digit sign-in code. A code expires after 10 minutes and stops working after five wrong tries.
• Ask a simple sum on the login form. This slows down basic bots. It isn't a CAPTCHA.
• Add a hidden field to the login form. Simple bots fill it in and get refused. People never see it, and there is nothing to tick.
• Check new and reset passwords against public breach data, and block administrators whose password shows up there (see External services).
• Password rules, session lists, and an email to an administrator when they sign in (at most once an hour).

You need HTTPS and your password to end sessions or change some Traffic settings. If you get locked out, run wp ironlatch-security-scanner login disable from WP-CLI on the server. It turns off every sign-in check above. Accounts waiting for approval stay waiting. Traffic Hostname, browser and referrer block lists, a live request log, hotlink protection, comment and registration limits, REST rate controls, manual network rules, a security headers check, and trusted proxy settings. Each blocking control stays off until you save it, and each can be turned off from WP-CLI. wp ironlatch-security-scanner traffic disable turns off the block lists, live log, hotlink protection, precise blocks and comment checks. bots disable, rest-rates disable, network disable and proxies disable cover the rest. The security headers check reads your homepage's response headers and lists the missing ones. It doesn't add headers. The REST request watch is on from the start. It only records matches, on your server, and doesn't block requests. Set IRONLATCH_DISABLE_FIREWALL to true in wp-config.php to stop it. Notifications Optional emails for changed files, suspicious PHP matches, and high-severity plugin vulnerabilities, plus a weekly digest. They use your site's WordPress mail and go to the admin email. Both are off by default. AI agent access (MCP) Off by default. On WordPress 6.9 or newer, with the official MCP Adapter plugin installed, an administrator can let an AI agent list findings, run the local hardening checks, and propose a sign-in limit change. A proposal changes nothing until an administrator approves it in wp-admin. What this plugin doesn't do

• It doesn't have a maintained malware signature feed. Patterns update with plugin releases.
• It doesn't change plugin, theme or core files. When a file differs from its release, reinstall that plugin or theme from Plugins or Appearance, or reinstall WordPress from Dashboard > Updates.
• Scheduled scans run on WP-Cron, which needs site traffic. A quiet site may run them late.

0.1.12

• New display title: Ironlatch Security Scanner & AI Agent Reviewer. The optional AI agent connection (off by default) is described the same way in the readme and inside the plugin. Wording only; settings and saved options are unchanged.

0.1.11

• The admin menu icon is now a shield with a padlock instead of the stock WordPress shield. It follows your admin color scheme.

0.1.10

• The logo in the admin header now matches the plugin icon (shield with a padlock). The decorative logo no longer carries the old brand name as alt text.

0.1.9

• New display title: Ironlatch Security Scanner & AI Assistant Reviewer. The optional AI assistant connection (off by default) is named in the description. No code changes.

0.1.8

• The database tables for fixes, login limits, traffic and activity are now checked after they are created. The schema version is saved only when every table exists, so a failed install is retried on the next load.
• Passwords typed into the plugin's forms are validated (text, valid encoding, no control characters, length limit) and used exactly as typed. Weak-password checks now reject a password they cannot read instead of skipping it.
• List fields in the network and REST rate settings are sanitized item by item with core helpers.

0.1.7

• Plugin, content, mu-plugin and site folders are now located through one helper instead of scattered path constants. The robots.txt check builds its admin and Ajax paths with admin_url().
• Removed the one-click "hide error details" setting. The check now tells you to set WP_DEBUG_DISPLAY in wp-config.php yourself.
• The "turn off the file editor" setting now blocks only the editor capabilities instead of defining a global constant.
• Admin forms check the nonce and capability before they read any input, and every request value is read and sanitized one key at a time.

0.1.6

• Renamed to Ironlatch Security Scanner (slug ironlatch-security-scanner). The command is now wp ironlatch-security-scanner.

0.1.2

• Removed the file repair and recovery tools that replaced, moved or chmodded site files. Scans still report changed files.
• Theme release ZIPs are now downloaded with WordPress's download_url().

0.1.1

• Removed the unused passkey code and the bundled WebAuthn library. Passkey status for other plugins is still reported.

0.1.0

• First release: local hardening scan, file integrity and pattern scans, reviewed file repair, opt-in vulnerability lookups, login and traffic protection, and email notifications.