Site Security Auditor – Plugin & File Checks

Site Security Auditor gives WordPress administrators a practical security review dashboard. See plugin update information, compare plugin and theme files against a trusted snapshot, and understand which settings deserve attention. Open Tools → Security Audit to start. Each section explains what it checks, what the result means, and what to do next. It is designed for routine maintenance and investigating unexpected file changes, without automatically editing your site. What you can do

• Review plugin updates: see available updates, inactive plugins and missing or stale update information. Open the familiar WordPress update screen to take action.
• Compare files: save a trusted SHA-256 baseline, then identify added, modified and removed code files in plugin and theme directories.
• Return to your latest report: the most recent file check stays visible with its timestamp and file count. Simply opening the dashboard does not start another scan.
• Download a file report: export the latest result as JSON to review with your developer or host.
• Follow a plain-language checklist: review HTTPS configuration, dashboard code editing and WordPress debug display, with links to Site Health and official guidance.
• Use a responsive dashboard: clear sections, keyboard-accessible controls and a scrollable plugin table on small screens.

A useful maintenance routine

1. Review available updates and take a backup.
2. Confirm your files are trustworthy before saving the first baseline.
3. Run a comparison after maintenance or when investigating changes.
4. Match changed files to intentional updates or edits.
5. Replace the baseline only after reviewing and trusting the current files.

A baseline records the current state; it does not prove that state is clean. Keep independent backups and ask a trusted professional about unexplained changes. Scope and limitations New baselines cover PHP, PHP7, PHTML, INC, TWIG, JSON, JS and CSS files inside the configured plugin directory and registered theme directories. WordPress core, uploads, must-use plugins, database content and other file types are excluded. Symbolic links are not followed and cause an incomplete result. Each run is bounded to 20,000 directory entries, 100 MiB of file data, 8 MiB per file and an approximately 8-second processing budget. Unreadable files or exceeded limits produce an incomplete report. Incomplete scans never replace a baseline or present a partial comparison as complete. Large sites may need a host-level integrity tool. Avoid editing files or running updates during a scan. This plugin is not a malware scanner, firewall or vulnerability database. It does not repair files, guarantee security, or certify a plugin as safe. An update or legitimate edit can change a file; unchanged files can still contain problems. Privacy and performance No account, API key, telemetry or additional remote metadata requests are required. The dashboard uses the update information already maintained by WordPress; WordPress itself may contact its normal update services. File hashes, relative paths, baseline time and the latest file report are stored in the site's options, without autoloading them. Reports are restricted to administrators; on multisite they require a network administrator. Downloaded reports contain relative file paths, so share them only with trusted people. Deactivation and deletion preserve these records to avoid silently discarding your trusted reference.

1. Install Site Security Auditor from Plugins → Add New, or upload the plugin ZIP.
2. Activate the plugin.
3. Open Tools → Security Audit using an administrator account.
4. Read the baseline warning, confirm that you trust the current files, and choose Save trusted baseline.
5. Return and select Compare files now to review changes.

On multisite, a network administrator can open the dashboard from a site's Tools menu. Baselines and reports are stored per site, while plugin and theme files may be shared across the network.

1.4.0

• New responsive dashboard, guided baseline workflow and actionable security checklist.
• Save the latest file report and download it as JSON.
• Run scans only through authenticated, nonce-protected POST actions.
• Preserve baselines when scans are incomplete; add resource limits and explicit coverage warnings.
• Include JS and CSS in new baselines while preserving legacy comparison scope.
• Use cached WordPress update data instead of per-plugin remote lookups on dashboard views.
• Recognize network-active plugins and restrict multisite access to network administrators.
• Refresh directory branding, documentation, screenshots and release metadata.

1.0

• Initial dashboard for plugin information, file baselines and hardening checks.