Description
AiutoComputerHelp Persistence Audit is a read-only security auditing plugin focused on mechanisms that can maintain, restore or recreate persistent code in a WordPress installation.
The plugin examines multiple persistence-relevant layers and correlates related artifacts instead of treating an isolated indicator as proof of compromise.
Current audit areas include:
- bootstrap configuration and selected drop-ins;
- MU-plugins;
- database options and transients;
- WordPress Cron;
- the root .htaccess file;
- administrator account metadata;
- registered REST route metadata;
- targeted filesystem anomalies inside the current WordPress installation;
- cross-layer correlation of meaningful artifacts and identifiers.
Findings use four levels: Pass, Info, Review and Warning. A Review or Warning means that the observed evidence deserves investigation; it does not by itself prove malware or compromise.
The filesystem scan offers Standard, Deep and Deep+ traversal modes. Candidate budget limits content inspection only. Deep+ performs much broader directory traversal and can take one minute or more on large installations or shared hosting.
Read-only and privacy design
The plugin does not remove files, modify the database, alter configuration, disable plugins, delete cron events, reset users, execute detected payloads or call suspicious REST endpoints.
It does not send scan results to external services and does not use external reputation APIs.
Filesystem inspection is limited to the current WordPress installation and symbolic links are not followed. Safe previews are bounded and redact common secrets such as database credentials, salts, tokens and authorization values.
Base64 content, when inspected, is decoded only for bounded static analysis and is never evaluated, included or executed.
Captures d’écran
Installation
- Upload the plugin ZIP from Plugins > Add New > Upload Plugin, or install it from the WordPress Plugin Directory when available.
- Activate AiutoComputerHelp Persistence Audit.
- Open the plugin audit screen in the WordPress administration area.
- Select the filesystem traversal depth and candidate budget.
- Run the audit and review findings in context.
For routine checks, Standard traversal is recommended. Deep and Deep+ are intended for broader incident review and may take considerably longer.
FAQ
-
Does the plugin remove malware or repair the site?
-
No. It is intentionally read-only. It identifies and correlates persistence-relevant evidence for manual review.
-
Does a Review or Warning mean the site is compromised?
-
No. Findings are heuristic and contextual. Legitimate plugins, hosting rules and administrative activity can produce similar indicators.
-
Does the plugin send data outside the site?
-
No. The audit runs locally and does not send scan results to external services.
-
Does Deep+ scan every file content?
-
No. Deep+ performs extensive directory traversal, while metadata rules select candidate files for bounded content inspection. The candidate budget limits candidate inspection, not traversal time.
-
Does the plugin follow symbolic links?
-
No.
-
Can I stop a filesystem scan?
-
Yes. The scan can be stopped from the audit interface. Partial results remain visible and the report is marked incomplete.
Avis
Il n’y a aucun avis pour cette extension.
Contributeurs & développeurs
« AiutoComputerHelp Persistence Audit » est un logiciel libre. Les personnes suivantes ont contribué à cette extension.
Contributeurs
Traduisez « AiutoComputerHelp Persistence Audit » dans votre langue.
Le développement vous intéresse ?
Parcourir le code, consulter le SVN dépôt, ou s’inscrire au journal de développement par RSS.
Journal
1.0.1
- Determine WordPress, content, plugin, MU-plugin and administration locations through WordPress APIs and plugin-relative helpers for broader installation compatibility.
1.0.0
- First public release.
- Read-only persistence audit across bootstrap, MU-plugins, options/transients, Cron, .htaccess, users, REST metadata and targeted filesystem anomalies.
- Cross-layer correlation of meaningful artifacts and identifiers.
- Safe bounded previews with secret redaction.
- Standard, Deep and Deep+ filesystem traversal modes with separate candidate budgets.
- User-controlled scan cancellation and live traversal counters.
- Conservative handling of normal feed transients, migration-style filenames and generic correlation artifacts.