=== VulnTitan - Malware Scanner, Vulnerability Scanner & Security === Tags: malware scanner, malware removal, vulnerability scanner Donate link: https://www.paypal.com/ncp/payment/TPGXWZTJX7TDE Tested up to: 6.9 Requires PHP: 7.4 Stable tag: 2.1.2 License: GPLv2 License URI: https://www.gnu.org/licenses/gpl-2.0.html VulnTitan security toolkit for WordPress sites. Detect and remove malware, vulnerable plugins, risky file changes, and comment spam. == Description == VulnTitan is a WordPress security plugin focused on malware scanning and removal, vulnerability detection, file integrity monitoring, firewall protection, and comment anti-spam controls. Instantly scan your WordPress site for malware infections and known vulnerabilities, review detailed results, and clean or remove malware safely using a guided fix workflow with automatic backups. VulnTitan focuses on practical protection: vulnerability detection, malware scanning and removal, file integrity monitoring, firewall protection, comment anti-spam defense, hidden custom login access, and a weekly executive security digest every 7 days. = Malware Scanner = The WordPress malware scanner inspects your site files for suspicious code patterns and known malicious signatures. - Detect malware infections in core, plugins, and themes - Review problematic files with contextual code preview - Safe-fix workflow with automatic backups - Clear severity indicators and actionable recommendations = Vulnerability Scanner = The vulnerability scanner checks your installed WordPress core, plugins, and themes against a real-time vulnerability database powered by the VulnTitan API. - Detect vulnerable plugins and themes - Identify outdated components with known security risks - Real-time vulnerability intelligence - Clear risk explanations and remediation guidance = File Integrity Scanner = Monitor unauthorized file changes and unexpected modifications. - Baseline comparison for WordPress files - Queue-based processing for performance safety - Visual status legends for fast review - Actionable next steps for suspicious changes = Firewall, Login & Comment Protection = VulnTitan includes firewall, WAF, login protection, and comment anti-spam controls to block common attack patterns and protect the WordPress login and comment surfaces. - Early MU-plugin runtime request guards - SQL injection (SQLi) payload protection - Command injection detection - Suspicious path traversal blocking - Endpoint whitelisting controls - Login lockout protection against brute-force attacks - Comment Shield with honeypot, submit-time validation, duplicate detection, guest link limits, and IP rate limiting - Suspicious comments can be held for moderation or blocked immediately - Configurable custom login slug so administrators can use a private login URL instead of the default `wp-login.php` - Default `wp-login.php` and guest `wp-admin` access can be hidden behind a `404` response when custom login is enabled - Weekly executive security report email with 7-day firewall, login abuse, WAF, and comment spam statistics = Security-First Architecture = - Secure storage and cleanup of scan queues and logs - Hardened backup handling outside `ABSPATH` by default - Adaptive performance tuning for safe large-site scanning == External services == This plugin connects to an external API at https://vulntitan.com/api/vulnerabilities to fetch up-to-date vulnerability data for WordPress core, plugins, and themes. This data is essential for detecting known vulnerabilities during scan operations. When a vulnerability scan is performed, the following data is sent to the VulnTitan API: - The slug and version of each plugin - The slug and version of each theme - The WordPress core version This data is transmitted only during scans initiated by the user or by scheduled scan settings. No personal, user-identifying, or sensitive site data is collected, transmitted, or stored. The external service is provided and operated by VulnTitan.com. - Terms of Service: https://vulntitan.com/terms - Privacy Policy: https://vulntitan.com/privacy == Screenshots == 1. WordPress malware and vulnerability scan dashboard overview. 2. Malware detection results with safe-fix workflow and backup protection. 3. Vulnerability scanner results showing vulnerable plugins and themes. 4. File integrity scan results with baseline comparison. 5. Firewall and WAF protection settings panel. 6. Vulnerability scan progress bar. 7. Firewall hidden custom login configuration and protected access screen. == Installation == = From your WordPress dashboard = 1. Navigate to **Plugins > Add New** 2. Click **Upload Plugin** 3. Upload the downloaded ZIP file 4. Click **Install Now**, then **Activate** = From FTP or File Manager = 1. Upload the extracted `vulntitan` folder to the `/wp-content/plugins/` directory 2. Go to your WordPress dashboard 3. Navigate to **Plugins > Installed Plugins** 4. Find **VulnTitan** and click **Activate** = Once activated = - Go to **VulnTitan** in your admin menu - Click **Scan Now** to run a malware and vulnerability scan - Review detected vulnerabilities, malware infections, and file integrity issues - Apply guided safe fixes where needed == Frequently Asked Questions == = Who owns the VulnTitan API? = The VulnTitan API is developed, owned, and maintained by the same team behind this plugin. It is not a third-party service. The API is operated solely to provide accurate and real-time vulnerability intelligence for WordPress sites. = What data does the plugin send to the API? = The plugin sends only non-personal technical information such as plugin slugs, theme slugs, and WordPress core version numbers. No personal data, login credentials, email addresses, or sensitive information is transmitted or stored. = Why is the API connection required? = The API provides up-to-date vulnerability data needed to detect known security issues affecting WordPress core, plugins, and themes. Without this connection, vulnerability detection would not function correctly. = Does VulnTitan remove malware? = Yes. When malware is detected, VulnTitan provides a guided safe-fix workflow with backup protection so you can review and safely remove infected files. == Changelog == = v2.1.2 - 14 Mar, 2026 = * Refined the Vulnerability scanner UI with a more professional overview and findings layout. * Moved the Vulnerability Overview panel outside the scrolling results area so it stays sticky as a separate summary block. * Improved clean-result messaging so results now explicitly reference the scanned plugin, theme, or WordPress core component. = v2.1.1 - 14 Mar, 2026 = * Added a live-updating Firewall security feed with auto-refresh, pause/resume controls, quick filters, search, and per-event forensic detail panels. * Expanded Firewall feed event data so administrators can inspect richer request, actor, and rule context directly in the admin UI. * Improved live refresh behavior so recent event polling no longer overwrites unsaved Firewall settings while the page is open. = v2.1.0 - 13 Mar, 2026 = * Added Comment Shield anti-spam protection for WordPress comments with honeypot, submit-time validation, duplicate detection, link controls, and IP rate limiting. * Added Firewall dashboard and weekly digest statistics for blocked or moderated comment spam activity. * Changed Firewall MU loader status to show WordPress-relative paths such as `wp-content/mu-plugins/vulntitan-firewall.php` instead of absolute server filesystem paths. = v2.0.8 - 13 Mar, 2026 = * Added a weekly executive security digest email with 7-day firewall telemetry, login abuse summaries, WAF detections, and top targeted paths/rules. * Added Firewall settings for enabling the weekly digest and overriding the recipient email address. * Upgraded the digest into a professional branded HTML email template with VulnTitan logo, metric cards, timeline, and protection profile summary. = v2.0.7 - 13 Mar, 2026 = * Fixed custom login logout requests on some Nginx-backed WordPress sites so hidden login logout no longer triggers `502 Bad Gateway` responses. * Stabilized hidden login request bootstrapping and canonical custom login route handling for logout/login flows. = v2.0.6 - 12 Mar, 2026 = * Added configurable custom login slug support so administrators can use a private login URL instead of the default `wp-login.php` path. * Hidden direct guest access to default `wp-login.php` and `wp-admin` entry points when custom login protection is enabled. * Reworked the Firewall page with a tabbed settings layout, a wider recent events section, and toast-style action feedback. = v2.0.4 - 10 Mar, 2026 = * Redesigned the VulnTitan Dashboard into an elite, professional security command center layout. * Redesigned the Firewall page into a professional command center layout. * Removed the dashboard sidebar to keep the UI focused on scan operations. * Redesigned the top navigation bar to match the new elite dashboard and firewall style. * Fixed scan progress indicator layout in the redesigned dashboard. = v2.0.3 - 10 Mar, 2026 = * Reduced false positives for benign decode-only utilities (e.g., base64 + gzuncompress). * Reduced false positives for safe data:image/svg+xml;base64 payloads. * Disabled auto-fix for low-risk malware findings to prevent accidental code removal. = v2.0.2 - 10 Mar, 2026 = * Reduced malware scanner false positives for base64-decoded signature and key material. * Avoided false positives from benign data:image base64 CSS payloads embedded in PHP/JS strings. * Prevented false positives on large serialized option blobs without execution or file-write patterns. = v2.0.1 - 03 Mar, 2026 = * Fixed Vulnerability scanner UI so the "Vulnerability Overview" section stays pinned at the top while results are scrolled. * Reduced Malware scanner false positives for benign CSS `content:` strings and similar static string-literal matches. = v2.0.0 - 25 Feb, 2026 = * Major release with redesigned Malware, Vulnerability, and File Integrity scan UX. * Improved malware scanner with detailed problematic-files panel and guided safe-fix actions. * Enhanced vulnerability detection powered by updated API intelligence. * Improved file integrity scanner with clearer legends and performance tuning. * Added dedicated Firewall module with MU runtime guards and login lockout protection. * Added WAF payload protection for SQL injection and command injection. * Security hardening for backup storage and automated cleanup routines. For full release history, see `CHANGELOG.md` included in the plugin package.