A WordPress plugin that scans your own site for injected-script malware: fake ClickFix verification boxes, EtherHiding blockchain loaders, web shells, PHP hidden in uploads, new administrators and changed core files. The scan is read-only and sends no site files anywhere. A filter strips known loader scripts from your pages, and a Content-Security-Policy starts in report-only mode until its log is clean.
