Launched this week
Security Guard
Find ClickFix and EtherHiding malware on WordPress sites
2 followers
Find ClickFix and EtherHiding malware on WordPress sites
2 followers
A WordPress plugin that scans your own site for injected-script malware: fake ClickFix verification boxes, EtherHiding blockchain loaders, web shells, PHP hidden in uploads, new administrators and changed core files. The scan is read-only and sends no site files anywhere. A filter strips known loader scripts from your pages, and a Content-Security-Policy starts in report-only mode until its log is clean.
I'm Mugees from PluginSprout, the plugin side of DistroCode, a WordPress agency in Sterling Heights, Michigan. We wrote Security Guard after an injected-script infection hit a production WordPress site.
That kind of malware hides well. It rarely sits in a file you can spot by name. It is a few lines of script in a post, an option or a must-use plugin, and it often shows its payload only to visitors. One version puts up a fake "Verify you are human" box that asks the visitor to paste a command into the Windows Run dialog (ClickFix). Another reads its next stage from a public blockchain, so there is no bad domain to block (EtherHiding).
What Security Guard does:
• A read-only scan of plugin, theme and must-use code, the uploads folder, the database, administrator accounts and core files. It never deletes or edits a file it flags.
• A baseline you save while the site is clean. Later scans flag any added or changed code file and any new administrator, even when nothing matches a known pattern.
• A filter that takes known loader scripts out of your pages and logs each removal.
• Six hardening switches, all on by default, and an event log of the newest 200 events.
The scan works in short steps, one request at a time, so slow hosting doesn't hit a time limit. It also runs once a day. Nothing is uploaded.
A licence is $49 a year for one site, $89 for five and $149 for unlimited sites. Every plan has every feature, and there's a 14-day money-back guarantee.
If your visitors have reported a fake Cloudflare check on your site, I'd like to hear what you found.