[WordPress] 外掛分享： AiutoComputerHelp Persistence Audit

內容簡介

AiutoComputerHelp Persistence Audit 是一款專注於 WordPress 安全審計的只讀外掛，旨在檢查和分析持久性代碼的機制，幫助用戶識別潛在的安全風險。

【主要功能】
• 檢查多個持久性相關層級
• 四級審計結果：通過、資訊、審查和警告
• 提供標準、深度及深度+掃描模式
• 不修改檔案或資料庫內容
• 限制檔案系統檢查於當前安裝

外掛標籤

開發者團隊

原文外掛簡介

AiutoComputerHelp Persistence Audit is a read-only security auditing plugin focused on mechanisms that can maintain, restore or recreate persistent code in a WordPress installation.
The plugin examines multiple persistence-relevant layers and correlates related artifacts instead of treating an isolated indicator as proof of compromise.
Current audit areas include:

bootstrap configuration and selected drop-ins;
MU-plugins;
database options and transients;
WordPress Cron;
the root .htaccess file;
administrator account metadata;
registered REST route metadata;
targeted filesystem anomalies inside the current WordPress installation;
cross-layer correlation of meaningful artifacts and identifiers.

Findings use four levels: Pass, Info, Review and Warning. A Review or Warning means that the observed evidence deserves investigation; it does not by itself prove malware or compromise.
The filesystem scan offers Standard, Deep and Deep+ traversal modes. Candidate budget limits content inspection only. Deep+ performs much broader directory traversal and can take one minute or more on large installations or shared hosting.
Read-only and privacy design
The plugin does not remove files, modify the database, alter configuration, disable plugins, delete cron events, reset users, execute detected payloads or call suspicious REST endpoints.
It does not send scan results to external services and does not use external reputation APIs.
Filesystem inspection is limited to the current WordPress installation and symbolic links are not followed. Safe previews are bounded and redact common secrets such as database credentials, salts, tokens and authorization values.
Base64 content, when inspected, is decoded only for bounded static analysis and is never evaluated, included or executed.