{"id":389090,"date":"2026-10-31T14:09:31","date_gmt":"2026-10-31T14:09:31","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/scanforge-file-theme-security\/"},"modified":"2026-10-31T14:47:32","modified_gmt":"2026-10-31T14:47:32","slug":"scanforge-file-security","status":"publish","type":"plugin","link":"https:\/\/th.wordpress.org\/plugins\/scanforge-file-security\/","author":14427544,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.1","stable_tag":"1.0.1","tested":"7.1.4","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"ScanForge File & Theme Security","header_author":"adnanlimdi","header_description":"Performs deep static code audits and integrity checks across plugins and themes to detect web shells, Tiny File Manager, and malicious backdoors.","assets_banners_color":"6f7687","last_updated":"2026-10-31 14:47:32","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/profiles.wordpress.org\/adnanlimdi\/","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/scanforge-file-security\/","header_author_uri":"https:\/\/profiles.wordpress.org\/adnanlimdi\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":51,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"adnan.limdi","date":"2026-10-31 14:09:05","revision":3776948},"1.0.1":{"tag":"1.0.1","author":"adnan.limdi","date":"2026-10-31 14:47:32","revision":3777002}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3776948,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3776948,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3776948,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":599},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3776948,"resolution":"772x250","location":"assets","locale":"","width":1544,"height":599}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3776948,"resolution":"1","location":"assets","locale":"","width":1429,"height":820},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3776948,"resolution":"2","location":"assets","locale":"","width":1429,"height":820},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3776948,"resolution":"3","location":"assets","locale":"","width":1429,"height":820},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3776948,"resolution":"4","location":"assets","locale":"","width":1429,"height":820}},"screenshots":{"1":"Quick In-Row File Auditing: Trigger on-demand security and checksum audits directly from each plugin row on the native WordPress Installed Plugins screen.","2":"Automated Batch Audit Sequence: Run memory-safe batch checks across all installed plugins and themes with real-time progress indicators and repository comparisons.","3":"Isolated Target Inspection &amp; Threat Log: Pinpoint unauthorized file modifications and discrepancies against official WordPress.org checksum manifests.","4":"Clean Admin Dashboard &amp; Metrics: Monitor loaded extensions, live threat counters, and cross-protection status with ScanForge Database Security."}},"plugin_section":[],"plugin_tags":[153575,289926,55021,600,289785],"plugin_category":[54],"plugin_contributors":[160155],"plugin_business_model":[],"class_list":["post-389090","plugin","type-plugin","status-publish","hentry","plugin_tags-checksums","plugin_tags-integrity-checker","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-webshell","plugin_category-security-and-spam-protection","plugin_contributors-adnanlimdi","plugin_committers-adnanlimdi"],"banners":{"banner":"https:\/\/ps.w.org\/scanforge-file-security\/assets\/banner-772x250.png?rev=3776948","banner_2x":"https:\/\/ps.w.org\/scanforge-file-security\/assets\/banner-1544x500.png?rev=3776948","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/scanforge-file-security\/assets\/icon-128x128.png?rev=3776948","icon_2x":"https:\/\/ps.w.org\/scanforge-file-security\/assets\/icon-256x256.png?rev=3776948","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/scanforge-file-security\/assets\/screenshot-1.png?rev=3776948","caption":"Quick In-Row File Auditing: Trigger on-demand security and checksum audits directly from each plugin row on the native WordPress Installed Plugins screen."},{"src":"https:\/\/ps.w.org\/scanforge-file-security\/assets\/screenshot-2.png?rev=3776948","caption":"Automated Batch Audit Sequence: Run memory-safe batch checks across all installed plugins and themes with real-time progress indicators and repository comparisons."},{"src":"https:\/\/ps.w.org\/scanforge-file-security\/assets\/screenshot-3.png?rev=3776948","caption":"Isolated Target Inspection &amp; Threat Log: Pinpoint unauthorized file modifications and discrepancies against official WordPress.org checksum manifests."},{"src":"https:\/\/ps.w.org\/scanforge-file-security\/assets\/screenshot-4.png?rev=3776948","caption":"Clean Admin Dashboard &amp; Metrics: Monitor loaded extensions, live threat counters, and cross-protection status with ScanForge Database Security."}],"raw_content":"<!--section=description-->\n<p><strong>ScanForge File &amp; Theme Security<\/strong> is a dedicated static code analysis and file integrity scanner built to detect unauthorized code modifications, web shells, and hidden backdoors across WordPress plugins and themes.<\/p>\n\n<p>Unlike heavy, background-daemon security suites, ScanForge is an on-demand auditing engine. It gives system administrators and developers instant visibility into file tampering by comparing local plugin code against official WordPress.org release checksums while heuristically hunting for malicious payloads.<\/p>\n\n<h3>How ScanForge Protects WordPress Files &amp; Themes<\/h3>\n\n<ul>\n<li><strong>Official WordPress.org Checksum Verification:<\/strong> Instantly identifies modified repository files, unauthorized rogue additions, or missing script components by comparing local hashes directly with official release manifests.<\/li>\n<li><strong>Web Shell &amp; PHP Backdoor Detection:<\/strong> Heuristically matches file contents against known malicious signatures, including WSO, b374k, FilesMan, c99, and r57 web shells.<\/li>\n<li><strong>Injected File Manager Discovery:<\/strong> Detects unauthorized dropped file management utilities (such as Tiny File Manager variants) via distinctive functional signatures (<code>FM_ROOTPATH<\/code>, <code>FM_SESSION_KEY<\/code>).<\/li>\n<li><strong>High-Risk Code Pattern Flags:<\/strong> Uncovers dangerous execution wrappers such as nested <code>eval(base64_decode())<\/code>, dynamic assertion backdoors, and shell execution handling raw superglobal inputs (<code>$_POST<\/code>, <code>$_GET<\/code>, <code>$_COOKIE<\/code>).<\/li>\n<li><strong>Intelligent Vendor Whitelisting:<\/strong> Automatically ignores standard dependency trees (<code>vendor\/<\/code>, <code>node_modules\/<\/code>, <code>tests\/<\/code>) to eliminate false alarms and maximize scanning speed.<\/li>\n<li><strong>On-Demand &amp; Lightweight:<\/strong> Runs sequential, memory-safe audits only when you click \"Scan\", leaving zero background cron overhead on your server.<\/li>\n<li><strong>Full-Stack Security Integration:<\/strong> Seamlessly pairs with ScanForge Database Security to audit SQL tables (<code>wp_posts<\/code>, <code>wp_options<\/code>) alongside your filesystem scripts.<\/li>\n<\/ul>\n\n<h3>External Services &amp; Privacy<\/h3>\n\n<p>This plugin queries official WordPress.org endpoints to verify plugin file integrity and check for available updates.<\/p>\n\n<ul>\n<li><strong>Service Used:<\/strong> WordPress.org Checksums and Plugin Information API (<code>api.wordpress.org<\/code> \/ <code>downloads.wordpress.org<\/code>).<\/li>\n<li><strong>Purpose:<\/strong> Retrieves official release MD5 hashes and plugin metadata to identify modified, added, or outdated files.<\/li>\n<li><strong>Data Transmitted:<\/strong> The plugin slug and installed version number are transmitted via standard HTTP GET queries. No personal data, visitor information, site contents, or admin credentials are transmitted.<\/li>\n<li><strong>Privacy Policy:<\/strong> All interactions with WordPress.org servers are governed by the WordPress Foundation Privacy Policy: https:\/\/wordpress.org\/about\/privacy\/<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>scanforge-file-security<\/code> directory to your <code>\/wp-content\/plugins\/<\/code> directory, or upload the ZIP file directly via <strong>Plugins &gt; Add New &gt; Upload Plugin<\/strong>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> screen in WordPress.<\/li>\n<li>Navigate to <strong>Tools &gt; ScanForge Files<\/strong> to run a comprehensive audit, or click <strong>ScanForge File Audit<\/strong> on any individual row in <strong>Plugins &gt; Installed Plugins<\/strong>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"how%20do%20i%20check%20if%20my%20wordpress%20plugin%20files%20have%20been%20hacked%20or%20modified%3F\"><h3>How do I check if my WordPress plugin files have been hacked or modified?<\/h3><\/dt>\n<dd><p>Navigate to <strong>Tools &gt; ScanForge Files<\/strong> and select <strong>Scan All Plugins &amp; Themes<\/strong>. ScanForge connects to the WordPress.org Checksum API to compare your local plugin files against official release files. Any altered core files, missing scripts, or rogue injected PHP files will be highlighted in the audit log.<\/p><\/dd>\n<dt id=\"can%20scanforge%20audit%20single-file%20plugins%3F\"><h3>Can ScanForge audit single-file plugins?<\/h3><\/dt>\n<dd><p>Yes. Standalone root plugins (such as <code>hello.php<\/code>) are audited alongside multi-folder extensions for web shells, malicious eval strings, and unauthorized modifications.<\/p><\/dd>\n<dt id=\"does%20this%20plugin%20run%20background%20processes%20or%20slow%20down%20page%20loads%3F\"><h3>Does this plugin run background processes or slow down page loads?<\/h3><\/dt>\n<dd><p>No. ScanForge contains zero background cron workers, continuous tracking scripts, or frontend overhead. Audits run strictly on demand when an administrator triggers them.<\/p><\/dd>\n<dt id=\"how%20does%20scanforge%20handle%20third-party%20vendor%20directories%3F\"><h3>How does ScanForge handle third-party vendor directories?<\/h3><\/dt>\n<dd><p>To prevent false positives on legitimate composer libraries (like AWS SDKs or Symfony components), ScanForge ignores common library folders (<code>vendor\/<\/code>, <code>node_modules\/<\/code>, <code>tests\/<\/code>) during static heuristic checks while still validating repository integrity.<\/p><\/dd>\n<dt id=\"how%20does%20scanforge%20differ%20from%20all-in-one%20security%20suites%3F\"><h3>How does ScanForge differ from all-in-one security suites?<\/h3><\/dt>\n<dd><p>Most comprehensive security plugins focus primarily on incoming network firewalls (WAF) and brute-force protection. ScanForge functions as a focused static file auditor and integrity validator designed to inspect actual PHP files and catch malicious code that slipped past firewalls.<\/p><\/dd>\n<dt id=\"how%20do%20i%20clean%20malicious%20database%20injections%3F\"><h3>How do I clean malicious database injections?<\/h3><\/dt>\n<dd><p>ScanForge File &amp; Theme Security inspects filesystem scripts. To scan and remove malicious redirect scripts, spam links, and obfuscated payloads stored inside your MySQL database tables (<code>wp_posts<\/code>, <code>wp_options<\/code>, <code>wp_comments<\/code>), pair this tool with <a href=\"https:\/\/wordpress.org\/plugins\/scanforge-db-security\/\">ScanForge Database Security<\/a>.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Fixed theme classification bug where official directory and default core themes defaulted to \"Custom \/ Third-Party\".<\/li>\n<li>Added automatic detection for bundled default themes (Twenty Twenty-Five, Twenty Twenty-Four, etc.) and WordPress.org theme directory listings.<\/li>\n<li>Refactored badge labeling in the admin audit trail to show \"Official WP Theme\".<\/li>\n<li>Updated UI cards and live statistic counters to maintain aesthetic consistency with ScanForge Database Security.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<li>Added single and batch audit orchestration for plugins and themes.<\/li>\n<li>Integrated official WordPress.org Checksum API integrity checks with transient caching.<\/li>\n<li>Added automatic checksum cache flushing on plugin upgrades and manual cache purge utility.<\/li>\n<li>Integrated JSON-driven threat signatures for web shells and Tiny File Manager detection.<\/li>\n<li>Fully compliant with WordPress Coding Standards (WPCS).<\/li>\n<\/ul>","raw_excerpt":"Audit WordPress plugins and themes for web shells, Tiny File Manager injections, modified files, and official repository checksum mismatches.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/389090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=389090"}],"author":[{"embeddable":true,"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/adnanlimdi"}],"wp:attachment":[{"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=389090"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=389090"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=389090"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=389090"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=389090"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/th.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=389090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}