shadowscan

<p>ShadowScan Security Link gives you ShadowScan Guard local WordPress hardening for plugin auto-updates, username enumeration reduction, version/plugin exposure reduction, sensitive-file blocking, and basic connection/self-check diagnostics.</p>
<p>The plugin supports dual backend pairing with both Guard and ShadowScan. Pair with Guard backend for Guard-specific features, or connect to ShadowScan Portal to sync heartbeat status and unlock managed features for sites with an active Essential or Premium plan, or an approved reviewed pricing path. Basic Hosting can stay hosting-only, while ShadowScan Guard local hardening remains available in the plugin until managed entitlements are active.</p>
<p>Pairing the plugin and enabling remote diagnostics each require an explicit administrator acknowledgment in WP Admin. Those checkpoints are covered by the <a href="https://shadowscan.com.au/plugin-addendum" rel="nofollow ugc">ShadowScan Plugin Addendum</a>.</p>
<p>ShadowScan does not install, activate, or configure third-party security tools. If another security plugin is present, the connector only records its presence as metadata.</p>
<h3>External services</h3>
<p>This plugin can connect to external services to sync status, process security workflows, and support optional diagnostics after an admin pairs the site to ShadowScan.</p>
<ul>
<li>Service: ShadowScan API (hosted at Supabase Edge Functions)</li>
<li>URL: <a href="https://axuhxgeafczsoctlzycz.supabase.co/functions/v1/" rel="nofollow ugc">ShadowScan API</a></li>
<li>Used for: ShadowScan pairing, heartbeat sync, command polling, command-result upload, subscription/policy sync, and support contact submissions.</li>
<li>Data sent and when: site URL, WordPress version, PHP version, connector version, Guard Layer/control status, heartbeat timestamps, and command execution metadata whenever the connector syncs with ShadowScan; contact form fields only when an admin submits support contact.</li>
<li>Terms: <a href="https://shadowscan.com.au/terms" rel="nofollow ugc">shadowscan.com.au/terms</a></li>
<li>Privacy: <a href="https://shadowscan.com.au/privacy" rel="nofollow ugc">shadowscan.com.au/privacy</a></li>
<li>
<p>Plugin Addendum: <a href="https://shadowscan.com.au/plugin-addendum" rel="nofollow ugc">shadowscan.com.au/plugin-addendum</a></p>
</li>
<li>
<p>Service: Guard API (hosted at Supabase Edge Functions)</p>
</li>
<li>URL: <a href="https://dzaidjskedmlrtyqdobg.supabase.co/functions/v1/" rel="nofollow ugc">Guard API</a></li>
<li>Used for: Guard pairing validation, migration token validation, and Guard backend operations.</li>
<li>Data sent and when: pairing codes, migration tokens, and site metadata only when pairing with Guard backend or processing migration scenarios.</li>
<li>Terms: <a href="https://shadowscan.com.au/terms" rel="nofollow ugc">shadowscan.com.au/terms</a></li>
<li>Privacy: <a href="https://shadowscan.com.au/privacy" rel="nofollow ugc">shadowscan.com.au/privacy</a></li>
<li>
<p>Plugin Addendum: <a href="https://shadowscan.com.au/plugin-addendum" rel="nofollow ugc">shadowscan.com.au/plugin-addendum</a></p>
</li>
<li>
<p>Service: Have I Been Pwned Passwords API</p>
</li>
<li>URL: <a href="https://api.pwnedpasswords.com" rel="nofollow ugc">api.pwnedpasswords.com</a></li>
<li>Used for: optional breached-password checks in password policy enforcement.</li>
<li>Data sent and when: k-anonymity password hash prefix (first 5 SHA-1 characters, no raw passwords) only when a password is checked by the policy flow.</li>
<li>Terms: <a href="https://haveibeenpwned.com/TermsOfUse" rel="nofollow ugc">haveibeenpwned.com/TermsOfUse</a></li>
<li>
<p>Privacy: <a href="https://haveibeenpwned.com/Privacy" rel="nofollow ugc">haveibeenpwned.com/Privacy</a></p>
</li>
<li>
<p>Service: Sentry</p>
</li>
<li>URL: <a href="https://sentry.io" rel="nofollow ugc">sentry.io</a></li>
<li>Used for: optional error and fatal-event telemetry to assist troubleshooting.</li>
<li>Data sent and when: error event metadata (such as exception messages, stack traces, and runtime context) only after an admin explicitly enables Sentry telemetry in plugin settings and a Sentry DSN is configured; the optional MU diagnostics helper can send early-startup fatal errors only while both Sentry telemetry and remote diagnostics are enabled.</li>
<li>Terms: <a href="https://sentry.io/terms/" rel="nofollow ugc">sentry.io/terms</a></li>
<li>Privacy: <a href="https://sentry.io/privacy/" rel="nofollow ugc">sentry.io/privacy</a></li>
</ul>
<h3>Third-Party Libraries</h3>
<p>This plugin bundles:<br />
* <a href="https://github.com/antonioribeiro/google2fa" rel="nofollow ugc">pragmarx/google2fa</a> (MIT License)<br />
* <a href="https://github.com/Bacon/BaconQrCode" rel="nofollow ugc">bacon/bacon-qr-code</a> (BSD-2-Clause; Copyright (c) 2017-present, Ben Scholzen “DASPRiD”)</p>
<h3>Hooks</h3>
<p><code>shadowscan_log</code><br />
Fires when the plugin emits an internal log message. You can hook this in a must-use plugin or theme if you want to capture logs.</p>


ShadowScan Security Link

ShadowScan Guard local WordPress hardening and basic diagnostics, with optional Guard or ShadowScan portal connection for managed features.

sweetwatermedia

<p>Steel Security & Hardening – Site Audit Tools focuses on practical security hygiene for WordPress administrators.</p>
<p>The free plugin provides:</p>
<ul>
<li>on-demand security scans</li>
<li>risk summaries grouped by severity and category</li>
<li>checks for common WordPress hardening gaps</li>
<li>checks for exposed root-level artifacts such as <code>.env</code>, SQL dumps, <code>phpinfo</code> files, and backup archives</li>
<li>a quarantine vault for operator-reviewed file isolation</li>
<li>uploads PHP execution blocking on supported server environments</li>
<li>manual guidance when automatic server hardening is not safely supported</li>
</ul>
<p>This plugin is positioned as an auditing and hardening tool. It helps surface risk and apply selected preventive controls, but it does not promise malware removal, incident response, or complete server protection.</p>
<h4>Included checks</h4>
<p>The scan currently looks for items such as:</p>
<ul>
<li>PHP error display exposure</li>
<li><code>WP_DEBUG</code> and <code>debug.log</code> exposure</li>
<li>XML-RPC availability</li>
<li>author and REST user enumeration exposure</li>
<li>theme/plugin file editor availability</li>
<li>WordPress generator meta output</li>
<li>comments enabled by default</li>
<li>uploads PHP execution hardening status</li>
<li>root-level sensitive files and archives</li>
</ul>
<h4>Server-aware behavior</h4>
<p>This plugin only auto-applies server config changes where it can do so in a scoped and reversible way.</p>
<ul>
<li>Apache and LiteSpeed: uploads PHP blocking is managed through a Steel Security-marked <code>.htaccess</code> block</li>
<li>IIS: uploads PHP blocking is managed through a Steel Security-marked <code>web.config</code> section</li>
<li>Nginx and unsupported environments: Steel Security provides manual guidance instead of claiming automatic protection</li>
</ul>
<h4>Pro companion</h4>
<p>This plugin can work with a separate Pro companion plugin that adds features such as scheduled scans, scan history, reports, and managed server-level controls such as directory listing protection and baseline security headers. The free plugin remains usable on its own.</p>


Steel Security & Hardening – Site Audit Tools

High-signal WordPress security auditing and hardening with practical site audit tools for administrators.

ShadowScan Security Link vs Steel Security & Hardening – Site Audit Tools