Jaroslav Svetlik

<p>VulnTitan is a WordPress security plugin focused on malware scanning and removal, vulnerability detection, file integrity monitoring, firewall protection, and anti-spam controls for comments and supported forms.</p>
<p>Instantly scan your WordPress site for malware infections and known vulnerabilities, review detailed results, and clean or remove malware safely using a guided fix workflow with automatic backups.</p>
<p>VulnTitan focuses on practical protection: vulnerability detection, malware scanning and removal, file integrity monitoring, firewall protection, anti-spam defense for comments and supported forms, hidden custom login access, and a weekly executive security digest every 7 days.</p>
<h4>Malware Scanner</h4>
<p>The WordPress malware scanner inspects your site files for suspicious code patterns and known malicious signatures.</p>
<ul>
<li>Detect malware infections in core, plugins, and themes</li>
<li>Review problematic files with contextual code preview</li>
<li>Safe-fix workflow with automatic backups</li>
<li>Clear severity indicators and actionable recommendations</li>
</ul>
<h4>Vulnerability Scanner</h4>
<p>The vulnerability scanner checks your installed WordPress core, plugins, and themes against a real-time vulnerability database powered by the VulnTitan API.</p>
<ul>
<li>Detect vulnerable plugins and themes</li>
<li>Identify outdated components with known security risks</li>
<li>Real-time vulnerability intelligence</li>
<li>Clear risk explanations and remediation guidance</li>
</ul>
<h4>File Integrity Scanner</h4>
<p>Monitor unauthorized file changes and unexpected modifications.</p>
<ul>
<li>Baseline comparison for WordPress files</li>
<li>Queue-based processing for performance safety</li>
<li>Visual status legends for fast review</li>
<li>Actionable next steps for suspicious changes</li>
</ul>
<h4>Firewall, Login, Comment & Form Protection</h4>
<p>VulnTitan includes firewall, WAF, login protection, and anti-spam controls to block common attack patterns and protect WordPress login, comment, and supported form submission surfaces.</p>
<ul>
<li>Early MU-plugin runtime request guards</li>
<li>SQL injection (SQLi) payload protection</li>
<li>Command injection detection</li>
<li>Suspicious path traversal blocking</li>
<li>Endpoint whitelisting controls</li>
<li>Login lockout protection against brute-force attacks</li>
<li>TOTP-based two-factor authentication for selected roles</li>
<li>Recovery codes and trusted-device support for enrolled accounts</li>
<li>CAPTCHA protection for WordPress login/registration, WooCommerce login/registration, WordPress lost-password, and optional comment forms</li>
<li>XML-RPC allow, disable, or rate-limit policy controls with IP allowlisting</li>
<li>Weak-password blocking during profile updates, password resets, and compatible registrations</li>
<li>Comment Shield with honeypot, signed tokens, submit-time validation, duplicate detection, guest link limits, IP rate limiting, and moderation-aware logging</li>
<li>Form Shield for Contact Form 7 and Fluent Forms with honeypot, signed submit tokens, link heuristics, repeated-domain detection, and IP rate limiting</li>
<li>Form spam blocks are logged into the WAF/live feed with provider-aware source labels for easier review</li>
<li>Suspicious comments can be held for moderation or blocked immediately</li>
<li>REST comments can enforce signed anti-spam tokens and CAPTCHA when anonymous REST commenting is enabled elsewhere</li>
<li>Configurable custom login slug so administrators can use a private login URL instead of the default <code>wp-login.php</code></li>
<li>Default <code>wp-login.php</code> and guest <code>wp-admin</code> access can be hidden behind a <code>404</code> response when custom login is enabled</li>
<li>Weekly executive security report email with 7-day firewall, login abuse, WAF, form spam, and comment moderation statistics</li>
</ul>
<h4>Security-First Architecture</h4>
<ul>
<li>Secure storage and cleanup of scan queues and logs</li>
<li>Hardened backup handling outside <code>ABSPATH</code> by default</li>
<li>Hardened malware and integrity scan actions with stricter capability checks and in-root path validation</li>
<li>Adaptive performance tuning for safe large-site scanning</li>
</ul>
<h4>WP-CLI Support</h4>
<p>VulnTitan supports WP-CLI commands for malware, integrity, and vulnerability scans so administrators can run checks from the terminal, scripts, or server automation.</p>
<ul>
<li><code>wp vulntitan scan malware</code></li>
<li><code>wp vulntitan scan integrity</code></li>
<li><code>wp vulntitan scan vulnerability</code></li>
<li><code>wp vulntitan scan all</code></li>
<li>Optional flags: <code>--scope=plugins</code>, <code>--format=json</code>, <code>--fail-on-findings</code></li>
</ul>
<h3>External services</h3>
<p>This plugin connects to an external API at https://vulntitan.com/api/vulnerabilities to fetch up-to-date vulnerability data for WordPress core, plugins, and themes. This data is essential for detecting known vulnerabilities during scan operations.</p>
<p>When a vulnerability scan is performed, the following data is sent to the VulnTitan API:<br />
– The slug and version of each plugin<br />
– The slug and version of each theme<br />
– The WordPress core version</p>
<p>This data is transmitted only during scans initiated by the user or by scheduled scan settings. No personal, user-identifying, or sensitive site data is collected, transmitted, or stored.</p>
<p>The external service is provided and operated by VulnTitan.com.</p>
<ul>
<li>Terms of Service: https://vulntitan.com/terms</li>
<li>Privacy Policy: https://vulntitan.com/privacy</li>
</ul>


VulnTitan – Malware Scanner, Vulnerability Scanner & Security

VulnTitan security toolkit for WordPress sites. Detect and remove malware, vulnerable plugins, risky file changes, and comment or form spam.

Malcure Web Security

cybermalcure

Malware Intercept

<h3>Malcure Security</h3>
<p>★★★★★</p>
<p>Protect your WordPress site from hacks and downtime.</p>
<p>Malcure Security Suite is a fast, lightweight, cloud-connected security platform for WordPress. It performs deep server-side scans (files + database) to catch malware and unauthorized changes, allows you to monitor login activity, enables a site-wide forced re-login after incidents, and sends email alerts of incidents upon scan. Built for commercial workloads—WooCommerce stores, memberships, LMS, bookings, directories, and multi-vendor marketplaces—it plays nicely with caching/CDNs and won’t get in the way of checkout, lessons, or bookings.</p>
<h3>What Malcure Security Suite Focuses On</h3>
<ul>
<li><strong>Detect:</strong> Deep server-side malware scans (files + database), integrity/diff checks, and vulnerabilities.</li>
<li><strong>Control:</strong> Session analytics (user/IP/device), Emergency Logout (everyone except you), rotate auth keys & salts to invalidate tokens, and force site-wide re-login post-incident. Compatible with 2FA/SSO.</li>
<li><strong>Report:</strong> Clear, actionable summaries with exact file paths and reasons, email alerts with next steps, and audit-friendly logs for teams and compliance (coming-soon).</li>
<li><strong>Logging:</strong> Event logs with identifiable and traceable details.</li>
</ul>
<h3>How It Works (SaaS)</h3>
<ol>
<li>Secure Handshake: Your site authenticates with Malcure and pulls fresh threat intelligence (signatures, heuristics, rules and analysis).</li>
<li>Local-first scanning: Scans your files and database in the background.</li>
<li>Severity-ranked results: Findings are grouped by Critical/High/Medium/Low with exact specs, the reason they were flagged, and one-click actions plus email alerts and audit-ready logs.</li>
<li>Graceful: If the cloud is temporarily unreachable, Malcure Security Suite continues with last-known rules and logs locally until it reconnects.</li>
</ol>
<h3>Features</h3>
<ul>
<li>Deep server-side malware scans (files + database) using tuned signatures + heuristics.</li>
<li>Background scanning so long runs finish reliably on large sites.</li>
<li>Low overhead by design; preserves Core Web Vitals and optimized to minimize impact on site speed</li>
<li>Session management: see who’s logged in, from where.</li>
<li>Emergency Logout: one-click sign-out (everyone except you); rotate auth keys & salts to invalidate sessions.</li>
<li>Robust Event Monitor.</li>
<li>Optimal Dark Mode.</li>
</ul>
<h3>Highlights</h3>
<ul>
<li>Signature + heuristic detection for obfuscated/injected PHP/JS (backdoor/web-shell traits).</li>
<li>Database scan of options, postmeta, posts, and comments for malicious payloads.</li>
<li>Email notifications for critical events and scan results</li>
<li>Security status panel (permissions, environment)</li>
<li>Compatible with WooCommerce, LearnDash/TutorLMS, MemberPress/PMP, major booking/event plugins, WPML/Polylang, Elementor/Divi/Block Editor, and caching/CDNs (LiteSpeed Cache, WP Rocket, NGINX FastCGI, Cloudflare).</li>
</ul>
<h3>Premium (Pro)</h3>
<ul>
<li>Scheduled scans (daily/weekly/monthly) with summary emails.</li>
<li>WP-CLI automation for headless/CI workflows and cron.</li>
<li>Priority support with accelerated SLAs.</li>
</ul>


Malcure Security Suite

🔐 All-in-one WordPress security: malware scanner (files+DB), force re-login, force logout, control logins, email-alerts. Cloud-based, light & fast.

VulnTitan – Malware Scanner, Vulnerability Scanner & Security vs Malcure Security Suite