Security Documentation
How 3,000 WordPress sites are monitored, hardened, backed up and patched — the actual checks, schedules and tooling, documented.
Always watching
Signals that run around the clock on every managed site.
Malware scan on code change
When a quicksave detects file changes in plugins, themes or mu-plugins, the changed files are scanned with Wordfence CLI and CaptainCore's own signature database.
- Covers .php, .js, .html, .svg, .phtml and .phar files
- Built-in signatures for blockchain C2, self-hiding plugins, remote eval, SEO spam and more
- Findings trigger an immediate alert with site details and matched signatures
WordPress core checksums
Every site's core files are verified against official WordPress.org checksums.
- Detects modified core files — potential backdoor injection
- Detects extra files that should not exist in core directories
- Alerts list each file path and modification type
Homepage capture & injection detection
Homepage captures are diffed for newly injected scripts and stylesheets.
- Pattern-matched against a signature database of known malicious and safe domains
- Findings carry a severity: critical, high or medium
Google Web Risk
Every production site's home URL is checked against Google's Web Risk API.
- Malware and unwanted-software distribution
- Social engineering, including extended phishing detection
Uptime monitoring
HTTP health checks against every monitored homepage, with retry logic across system and Cloudflare DNS.
- Validates the HTTP status code and HTML integrity
- Escalating alerts: immediate, then 1h, 4h and 24h follow-ups
- Recovery notifications when a site comes back
Secure by default
Every site ships with the CaptainCore Helper must-use plugin, which applies hardening automatically.
Hardening defaults
Baseline protections applied to every site with no configuration.
- User enumeration blocked: ?author= queries, the REST users endpoint, author sitemaps and oEmbed author URLs
- Generic login errors that never confirm whether a username exists
- WordPress version hidden from HTML and RSS output
- Empty author archives return 404 instead of confirming usernames
- Password reset requests limited by IP geolocation
Security audit log
A tamper-evident trail of security-critical events on every site, queryable via WP-CLI.
- User lifecycle: registrations, deletions, role changes, password resets, super admin grants
- Plugin and theme installs, updates, activations and deletions — admin UI and WP-CLI
- Security-critical options, file-editor access, application passwords and code snippets
While you sleep
Backups, versioning and updates run every night — and each quicksave feeds the malware scanner.
Nightly backups
Full-site backups across all sites, 40 in parallel.
- All previous backups retained indefinitely on efficient incremental storage
- A clean restore point is always available within 24 hours
Nightly quicksaves
Versioned snapshots of all plugins, themes and mu-plugins, 16 in parallel.
- Git-based versioning records exactly what changed and when
- Changed files are automatically scanned for malware
Managed updates
Plugin and theme updates on a staggered schedule for sites with updates enabled.
- Staging updates Friday, production the following Wednesday
- The staging window catches issues before they reach production
PHP lifecycle
The fleet is kept on actively supported PHP versions, tracked against the official end-of-life schedule.
- Theme and plugin compatibility issues fixed before or during each upgrade
- Deprecations, fatals and breaking changes addressed fleet-wide
Deeper, on a cycle
Slower, deeper passes that catch what the continuous monitors might miss.
Vulnerability audits
Installed plugins and themes are audited against the Security Finder vulnerability database on a rolling cycle.
- Component versions checked against known CVEs and CVSS scores
- Covers production and staging environments
- Findings filtered to critical and high severity for immediate attention
PHP error sweep
The sites with the largest PHP error logs are analyzed and fixed in batches through the week.
- Error patterns analyzed and targeted fixes applied
- Every fix logged to the site's process log for an audit trail
When something is found
Centralized tracking, targeted alerts, and fleet-wide remediation.
Threat tracking
Security Finder maps vulnerabilities onto the fleet-wide component inventory.
- Which sites run a vulnerable component, with direct remediation access
- Status workflow from tracking to investigating to resolved, with timestamped notes
- Resolution actions logged on each affected site
Fleet-wide patching
When a critical vulnerability is confirmed, patched builds deploy to every affected site in parallel.
- Patched plugin and theme zips stored permanently in cloud storage
- Deployed to up to 20 sites concurrently, each deployment verified and logged
- Affected sites identified automatically from Security Finder data
Malware cleanup
Full-stack remediation for compromised sites.
- Kills persistence mechanisms and removes malicious files
- Reinstalls WordPress core and resets credentials
- Verification loops run until the site checks out clean
On-demand forensics
Investigation tooling built from real incident response, runnable per site or fleet-wide.
Malware hunt
A standalone scanner with over 50 detection patterns.
- Backdoors and web shells: eval chains, cookie- and IP-gated shells
- PHP hidden in uploads, images and CSS; malicious drop-in files
- Self-hiding and trojanized plugins, C2 domains, blockchain-based resolvers
- Obfuscation: hex encoding, chr() building, goto spaghetti, XOR loops
Timestamp forensics
Finds files with forged modification times — a common anti-forensic technique.
- Five-pass filtering eliminates migration artifacts and known-benign files
- Content-based backdoor detection on whatever remains
Role & capability audit
Audits WordPress roles and users for unauthorized privilege escalation.
- Dangerous capabilities on non-administrator roles
- Capabilities injected directly into user meta
- Default registration role and open-registration settings
Database scan
Scans options, code snippets and widgets for executable code.
- Credit card skimmers, obfuscated eval patterns, fake payment forms
- PHP backdoor functions and superglobal access in stored code
Third-party script integrity
Embedded third-party scripts are hash-verified on a schedule.
- SHA256 comparison catches upstream supply-chain tampering
- Companion checks for uploads-directory PHP and security-log growth
Alerting
Targeted email alerts for each threat scenario.
| Alert | Trigger | Details included |
|---|---|---|
| Malware detection | Signature match on quicksave | Filename, signature name, description |
| Core checksum failure | Modified or unexpected core files | File paths, modification type |
| Injection detected | New script or stylesheet in homepage capture | Page, severity, injected element |
| Google Web Risk | URL flagged by the Web Risk API | Threat type, confidence |
| Uptime failure | Site unreachable or invalid HTML | HTTP code, error, escalation count |
| Default role changed | Suspicious default user role setting | Role name |
Schedule summary
Every check, its cadence, and what it covers.
| Check | Frequency | Scope |
|---|---|---|
| Uptime monitoring | every 5 min | All monitored sites |
| Malware scan on code change | every quicksave | Changed files |
| Homepage capture & injection detection | daily | All sites |
| WordPress core checksums | daily | All sites |
| Google Web Risk check | daily | All production sites |
| Nightly backups | daily 12:05 AM | All sites (40 parallel) |
| Nightly quicksaves + malware scan | daily 12:15 AM | All sites (16 parallel) |
| Third-party script integrity | every 6 hours | Embedded analytics |
| PHP upgrades & compatibility fixes | follows PHP EOL schedule | All sites |
| Managed updates — staging | Fri 6:15 AM | Staging (updates on) |
| Managed updates — production | Wed 6:15 AM | Production (updates on) |
| Vulnerability audit | ~20 sites/day | Rolling fleet coverage |
| PHP error sweep | weekly, 3–4 batches | Top error-log sites |
| Security patch deploy | as needed | All affected sites |
| Malware hunt / forensic tools | on demand | Individual or fleet |
WordPress security documentation · last updated August 22, 2026