Security documentation

Security Documentation

How 3,000 WordPress sites are monitored, hardened, backed up and patched — the actual checks, schedules and tooling, documented.

Continuous monitoring

Always watching

Signals that run around the clock on every managed site.

every quicksave

Malware scan on code change

When a quicksave detects file changes in plugins, themes or mu-plugins, the changed files are scanned with Wordfence CLI and CaptainCore's own signature database.

  • Covers .php, .js, .html, .svg, .phtml and .phar files
  • Built-in signatures for blockchain C2, self-hiding plugins, remote eval, SEO spam and more
  • Findings trigger an immediate alert with site details and matched signatures
daily

WordPress core checksums

Every site's core files are verified against official WordPress.org checksums.

  • Detects modified core files — potential backdoor injection
  • Detects extra files that should not exist in core directories
  • Alerts list each file path and modification type
daily

Homepage capture & injection detection

Homepage captures are diffed for newly injected scripts and stylesheets.

  • Pattern-matched against a signature database of known malicious and safe domains
  • Findings carry a severity: critical, high or medium
daily

Google Web Risk

Every production site's home URL is checked against Google's Web Risk API.

  • Malware and unwanted-software distribution
  • Social engineering, including extended phishing detection
every 5 min

Uptime monitoring

HTTP health checks against every monitored homepage, with retry logic across system and Cloudflare DNS.

  • Validates the HTTP status code and HTML integrity
  • Escalating alerts: immediate, then 1h, 4h and 24h follow-ups
  • Recovery notifications when a site comes back
Baseline hardening

Secure by default

Every site ships with the CaptainCore Helper must-use plugin, which applies hardening automatically.

always on

Hardening defaults

Baseline protections applied to every site with no configuration.

  • User enumeration blocked: ?author= queries, the REST users endpoint, author sitemaps and oEmbed author URLs
  • Generic login errors that never confirm whether a username exists
  • WordPress version hidden from HTML and RSS output
  • Empty author archives return 404 instead of confirming usernames
  • Password reset requests limited by IP geolocation
always on

Security audit log

A tamper-evident trail of security-critical events on every site, queryable via WP-CLI.

  • User lifecycle: registrations, deletions, role changes, password resets, super admin grants
  • Plugin and theme installs, updates, activations and deletions — admin UI and WP-CLI
  • Security-critical options, file-editor access, application passwords and code snippets
Nightly automation

While you sleep

Backups, versioning and updates run every night — and each quicksave feeds the malware scanner.

daily 12:05 AM

Nightly backups

Full-site backups across all sites, 40 in parallel.

  • All previous backups retained indefinitely on efficient incremental storage
  • A clean restore point is always available within 24 hours
daily 12:15 AM

Nightly quicksaves

Versioned snapshots of all plugins, themes and mu-plugins, 16 in parallel.

  • Git-based versioning records exactly what changed and when
  • Changed files are automatically scanned for malware
Wed & Fri 6:15 AM

Managed updates

Plugin and theme updates on a staggered schedule for sites with updates enabled.

  • Staging updates Friday, production the following Wednesday
  • The staging window catches issues before they reach production
PHP EOL schedule

PHP lifecycle

The fleet is kept on actively supported PHP versions, tracked against the official end-of-life schedule.

  • Theme and plugin compatibility issues fixed before or during each upgrade
  • Deprecations, fatals and breaking changes addressed fleet-wide
Scheduled scans

Deeper, on a cycle

Slower, deeper passes that catch what the continuous monitors might miss.

~20 sites/day

Vulnerability audits

Installed plugins and themes are audited against the Security Finder vulnerability database on a rolling cycle.

  • Component versions checked against known CVEs and CVSS scores
  • Covers production and staging environments
  • Findings filtered to critical and high severity for immediate attention
weekly

PHP error sweep

The sites with the largest PHP error logs are analyzed and fixed in batches through the week.

  • Error patterns analyzed and targeted fixes applied
  • Every fix logged to the site's process log for an audit trail
Vulnerability response

When something is found

Centralized tracking, targeted alerts, and fleet-wide remediation.

continuous

Threat tracking

Security Finder maps vulnerabilities onto the fleet-wide component inventory.

  • Which sites run a vulnerable component, with direct remediation access
  • Status workflow from tracking to investigating to resolved, with timestamped notes
  • Resolution actions logged on each affected site
as needed

Fleet-wide patching

When a critical vulnerability is confirmed, patched builds deploy to every affected site in parallel.

  • Patched plugin and theme zips stored permanently in cloud storage
  • Deployed to up to 20 sites concurrently, each deployment verified and logged
  • Affected sites identified automatically from Security Finder data
on incident

Malware cleanup

Full-stack remediation for compromised sites.

  • Kills persistence mechanisms and removes malicious files
  • Reinstalls WordPress core and resets credentials
  • Verification loops run until the site checks out clean
Incident response toolkit

On-demand forensics

Investigation tooling built from real incident response, runnable per site or fleet-wide.

on demand

Malware hunt

A standalone scanner with over 50 detection patterns.

  • Backdoors and web shells: eval chains, cookie- and IP-gated shells
  • PHP hidden in uploads, images and CSS; malicious drop-in files
  • Self-hiding and trojanized plugins, C2 domains, blockchain-based resolvers
  • Obfuscation: hex encoding, chr() building, goto spaghetti, XOR loops
on demand

Timestamp forensics

Finds files with forged modification times — a common anti-forensic technique.

  • Five-pass filtering eliminates migration artifacts and known-benign files
  • Content-based backdoor detection on whatever remains
on demand

Role & capability audit

Audits WordPress roles and users for unauthorized privilege escalation.

  • Dangerous capabilities on non-administrator roles
  • Capabilities injected directly into user meta
  • Default registration role and open-registration settings
on demand

Database scan

Scans options, code snippets and widgets for executable code.

  • Credit card skimmers, obfuscated eval patterns, fake payment forms
  • PHP backdoor functions and superglobal access in stored code
every 6 hours

Third-party script integrity

Embedded third-party scripts are hash-verified on a schedule.

  • SHA256 comparison catches upstream supply-chain tampering
  • Companion checks for uploads-directory PHP and security-log growth

Alerting

Targeted email alerts for each threat scenario.

Alert Trigger Details included
Malware detection Signature match on quicksave Filename, signature name, description
Core checksum failure Modified or unexpected core files File paths, modification type
Injection detected New script or stylesheet in homepage capture Page, severity, injected element
Google Web Risk URL flagged by the Web Risk API Threat type, confidence
Uptime failure Site unreachable or invalid HTML HTTP code, error, escalation count
Default role changed Suspicious default user role setting Role name

Schedule summary

Every check, its cadence, and what it covers.

Check Frequency Scope
Uptime monitoring every 5 min All monitored sites
Malware scan on code change every quicksave Changed files
Homepage capture & injection detection daily All sites
WordPress core checksums daily All sites
Google Web Risk check daily All production sites
Nightly backups daily 12:05 AM All sites (40 parallel)
Nightly quicksaves + malware scan daily 12:15 AM All sites (16 parallel)
Third-party script integrity every 6 hours Embedded analytics
PHP upgrades & compatibility fixes follows PHP EOL schedule All sites
Managed updates — staging Fri 6:15 AM Staging (updates on)
Managed updates — production Wed 6:15 AM Production (updates on)
Vulnerability audit ~20 sites/day Rolling fleet coverage
PHP error sweep weekly, 3–4 batches Top error-log sites
Security patch deploy as needed All affected sites
Malware hunt / forensic tools on demand Individual or fleet

WordPress security documentation · last updated August 22, 2026