Repackaged release; identical in behaviour to 2.3.2.<\/p>","2.3.2":"
Activation no longer removes anything, auto-clean is off by default, and an\noption is only removed when its value carries a malware marker.<\/p>","2.3.1":"
Correct handling of installs that move or rename wp-content, the plugins\ndirectory or mu-plugins.<\/p>","2.3.0":"
Quarantined files move from disk into the database, restoring a removed file\nbecomes a download, and the file editor now follows the WordPress Hardening\nsetting.<\/p>","2.2.0":"
Adds database and account scanning, quarantine with one-click restore, and much\nstricter malware-removal gates. Recommended for all users.<\/p>","2.1.0":"
Malware Shield no longer removes a file on a generic heuristic alone.<\/p>","2.0.0":"
Major rewrite: safe-by-default, firewall is now opt-in and never edits requests.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3720899,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3720899,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3720899,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3720899,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.3.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3720979,"resolution":"1","location":"assets","locale":"","width":1920,"height":3210},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3720979,"resolution":"2","location":"assets","locale":"","width":1920,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3720979,"resolution":"3","location":"assets","locale":"","width":1920,"height":520},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3720979,"resolution":"4","location":"assets","locale":"","width":1920,"height":977},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3720979,"resolution":"5","location":"assets","locale":"","width":1920,"height":1754}},"screenshots":{"1":"The Protection tab. Every feature carries a Safe, Opt-in or Advanced badge, and core protection is already on after activation.","2":"Malware Shield. Scan-only and scan-and-clean runs, plus a plain account of what a plugin alone cannot fix after an infection.","3":"Findings and quarantine. A clean install reports nothing at all, and anything the shield does remove is kept as a copy you can download again.","4":"Account-wide scan. Read-only: it looks at every site under the same hosting user and never changes anything outside this one.","5":"The activity log, and the full list of event types it can record."}},"plugin_section":[],"plugin_tags":[2439,1174,31093,1184,600],"plugin_category":[54],"plugin_contributors":[283652],"plugin_business_model":[],"class_list":["post-364454","plugin","type-plugin","status-publish","hentry","plugin_tags-brute-force","plugin_tags-firewall","plugin_tags-hardening","plugin_tags-malware","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-adnanali32038","plugin_committers-adnanali32038"],"banners":{"banner":"https:\/\/ps.w.org\/stillward-security\/assets\/banner-772x250.png?rev=3720899","banner_2x":"https:\/\/ps.w.org\/stillward-security\/assets\/banner-1544x500.png?rev=3720899","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/stillward-security\/assets\/icon-128x128.png?rev=3720899","icon_2x":"https:\/\/ps.w.org\/stillward-security\/assets\/icon-256x256.png?rev=3720899","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/stillward-security\/assets\/screenshot-1.png?rev=3720979","caption":"The Protection tab. Every feature carries a Safe, Opt-in or Advanced badge, and core protection is already on after activation."},{"src":"https:\/\/ps.w.org\/stillward-security\/assets\/screenshot-2.png?rev=3720979","caption":"Malware Shield. Scan-only and scan-and-clean runs, plus a plain account of what a plugin alone cannot fix after an infection."},{"src":"https:\/\/ps.w.org\/stillward-security\/assets\/screenshot-3.png?rev=3720979","caption":"Findings and quarantine. A clean install reports nothing at all, and anything the shield does remove is kept as a copy you can download again."},{"src":"https:\/\/ps.w.org\/stillward-security\/assets\/screenshot-4.png?rev=3720979","caption":"Account-wide scan. Read-only: it looks at every site under the same hosting user and never changes anything outside this one."},{"src":"https:\/\/ps.w.org\/stillward-security\/assets\/screenshot-5.png?rev=3720979","caption":"The activity log, and the full list of event types it can record."}],"raw_content":"\n
Stillward Security follows one rule: protect, don't disturb.<\/strong><\/p>\n\n Most security plugins break sites by aggressively filtering requests, stripping\nform data, whitelisting file types, or forcing strict policies. Stillward ships\nwith only non-breaking<\/em> hardening enabled by default. Anything that can affect\nhow your site works is turned OFF until you knowingly enable it.<\/p>\n\n Enabled by default (safe on any site):<\/strong><\/p>\n\n Opt-in (off by default \u2014 enable knowingly):<\/strong><\/p>\n\n Malware Shield \u2014 and why it will not eat your files<\/strong><\/p>\n\n The Malware Shield hunts one specific, self-healing infection (fake Everything that is<\/em> removed is copied into the plugin's own database table\nfirst -- never into another file on the server, because a copy of malware on\ndisk is still malware on disk. If a removal turns out to be a mistake, download\nthe copy from the Malware Shield tab and put it back. Removed options and cron\nevents are backed up the same way and restore in one click. An infected theme\n functions.php is never modified or deleted: it is reported, so you can\nreinstall a clean copy of the theme.<\/p>\n\n Developers can force report-only behaviour for any path with the\n wpss_malware_auto_removable and Database Audit \u2014 the things a file scanner cannot see<\/strong><\/p>\n\n A file scanner is blind to a compromise that never writes a file, and that is\nnot a hypothetical: an SEO-cloaking campaign ran for four months across eight\nsites on one hosting account while hourly scans reported clean, because its code\nlived in a plugin's database table, its configuration in an option, its spam in\n wp_posts, and its administrators were inserted straight into The audit runs alongside the file scan and asks three questions that have exact\nanswers:<\/p>\n\n Nothing found in the database is ever changed automatically. A confirmed rogue\nadministrator can be demoted to Subscriber with its sessions ended and password\nreset \u2014 never deleted \u2014 and the previous role, capabilities and password hash go\ninto quarantine first so Restore puts the account back exactly as it was.<\/p>\n\n Critical findings are e-mailed the moment they are recorded: once per distinct\nfinding per day, at most twelve an hour, and only for findings that mean\nsomething got in. Routine lockouts and firewall blocks are logged but never\nmailed, because an alert that is always noise teaches people to ignore alerts.<\/p>\n\n Safety guarantees<\/strong><\/p>\n\n That is the one thing it is built not to do. Only non-breaking hardening is on\nafter activation. Every feature that can change how your site behaves -- the\nrequest firewall, Content-Security-Policy, HSTS, the strict MIME whitelist, the\ncustom login URL and XML-RPC blocking -- is off until you turn it on yourself.<\/p><\/dd>\n Three gates must all pass before anything is removed:<\/p>\n\n Everything removed is copied into the plugin's own database table first --\nnever onto disk -- and can be downloaded again from the Malware Shield tab.<\/p><\/dd>\n No. It never edits, strips or re-encodes a submitted request. It runs in\nlog-only mode by default and blocks only if you switch it to Block mode.<\/p><\/dd>\n Only if nothing depends on it. Leave it enabled if you use Jetpack, the\nWordPress mobile app, or any service that publishes to your site remotely.<\/p><\/dd>\n One, and only WordPress.org's own API. When the Malware Shield inspects a file\nin wp-includes, wp-admin or the web root, it asks WordPress's built-in\nget_core_checksums() for the official checksum manifest of your WordPress\nversion, so it can tell a file WordPress genuinely ships from one an attacker\nplanted. That request goes to api.wordpress.org -- the same endpoint WordPress\nitself uses for updates -- and carries only your WordPress version number and\nlocale. Nothing about your site, its content or its users is sent. The manifest\nis cached, and if the request fails the scanner simply reports those files\ninstead of judging them.<\/p>\n\n There is no telemetry, no analytics, no third-party service and no registration.\nEverything else the plugin records stays in your own database.<\/p><\/dd>\n Uninstall removes its options, its log and quarantine tables and its scheduled\ntasks, on every site in a multisite network. Accounts you demoted\nthrough the account scanner are deliberately left as they are -- silently\nrestoring an administrator during an uninstall would be dangerous.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
\n
db.php<\/code> \/\n advanced-cache.php drop-ins, vapor-*<\/code> \/ host-*-bridge<\/code> mu-plugins, injected\ntheme functions.php<\/code>, sc_*<\/code> options and cron). Deleting a legitimate file is\nworse than the malware, so three gates must all pass before anything is removed:<\/p>\n\n\n
\/uploads<\/code>,\nthe wp-content\/cache<\/code> staging copy, filenames it is known to plant, and any\nfile in wp-includes<\/code>\/wp-admin<\/code>\/the web root that the official WordPress\nchecksum manifest says WordPress does not ship.\nA file that IS part of a real plugin, theme or WordPress itself is never\ndeleted<\/strong> \u2014 it is reported instead, because an infected real file needs\nreinstalling, not erasing. wp-config.php<\/code> is never deleted under any\ncircumstance.<\/li>\nwpss_malware_protected_paths<\/code> filters.<\/p>\n\nwp_users<\/code>.<\/p>\n\n\n
md5(sha1($host))<\/code>, so the name is different on every\nsite and no blocklist can list it \u2014 but the same name can be computed here and\nlooked up. There is no false-positive surface at all. Autoloaded 32-hex option\nnames in general are raised as a warning.<\/li>\nuser_login<\/code> values are\ntreated the same way \u2014 WordPress will not create one.<\/li>\n\n
\n
stillward-security<\/code> folder to \/wp-content\/plugins\/<\/code>, or install\nthe ZIP via Plugins \u2192 Add New \u2192 Upload Plugin.<\/li>\n\n
Will this plugin break my site?<\/h3><\/dt>\n
The Malware Shield deletes files. How do I know it will not delete mine?<\/h3><\/dt>\n
\n
Does the firewall change my form data?<\/h3><\/dt>\n
Should I disable XML-RPC?<\/h3><\/dt>\n
Does the plugin contact any external service?<\/h3><\/dt>\n
What happens when I delete the plugin?<\/h3><\/dt>\n
2.3.3<\/h4>\n\n
\n
2.3.2<\/h4>\n\n
\n
2.3.1<\/h4>\n\n
\n
2.3.0<\/h4>\n\n
\n
2.2.0<\/h4>\n\n
\n
s:13:\"administrator\";b:1<\/code>. Every\naccount created by SQL injection on those eight sites wrote a string<\/em> there\ninstead, because the row was built by hand. That one difference found four\nrogue administrators and zero false positives. Duplicated user_login values \u2014\nwhich WordPress refuses to create \u2014 are treated the same way. Softer signals\n(no e-mail address, a registration date that contradicts the account's own ID,\nnever used at all) are reported together as a warning rather than separately\nas noise.<\/li>\n.claude\/<\/code>\nconfiguration. Dot-files and dot-directories are now excluded from the build.<\/li>\n<\/ul>\n\n2.1.4<\/h4>\n\n
\n
2.1.3<\/h4>\n\n
\n
2.1.2<\/h4>\n\n
\n
2.1.1<\/h4>\n\n
\n
sc_%<\/code> prefix.<\/li>\n2.0.0<\/h4>\n\n
\n