WP Drop-in & Persistence Shield

WP Drop-in & Persistence Shield is a lightweight, zero-bloat WordPress security plugin purpose-built to stop self-healing WordPress malware, drop-in hijacking (db.php, advanced-cache.php, object-cache.php), unauthorized Must-Use (MU) plugins, theme functions.php droppers, and rogue Administrator account creation.

Why This Plugin Exists

Modern WordPress malware strains (such as the SCV:5.1.2 / flux-profiler-dex / Prime Widget family) do not rely on a single infected plugin. Instead, they establish multi-layered persistence across WordPress:

1. Drop-in Hijacking: Writing obfuscated code to wp-content/db.php, wp-content/advanced-cache.php, or wp-content/object-cache.php so the payload runs before normal plugins load (and often causes fatal redeclaration errors like Cannot redeclare voru()).
2. Must-Use Plugin Persistence: Dropping hidden or disguised files into wp-content/mu-plugins/ (e.g., flux-profiler-dex.php) and hidden shadow directories (wp-content/.sc_*).
3. Theme functions.php Self-Healing: Injecting obfuscated dropper blocks (/* SC_TH_BEGIN ... SC_TH_END */) into active and inactive themes so that deleting the malware file from mu-plugins or plugins immediately recreates it on the next page load.
4. Rogue Administrator Accounts: Silently inserting backdoor admin users (e.g. administrator_<hex>) directly into wp_users and wp_usermeta.
5. WP-Cron & wp_options C2: Scheduling recurring resurrection tasks (sc_cron_guard, sc_cron_recovery, sc_cron_fetch) and storing encrypted payloads in wp_options.

WP Drop-in & Persistence Shield neutralizes every single one of these persistence vectors in real time.

Key Features

• Drop-in Guard: Monitors wp-content/ for unauthorized drop-ins (db.php, advanced-cache.php, object-cache.php, maintenance.php, sunrise.php) and immediately removes them unless explicitly whitelisted by the site owner.
• MU-Plugin Guard: Enforces a strict whitelist on wp-content/mu-plugins/ and purges .sc_* shadow directories and webroot __PATH__ droppers.
• Theme functions.php Self-Healing Stripper: Automatically detects and strips /* SC_TH_BEGIN ... SC_TH_END */ and __scf_ obfuscated droppers if an attacker or script attempts to inject them into your theme.
• Strict Administrator Whitelist: Locks down who can hold the administrator capability. Any unauthorized admin account created via SQL injection, vulnerable plugins, or wp_insert_user is deleted immediately.
• Database & WP-Cron Guard: Blocks malicious option writes (sc_*, _transient_sc_*, flux-profiler*) via pre_update_option and unschedules malicious WP-Cron hooks automatically.
• XML-RPC & C2 Probe Firewall: Completely disables XML-RPC (/xmlrpc.php returns 403 Forbidden) and blocks C2 trigger headers/parameters (HTTP_X_SC_KEY, ?sc_c=, ?sc_cb=, ?p=97760610).
• One-Click MU-Plugin Mode: Can be installed as a standard plugin (wp-content/plugins/wp-persistence-shield/) or promoted with one click to wp-content/mu-plugins/ so it runs at the earliest possible WordPress lifecycle stage.

Installation

Option 1: Standard WordPress Plugin (with 1-Click MU Promotion)

1. Download the latest release ZIP or clone this repository into wp-content/plugins/wp-persistence-shield/:

   cd /path/to/wordpress/wp-content/plugins/
   git clone https://github.com/abdulwajidck/wp-persistence-shield.git

2. Activate WP Drop-in & Persistence Shield in WP Admin → Plugins.
3. Go to Settings → Persistence Shield, review your whitelisted Administrator usernames, and click Install MU-Plugin Loader for early-boot protection.

Option 2: Direct Must-Use (MU) Plugin Installation (Recommended for Hardened Servers)

Copy wp-persistence-shield.php directly into wp-content/mu-plugins/ and lock its ownership to root:

cp wp-persistence-shield.php /path/to/wordpress/wp-content/mu-plugins/wp-persistence-shield.php
chown root:www-data /path/to/wordpress/wp-content/mu-plugins/wp-persistence-shield.php
chmod 640 /path/to/wordpress/wp-content/mu-plugins/wp-persistence-shield.php

Configuration

Navigate to Settings → Persistence Shield in WP-Admin to configure:

• Allowed Drop-ins: Leave empty unless you use a known object/page cache drop-in (such as Redis Object Cache object-cache.php or WP Rocket advanced-cache.php).
• Allowed MU-Plugins: List legitimate files in wp-content/mu-plugins/.
• Allowed Administrator Usernames: Only usernames on this list are permitted to hold the administrator role when Administrator Whitelist is enabled.
• Blocked Option Prefixes & Cron Hooks: Customize prefixes and cron hooks blocked from wp_options.

License

Released under the GNU General Public License v2.0 or later.