🛡️ WP ShieldX

Next-Generation WordPress Cyber Defense, Real-Time File Integrity & Threat Remediation Suite

Key Features • Architecture • Installation • Compatibility • Audit Results • Credits

⚡ Short Description

WP ShieldX is a lightweight, zero-bloat WordPress cybersecurity suite providing real-time file integrity tracking (added, modified, deleted), multi-vector WAF attack defense (SQLi, XSS, RFI), deep heuristic malware & webshell scanning via the official WordPress.org Checksums API, 1-click system hardening, and automated file quarantine with core repair.

🌟 Why WP ShieldX?

Most traditional security plugins:

• ❌ Flood your MySQL database with hundreds of megabytes of live traffic bloat.
• ❌ Rely strictly on static hash files, missing newly added backdoors or silent edits to core files.
• ❌ Require complex server setups (auto_prepend_file, editing php.ini or .user.ini).
• ❌ Leave messy orphaned tables and broken .htaccess rules upon uninstallation.

WP ShieldX was engineered from the ground up to be different:

• ✅ Zero Bloat: Lightweight, non-intrusive database schema using indexed custom tables.
• ✅ Dual-Tier Real-Time File Monitoring: In-memory upload interception + sub-millisecond root file micro-checks.
• ✅ Official WordPress.org Checksums Integration: Verifies core integrity directly against pristine release hashes.
• ✅ Complete Self-Contained Remediation: 1-click quarantine vault, official core file repair, and pre-update rollback snapshots.
• ✅ 100% Pristine Uninstall: Leaves 0 orphaned tables, 0 leftover junk files, and 0 broken server rules.

🚀 Key Features

1. 📁 Real-Time File Integrity Monitor (FIM)

• Cryptographic Baseline: Tracks root files, core libraries, plugins, themes, and media uploads using cryptographic SHA-256 snapshots.
• Granular Change Detection: Instantly alerts on newly created, modified, or deleted files.
• In-Memory Upload Interceptor: Intercepts files via wp_handle_upload_prefilter, blocking executable scripts (.php, .phtml, .phar) and polyglot embedded image webshells before they can touch your disk.
• Parent-Level Config Detection: Automatically monitors wp-config.php even if it is stored one directory above the web root.

2. 🧬 Deep Malware & Weird Pattern Scanner

• WordPress.org Checksums API: Connects directly to api.wordpress.org/core/checksums/1.0/ to verify every core file against official releases.
• YARA-Grade Heuristics & Webshell Signatures:
  • Obfuscated dynamic executions (eval(base64_decode()), gzinflate, str_rot13, hex2bin, pack).
  • Deprecated regex code execution (preg_replace /e).
  • Direct user input command execution (system($_POST), exec($_GET), passthru($_REQUEST)).
  • Known webshell markers (c99, r57, WSO, b374k, FilesMan, IndoXploit, Alfa Team).
  • Silent admin user creations (wp_create_user + set_role('administrator')).
• Shannon Entropy Analysis: Detects packed, encrypted, or high-density obfuscated strings.

3. 🛡️ Active Web Application Firewall (WAF)

• Request Inspection: Filters GET, POST, COOKIE, and raw REQUEST_URI inputs before requests reach your themes or database.
• Exploit Defenses:
  • SQL Injection (SQLi): Stops UNION SELECT, SLEEP(), BENCHMARK(), and blind injection vectors.
  • Cross-Site Scripting (XSS): Blocks `