SM Fix – Security Incident Response for WordPress

Investigate, trace, and remediate WordPress security incidents. Get a forensic report, quarantine threats, and fix issues with one click.

Description

Something happened to your WordPress site. Maybe you noticed unfamiliar admin accounts. Maybe your host flagged suspicious files. Maybe a visitor told you your site was redirecting somewhere it shouldn't.

SM Fix is what you run next.

It investigates your site for signs of compromise, produces a severity-ranked forensic report, and gives you one-click automated fixes for everything that's safe to automate — with plain-English manual instructions for everything that isn't.

What SM Fix checks

• File system — PHP files in uploads, recently modified files, suspicious filenames, world-writable permissions
• Database — unknown admin accounts, elevated user capabilities, malware payload patterns in wp_options
• Configuration — WP_DEBUG in production, file editor status, debug logging, SSL enforcement
• Plugins and themes — nulled plugins, recently modified files, inactive installs
• Users and authentication — default admin usernames, application passwords, accounts with no email
• Network and output — injected outbound URLs, hidden iframes, script tag injections in theme files
• Core integrity — compares every core file against official WordPress checksums
• Log review — reads your debug log and server error log for indicators of attack

What SM Fix does when it finds something

Some findings get a one-click fix button. These are safe, reversible, scoped actions — quarantining a suspicious file, disabling debug mode, revoking an application password. Every automated action snapshots the affected file or setting before making any change.

Everything else gets a clear manual instruction. No buttons that do things you can't undo. No false promises.

Privacy — your data never leaves your server

SM Fix collects no data, no analytics, and no telemetry by default. Your scan results are stored in your WordPress installation and nowhere else. We have no account system, no registration, and no visibility into your site or your findings. We are blind to everything you do with this plugin — by design.

The only outbound request SM Fix makes is to api.wordpress.org to retrieve official WordPress core checksums during the core integrity check. This request includes your WordPress version number and nothing else. You can disable this check entirely in the plugin settings.

If you use the AI interpretation feature, the list of scan findings (not your site content, files, or database) is sent to the Anthropic API using your own API key. You control that key, that cost, and that relationship. SM Fix itself sends nothing to Anthropic or any other third party.

AI interpretation (optional)

Add your own Anthropic API key in Settings to enable plain-English interpretation of your scan findings. SM Fix will summarise what likely happened, which findings are most urgent, and what patterns across findings suggest about the nature of the attack.

This feature is entirely optional and disabled by default. No API key is bundled with the plugin.

Installation

1. Upload the sm-fix folder to /wp-content/plugins/
2. Activate the plugin through the Plugins menu in WordPress
3. Navigate to SM Fix in the admin sidebar
4. Click Run Scan

No configuration required to run your first scan. An API key is optional and only needed for AI interpretation of findings.

Frequently Asked Questions

Does SM Fix prevent attacks?

No. SM Fix responds to incidents after they happen. For prevention, pair it with a firewall plugin such as NinjaFirewall or Wordfence.

Will SM Fix delete any of my files?

No. Automated actions move suspicious files to a protected evidence directory — they're never permanently deleted. You can review everything before deciding what to do with it.

Do you see my scan results?

No. Your results are stored in your WordPress directory on your server. SM Fix has no visibility into your site or your findings.

What is the only external request SM Fix makes?

The core integrity check sends your WordPress version number to api.wordpress.org to retrieve the official file checksums for your version. No site data is included. You can disable this check in Settings.

Does SM Fix work on multisite installations?

Not in v1.0. Multisite support is planned as a paid feature in a future release.

What happens to my data if I uninstall SM Fix?

Use the Delete all data option in Settings before uninstalling. This removes all scan history and plugin settings from your database. Nothing is stored on our end to delete.

Can I run SM Fix on a live production site?

Yes. The scan is read-only except where you explicitly trigger a one-click fix. It does not modify your site, your files, or your database during the scan itself.

How long does a scan take?

Typically 30–90 seconds, depending on the size of your site and whether the core integrity check is enabled. The core integrity check requires an outbound connection and may be slower on some hosting environments.

Screenshots

1. Dashboard — pre-scan state with hosting provider detection and privacy statement
2. Scan in progress — phase-by-phase progress with rotating tips
3. Report view — severity-ranked findings with one-click fix buttons
4. Settings — API key, scan options, notifications, privacy statement, and data management

Changelog

1.0.0

• Initial release
• Eight scan categories: file system, configuration, database, plugins and themes, users and authentication, network and output, core integrity, log review
• Seven one-click fix actions
• AI interpretation panel (optional, user-supplied API key)
• Hosting provider detection for seven providers
• Scan history with comparison view
• Evidence directory with quarantine, snapshots, and action log

Upgrade Notice

1.0.0

Initial release.