Agent Collect
Normalize
Package
One WordPress Agent. Multiple Specialized Security Engines.
Aegisify Audit Agent 1.9.21 combines vulnerability intelligence, source-code review, dependency audits, malware heuristics, file integrity, hardening, permissions, application inventory, WooCommerce intelligence, and compliance-oriented posture checks in one coordinated local assessment workflow.
The Scan Engines and Evidence Sources
Aegisify Audit Agent 1.9.21 does not depend on one generic scanner. The verified implementation combines specialized local engines and supporting data sources. Each engine answers a different security question and contributes evidence to the broader Aegisify Audit workflow.
Full Agent Scan
The full Agent scan runs a coordinated sequence of local assessments and returns a normalized report. It combines WordPress hardening, environment inventory, filesystem permissions, malware heuristics, file drift, related Aegisify product context, WooCommerce intelligence, and deep static code analysis.
The report includes a severity summary, affected components, evidence, timestamps, site context, plugin and theme inventory, health signals, scheduled events, and the telemetry policy applied to the collection.
WordPress Vulnerability Scan
The vulnerability engine builds an inventory of WordPress core, plugins, themes, and selected runtime or dependency components. It checks installed versions, available updates, inactive software, and automatic-update posture, then correlates eligible components with vulnerability intelligence.
The reviewed package integrates the WPVulnerability API for WordPress and supported runtime technologies. Findings can include vulnerability identifiers, affected versions, severity information, fixed-version guidance, references, and provider status. Results remain dependent on provider coverage, product identification, version accuracy, and current advisory data.
Static Code Analysis
Static analysis reviews source code without executing the application logic. The Agent’s verified execution path combines PHP_CodeSniffer, WordPress Coding Standards, WordPress Plugin Check-related rules, WordPress VIP standards, and native Aegisify checks.
PHP analysis looks for conditions such as unsafe database construction, missing prepared queries, insufficient nonce or capability controls, unvalidated input, unsafe output, risky redirects, upload handling problems, insecure deserialization, dynamic execution, server-side request forgery sinks, direct database behavior, token exposure in logs, and plugin packaging concerns.
JavaScript checks include unsafe HTML insertion, browser storage of sensitive tokens, and WordPress REST or AJAX calls that appear to lack expected request protection. Python checks include shell execution risks, unsafe object deserialization, dynamic SQL, outbound request risks, and exposed debug behavior.
Package and Dependency Audits
The inventory engine discovers supported dependency manifests and lockfiles for PHP Composer, JavaScript package managers, and Python projects. When the required local tooling is available, the Agent can run ecosystem-native audit commands and normalize their results.
Verified integrations include Composer audit, npm audit, Yarn audit, pnpm audit, and pip-audit. Findings can identify the affected package, ecosystem, advisory record, aliases such as CVE identifiers, severity, description, fixed versions, dependency path, and reference material.
Availability depends on the hosting environment. A missing executable, disabled process function, unsupported lockfile, restricted shell environment, or provider failure is reported as a capability or execution condition rather than converted into a false “clean” result.
Heuristic Malware Review
The malware component searches selected WordPress paths for higher-risk combinations of suspicious execution, obfuscation, encoded payloads, unexpected PHP files, variable function behavior, and decode-and-execute chains. It is designed to raise evidence for review instead of declaring that every unusual string is malicious.
This is a heuristic layer, not a guarantee that all malware will be detected. Custom plugins, licensed code protectors, migration utilities, backup software, and security tools can contain patterns that require human interpretation. Conversely, sophisticated malware can avoid common indicators. Aegisify Audit should present these results with evidence, confidence, and surrounding context.
Baseline and File Drift Monitoring
The Agent can create file hash baselines for approved WordPress content areas and compare later snapshots to identify added, changed, or removed files. Drift events can be placed on a timeline and correlated with activity records and later scan results.
A file change is not automatically an attack. Updates, deployments, cache generation, image processing, and routine administration can change the filesystem. The value comes from identifying the change, the location, the time, and the related operational evidence so the team can decide whether the change was expected.
WordPress Hardening Review
The hardening engine checks security-relevant WordPress conditions such as software version exposure, XML-RPC availability, debugging posture, administrator transport security, file editor controls, software modification controls, and common public files that may reveal unnecessary information.
These checks explain whether protective settings are present and observable. They do not assume that one setting is correct for every deployment. For example, an integration may legitimately require XML-RPC, while another site may safely disable it. The report should therefore connect the setting to site purpose and exposure.
Permission and Recent-Change Review
The permission scan reviews important WordPress directories for overly permissive filesystem modes and collects a bounded list of recently changed PHP files within the content area. This helps identify conditions where web processes or unrelated accounts may have more write access than intended.
Hosting models differ, so permissions must be interpreted with server ownership, deployment practices, managed-host controls, and required write paths in mind. The Agent reports the observed condition; the remediation decision belongs to the site owner or hosting administrator.
WordPress, REST, AJAX, Role, Runtime, and Database Inventory
The local inventory maps WordPress core, standard plugins, must-use plugins, themes, privileged roles, capabilities, runtime details, database posture, Site Health signals, scheduled events, REST routes, public or mutating interfaces, and authenticated or unauthenticated AJAX actions.
This is important because WordPress risk is not limited to installed plugin names. Custom routes, public actions, role changes, runtime components, database privileges, and scheduled tasks can materially change the attack surface and the evidence needed to review it.
WooCommerce Security Intelligence
When WooCommerce is present, the Agent examines security and reliability conditions around the commerce environment. The verified review includes platform and update posture, checkout transport, payment gateway configuration, webhooks, API keys and permissions, Store API exposure, High-Performance Order Storage status, scheduled job failures, template overrides, local log indicators, and privileged user counts.
The WooCommerce payload is designed around versions, configuration posture, route names, counts, hashed destination hosts, compatibility metadata, job status, template versions, and local sensitive-pattern indicators—not customer order content or payment card data.
Compliance-Oriented Posture Checks
The Agent includes metadata-based checks influenced by secure configuration baselines, including STIG and SRG concepts. The reviewed controls examine areas such as security headers, cookie protections, XML-RPC exposure, public REST and AJAX surfaces, file editor settings, database SQL mode, and elevated database privileges.
These checks are evidence for technical review. They are not a certification, an authorization decision, or proof that a WordPress site complies with a law, regulation, contract, or government baseline. Formal compliance requires defined scope, applicable controls, implementation evidence, organizational processes, and an authorized assessment process.
Evidence Requires Context, Coverage and Verification
Aegisify Agent Scan Engines FAQ
Does the Aegisify Agent rely on one vulnerability scanner?
No. The verified Agent combines an orchestrated full scan with vulnerability correlation, static code analysis, package audits, malware heuristics, file drift, hardening, permission review, application inventory, WooCommerce intelligence, and baseline-oriented checks.
Does static analysis execute WordPress plugin code?
No. Static analysis inspects source files and patterns without executing the application behavior. Findings still require review of the actual code path and runtime context.
What happens when Composer, npm, Yarn, pnpm, or pip-audit is unavailable?
The Agent reports the missing executable, unsupported lockfile, disabled process capability, restricted environment, or execution failure as a coverage condition. It should not report that dependency scope as clean.
Does a malware heuristic finding prove that a file is malicious?
No. Obfuscation, encoded data, dynamic execution, and unusual PHP placement can be meaningful indicators, but legitimate software can contain similar patterns. The evidence requires human review and surrounding context.
Can the Agent scan WooCommerce without collecting customer orders or payment data?
The verified WooCommerce review is designed around versions, configuration posture, route names, counts, hashed destination hosts, compatibility metadata, job status, template versions, and local indicators rather than normal collection of order content or payment card data.
Do the scan engines guarantee that a WordPress site is secure?
No. Scan coverage depends on the selected scope, supported files and technologies, provider data, local tooling, hosting restrictions, permissions, and the site state at the time of inspection.
Scan Engine References
The scan descriptions are based on capabilities verified in Aegisify Audit Agent 1.9.21 and terminology aligned with WordPress Coding Standards, WordPress Plugin Check guidance, WPVulnerability, Composer audit documentation, npm audit documentation, and pip-audit.