Local WordPress Signals Become Reviewable Audit Intelligence
The Agent collects approved local evidence, passes it through a verified security channel, and returns structured findings to Aegisify Audit SaaS for correlation, prioritization, reporting, and verification.
Local scanners and sensors collect only the evidence allowed by the site’s scan scope and telemetry policy.
Structured Agent results are combined with external evidence and scan history instead of becoming an uncontrolled site-data dump.
See What an External WordPress Scan Cannot See
The Aegisify Audit Agent is the authorized WordPress-side component of Aegisify Audit. It collects local security evidence, evaluates software and code, monitors important changes, and securely returns structured results to the Aegisify Audit SaaS platform for prioritization, reporting, and verification.
What Does the Aegisify Audit Agent Do?
A public website scan can observe exposed pages, headers, technologies, network behavior, and other evidence visible from the internet. It cannot safely inspect everything inside WordPress. The Aegisify Audit Agent closes that visibility gap by performing authorized local inspection from within the customer’s WordPress environment.
The Agent inventories WordPress core, plugins, themes, runtime components, selected dependencies, roles, capabilities, scheduled events, REST routes, AJAX actions, database posture, and security-relevant configuration. It also performs vulnerability correlation, static code analysis, heuristic malware review, file drift monitoring, permission checks, WooCommerce security intelligence, activity logging, and compliance-oriented posture checks.
Results are normalized into structured findings rather than sent as an uncontrolled dump of the site. Aegisify Audit SaaS can then combine external and internal evidence, preserve scan history, support human review, and communicate technical conditions in language useful to security executives, WordPress owners, developers, agencies, and IT teams.
Discover
Build a current inventory of WordPress software, application surfaces, dependencies, permissions, and security-relevant settings.
Analyze
Review vulnerable components, code patterns, configuration weaknesses, file changes, activity events, and WooCommerce conditions.
Correlate
Connect local evidence with external scanning, severity, confidence, affected assets, and historical context in Aegisify Audit.
Verify
Rescan after corrective work and compare evidence so teams can confirm whether the underlying condition changed.
A Verified, Domain-Bound Connection
The Agent is designed to operate only after the WordPress site has an authorized relationship with Aegisify Audit SaaS. It does not expose deep scanning as an anonymous public function, and it does not depend on sharing a customer’s WordPress administrator password with the SaaS platform.
Connection safeguards verified in the Agent
- Verified domain relationship: the local site identity must match the domain approved by the SaaS service.
- Dedicated Agent credential: the connection uses a purpose-specific security key rather than a shared WordPress login.
- Cryptographically signed requests: incoming SaaS actions are checked for authenticity and integrity.
- Freshness and replay controls: stale or previously used requests are rejected instead of being trusted indefinitely.
- HTTPS enforcement: sensitive Agent communication is expected to use encrypted transport with certificate verification.
- Permission-gated API surface: scan, report, telemetry, log, and queue functions pass through the Agent’s authorization layer.
- Connection revalidation: queued work refreshes the verified SaaS relationship before executing protected operations.
The Site Controls What the Agent Can Share
Aegisify Audit Agent includes a telemetry policy layer with a master control and separate category permissions. The default posture in the reviewed package is restrictive: telemetry is not broadly enabled until the site owner or authorized administrator allows the required categories.
This design helps separate ordinary scan evidence from optional operational telemetry. It also gives customers a clearer way to decide whether Aegisify Audit may receive software inventory, integrity, activity, backup, drift, configuration, or log-related information.
Software and Component Posture
WordPress core, plugin, and theme versions can be shared as structured inventory when the applicable category is enabled.
Integrity Evidence
File hashes and baseline comparisons can support change detection without transferring the entire file set as routine telemetry.
Privilege and Access Context
Role, capability, and privileged-account posture can be reported as controlled security metadata.
Cron and Event Inventory
Scheduled WordPress jobs can be inventoried to expose failed, unexpected, or operationally important background activity.
Backup and Restore Signals
Backup, restore, and snapshot status can be included when a customer wants recovery-readiness evidence in the audit workflow.
Drift and Configuration State
File changes, snapshot differences, and privileged configuration states can help explain what changed between scans.
Metadata-first collection
The general telemetry model is designed around minimum-necessary security metadata. The reviewed Agent explicitly avoids treating customer posts, comments, WooCommerce orders, usernames, email addresses, secrets, tokens, API keys, payment data, health data, or raw database rows as ordinary inventory payloads.
Log retrieval is handled differently because a log can contain content beyond structured metadata. Access to WordPress debug logs, an approved custom log file, or the WordPress Activity Log is therefore represented as separate opt-in permissions. Organizations should review log retention and redaction policies before enabling those categories.
- Enable or leave disabled the telemetry master control.
- Select only the categories needed for the organization’s audit workflow.
- Keep log access disabled unless the investigation or reporting use case requires it.
- Review the resulting evidence in Aegisify Audit and adjust permissions when the operational need changes.
Track Security-Relevant Changes Across WordPress
The Agent includes a local WordPress Activity Log with 60 configurable sensors across 14 event categories. Each sensor can be enabled or disabled and assigned a severity so the organization can focus on the changes that matter to its site and operating model.
The activity system records events and sanitized context rather than attempting to copy the full contents of every affected object. Pending events are persisted locally and can be retrieved through the authorized Agent workflow when Activity Log access is enabled.
Why activity sensors matter
A vulnerability tells the team what could be exploited. An activity event helps explain what actually changed. When combined with file drift, configuration posture, and scan history, activity evidence can answer questions such as:
- Was a vulnerable plugin installed, activated, updated, or removed?
- Did an administrator change a security-relevant WordPress setting?
- Was a new user registered or a privileged user account modified?
- Did a theme switch or file edit occur before a new finding appeared?
- Did the site’s state change between the baseline scan and the verification scan?
Run Heavy Security Work Without Treating Every Request as Immediate
Deep scans can inspect thousands of files, enumerate software, call vulnerability providers, run dependency tools, and normalize large result sets. The Agent therefore separates scan requests from scan execution through persistent queue state and WordPress background scheduling.
Agent Scan Queue
Coordinates the broader local Agent assessment, including hardening, inventory, permissions, malware heuristics, file drift, static analysis, WooCommerce intelligence, and related evidence.
Vulnerability Scan Queue
Coordinates software inventory, update posture, provider correlation, and dependency vulnerability audit results.
Static Analysis Queue
Coordinates code-focused inspection for selected plugins or approved application scope using WordPress-aware and language-specific rules.
Observable job lifecycle
Queue records preserve the operational facts needed to explain a job: request time, start time, completion time, current status, errors, scan profile, selected scope, remote job context, and result counts. The Agent also checks for duplicate work, abandoned queue entries, stale running states, and missing scheduled events so a broken background job does not silently appear healthy.
Administrators can clear or reset stale queue state when a hosting timeout, disabled WordPress cron, deployment interruption, or other environmental problem prevents normal completion. Completed results are cached locally and made available to the authenticated SaaS reporting workflow.
How an Agent Finding Moves Through Aegisify Audit
Authorize
Verify the WordPress domain and establish the protected Agent-to-SaaS relationship.
Collect
Run only the approved scans and telemetry categories required for the assessment.
Normalize
Convert tool-specific output into consistent findings, evidence, severity, affected assets, and status.
Correlate
Review local evidence beside the external attack surface, scan history, business context, and related conditions.
Prioritize
Separate urgent exposure from lower-confidence indicators, operational observations, and maintenance work.
Remediate
Assign corrective work to the appropriate WordPress owner, developer, host, security team, or business owner.
Verify
Rescan and compare evidence to confirm whether the condition was removed, reduced, accepted, or remains open.
What the Agent Means for Each Audience
Security Executives
See which WordPress risks have local evidence, what business function is affected, how conditions change over time, and whether corrective work was verified.
WordPress Owners
Understand software, configuration, activity, and maintenance risk without having to interpret every raw scanner message or server log.
Business Decision Makers
Connect website risk to uptime, customer trust, ecommerce operations, recovery readiness, and the cost of neglected software or unclear ownership.
WordPress Developers
Receive code-level and dependency evidence tied to files, rules, affected components, and WordPress-specific development practices.
Agencies and Integrators
Apply a repeatable audit workflow across managed sites while preserving domain authorization, queue visibility, site-specific telemetry policy, and historical evidence.
IT and Security Engineers
Review REST and AJAX surfaces, permissions, runtime posture, vulnerability data, database conditions, file drift, logs, activity events, and scan execution health.
Aegisify Audit Agent FAQ
Is the Aegisify Audit Agent a WordPress security scanner?
Yes, but it is broader than a single scanner. It combines WordPress vulnerability scanning, static code analysis, dependency audits, hardening checks, malware heuristics, file drift, permissions, activity sensors, WooCommerce intelligence, inventory, and controlled telemetry.
Why is an Agent needed when Aegisify can scan a public website?
An external scan can test the public attack surface, but it cannot safely inspect local plugin files, dependency manifests, WordPress roles, database privileges, scheduled events, activity history, configuration constants, or internal WooCommerce posture. The Agent supplies that authorized local evidence.
Does Aegisify Audit need my WordPress administrator password?
The reviewed Agent architecture uses a dedicated, domain-bound Agent security relationship and signed requests. It is not designed around sending a WordPress administrator password to the SaaS platform.
Can the Agent send customer content or WooCommerce order data?
Routine inventory and telemetry are designed to use security metadata rather than customer content, orders, emails, usernames, payment data, secrets, tokens, API keys, or raw database rows. Separate log access permissions should be reviewed because logs may contain content beyond structured metadata.
Does the Agent automatically fix every vulnerability?
No. The Agent discovers and reports evidence. Remediation can require a plugin update, code change, configuration change, hosting action, compensating control, vendor response, business approval, or risk acceptance. A rescan should verify the result.
Does the Agent use OWASP?
Its checks overlap important OWASP application-security categories, including access control, injection, security misconfiguration, vulnerable components, integrity failures, logging, and server-side request forgery. The reviewed version should not be described as a complete formal OWASP certification or control-mapping system.
Does static analysis execute the plugin code?
No. Static analysis inspects source files and patterns without running the application behavior. It can identify risky conditions, but developers should review the code path and runtime context before deciding whether a finding is exploitable.
What happens when a scan times out or WordPress cron fails?
The Agent records queue state, timestamps, errors, and stale-job conditions. Administrators can clear or reset overdue state, and the underlying hosting or cron problem must be corrected before reliable background scanning can resume.
Is the Agent useful for WooCommerce?
Yes. The verified package reviews WooCommerce software posture, checkout transport, payment configuration, webhooks, API permissions, Store API exposure, scheduled jobs, template overrides, compatibility state, logs, and privileged-user counts without using customer order content as normal audit payload.
Can the Agent replace manual security review?
It can reduce manual collection and highlight important evidence, but human review remains necessary for business context, exploitability, false positives, custom code, architecture decisions, remediation approval, and risk acceptance.
Related Aegisify Agent Guides
This page describes capabilities verified in Aegisify Audit Agent 1.9.21. For the detailed scanning methods, review the Aegisify Agent Scan Engines page. For definitions of OWASP, CVE, CVSS, WPVulnerability, code-analysis standards, package audits, OSV, STIG/SRG concepts, file hashing, and security telemetry, review the Aegisify Agent Technology Stack page.