Local signals become structured, reviewable audit evidence.
Evidence Relay
Only structured scan evidence moves through the Agent-to-SaaS workflow under defined access and job context.
Understand the Technologies Behind Deeper WordPress Security Audits
The Aegisify Audit Agent combines WordPress-native application intelligence with vulnerability identifiers, severity models, code-analysis standards, package-manager audits, file integrity, security telemetry, OWASP-relevant checks, and selected secure-configuration concepts.
The Security Standards, Data Models, and Tools Behind the Agent
This page defines the principal technologies, standards, data models, and security concepts referenced by Aegisify Audit Agent 1.9.21. It explains their role without presenting any one framework, identifier, score, scanner, or baseline as proof that a WordPress site is secure or compliant.
What the Agent Uses—and What Each Technology Means
WordPress APIs and Site Health
The Agent uses WordPress-native plugin, theme, role, capability, cron, REST, AJAX, HTTP, filesystem, update, and Site Health information to understand the environment from inside the application.
WPVulnerability
WPVulnerability is a WordPress-focused vulnerability database API. The Agent uses supported provider data to correlate installed WordPress and runtime versions with published vulnerability records.
CVE
Common Vulnerabilities and Exposures provides shared identifiers for publicly known cybersecurity vulnerabilities. A CVE identifier helps different tools and teams refer to the same vulnerability, but the identifier alone does not determine business risk or remediation priority.
CVSS
The Common Vulnerability Scoring System describes technical severity characteristics. CVSS can help with prioritization, but an organization should also consider exploitability, exposure, affected business function, compensating controls, and asset importance.
PHP_CodeSniffer
PHP_CodeSniffer analyzes PHP source against defined coding standards and security-related rules. It is part of the verified local static analysis path in the reviewed Agent package.
WordPress Coding Standards
WordPress Coding Standards are rules and best practices used to review code quality, interoperability, security, escaping, sanitization, database use, internationalization, and other WordPress-specific development concerns.
WordPress Plugin Check
Plugin Check helps evaluate whether plugin code and packaging meet WordPress.org expectations, including concerns related to security, performance, accessibility, internationalization, and repository readiness. Aegisify uses related checks as one part of a broader security review.
WordPress VIP Coding Standards
VIP-oriented standards add checks for performance, database behavior, platform safety, and scalable WordPress practices. They are useful signals but do not by themselves prove that a plugin is secure or suitable for a specific hosting platform.
Composer Audit
Composer audit checks PHP package dependency information against security advisories. The Agent can normalize findings when Composer and a supported lockfile are available.
npm, Yarn, and pnpm Audits
These package-manager audit functions evaluate JavaScript dependency records for known security advisories. Results depend on the project’s lockfile, configured registry, installed tooling, and current advisory data.
pip-audit
pip-audit checks Python environments or dependency specifications for known package vulnerabilities. The Agent can use it when a supported Python project and local executable are available.
OSV
OSV is an open-source vulnerability schema and distributed database designed to map advisories to affected package versions. The Agent inventories relevant package data and detects OSV-related tooling capability; broader correlation may also occur in the SaaS workflow. The reviewed package should not be marketed as performing every OSV function locally.
OWASP
The OWASP Top 10 is an application-security awareness document covering major web application risk categories such as broken access control, injection, security misconfiguration, vulnerable components, integrity failures, logging failures, and server-side request forgery. Many Agent checks address conditions that overlap these categories.
Important: the reviewed Agent contains OWASP-relevant checks, but it does not expose a complete formal OWASP control-mapping or certification framework in the verified scan path.
STIG and SRG Concepts
Security Technical Implementation Guides and Security Requirements Guides provide configuration and control baselines used in U.S. Department of Defense environments. Aegisify uses selected concepts for posture checks; this does not make an ordinary WordPress site STIG-compliant or government-authorized.
File Hashing and Drift
A cryptographic file hash acts like a compact fingerprint. Comparing hashes over time can identify changed files without treating every change as malicious. The Agent records added, changed, and removed file evidence for investigation.
Security Telemetry
Telemetry is structured operational evidence sent from the Agent to the SaaS service under an explicit access policy. It can include versions, counts, states, hashes, events, and scan results while excluding unrelated customer content from routine collection.
Aegisify Agent Technology Stack FAQ
Does the Aegisify Agent use OWASP?
The verified checks overlap important OWASP application-security categories, including access control, injection, security misconfiguration, vulnerable components, integrity failures, logging failures, and server-side request forgery. The reviewed version should not be described as a complete formal OWASP certification or control-mapping system.
What is the difference between CVE and CVSS?
CVE provides a shared identifier for a publicly known vulnerability. CVSS describes technical severity characteristics. Neither item alone determines the business impact, exposure, exploitability, compensating controls, or remediation priority for a specific WordPress site.
Does WPVulnerability replace local WordPress inspection?
No. WPVulnerability helps correlate identified software versions with published vulnerability records. Local inspection is still needed for code, configuration, permissions, routes, activity, file changes, dependencies, runtime context, and custom application behavior.
Does the Agent perform every OSV function locally?
The reviewed package inventories relevant package data and detects OSV-related tooling capability. Broader correlation may also occur in the SaaS workflow, so the verified version should not be marketed as performing every OSV function locally.
Do WordPress Coding Standards or Plugin Check prove that code is secure?
No. These standards and checks can identify important quality, compatibility, packaging, and security-related conditions, but they cannot prove that every code path is safe or that a plugin is appropriate for every environment.
Do STIG- or SRG-influenced checks make a WordPress site compliant?
No. Selected baseline concepts can support posture review, but compliance and authorization require defined scope, control evidence, organizational processes, assessment, and an accountable decision authority.
Are package-manager audits always available on WordPress hosting?
No. Composer, npm, Yarn, pnpm, and pip-audit capabilities depend on supported manifests or lockfiles, local executables, process permissions, registry or advisory access, and hosting restrictions.
Official Technology References
Definitions are aligned with official or primary references from OWASP Top 10, CVE Program, FIRST CVSS, WordPress Coding Standards, WordPress Plugin Check guidance, WPVulnerability, OSV, Composer audit documentation, npm audit documentation, pip-audit, and DoD SRG/STIG library.