Description: Maintains a closed/blocked list of known malicious signatures or file identifiers. How it works: closed_list can be used to prioritize or automatically flag known-bad items during scans. How to access / configure: WP Admin → AegisShield → Malware Scan → Advanced. Review or update closed list (if exposed). Save changes. Recommended setting: Keep defaults; only add items if you have verified malicious samples.

Description: Allowlist specific file hashes to trust known-good files even if patterns look suspicious. How it works: allowlist_hashes lets you pin trusted file versions; future scans treat matching hashes as safe. How to access / configure: WP Admin → AegisShield → Malware Scan → Allowlist (Pro or advanced). Add the trusted hash for a verified file. Save and rerun scan. Recommended setting: Use sparingly; re-validate hashes after updates.

Description: Suppress known false positives by ignoring specific file paths or patterns. How it works: ignore_list prevents repeated flagging of trusted files while keeping scans focused on unknown threats. How to access / configure: WP Admin → AegisShield → Malware Scan. Add items to Ignore List. Save and rerun scan to confirm noise reduction. Recommended setting: Only ignore after verifying the file is safe; never ignore core PHP backdoor patterns.

Basic Heuristic Detection

Description: Detects suspicious code patterns commonly used by malware (obfuscation, eval chains, backdoors). How it works: The heuristic engine analyzes file contents and assigns suspicion based on signatures and indicators. How to access / configure: WP Admin → AegisShield → Malware Scan. Run a scan. Review the report for suspect indicators and file paths. Recommended setting: Treat PHP files in uploads as high risk; verify against known-good sources.

Full Malware Scan (Themes / Plugins / Uploads)

Description: Scans common WordPress directories for suspicious files and malware patterns. How it works: AegisShield enumerates files in selected directories and evaluates them with heuristic checks, producing a report of suspects. How to access / configure: WP Admin → AegisShield → Malware Scan. Select directories (themes, plugins, uploads). Run Full Scan and review findings. Recommended setting: Run weekly on production sites; run immediately after any compromise indicators.

Description: Limit security header profiles to specific URL paths (Pro). How it works: profiles_custom_paths lets you apply different header rules to different sections of your site. How to access / configure: WP Admin → AegisShield → Security Headers → Profiles (Pro). Add path rules (e.g., /wp-admin/*, /checkout/*). Save and test. Recommended setting: Use stricter headers on admin and sensitive pages; keep relaxed for legacy pages if needed.

Security Header Profiles

Description: Apply pre-built security profiles such as Relaxed / Balanced / Strict (Pro). How it works: Profiles set multiple header values together, making it easier to adopt best-practice defaults. How to access / configure: WP Admin → AegisShield → Security Headers → Profiles (Pro). Select a profile. Save and test key site pages. Recommended setting: Start with Balanced; move to Strict after CSP violations are addressed.

Description: Add custom directives to CSP when you need advanced control (Pro). How it works: builder_extra_directives and builder_extra_mode append additional CSP rules beyond the guided fields. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Enter extra directives. Save and test. Recommended setting: Only use if you understand CSP; validate directives to avoid breaking the site.

Description: Restricts which sites can embed your site in an iframe (anti-clickjacking) (Pro). How it works: builder_frame_ancestors sets the CSP frame-ancestors directive; pairs well with X-Frame-Options. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Set frame ancestors to 'none' or 'self'. Save changes. Recommended setting: Use 'none' for most sites; 'self' if you embed your own pages internally.

Description: Controls which endpoints your site can connect to (AJAX, APIs) via CSP connect-src (Pro). How it works: builder_connect_src and builder_connect_mode define allowed origins for fetch/XHR/WebSocket connections. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Connect settings. Add API domains and Save Changes. Recommended setting: Only allow your own domain and required external APIs (payments, analytics, etc.).

News & Events

Categories: AegisShield
Closed List
read more
Categories: AegisShield
Allowlist Hashes
read more
Categories: AegisShield
Ignore List
read more
Categories: AegisShield
Basic Heuristic Detection
read more
Categories: AegisShield
Full Malware Scan (Themes / Plugins / Uploads)
read more
Categories: AegisShield
Custom Profile Paths
read more
Categories: AegisShield
Security Header Profiles
read more
Categories: AegisShield
Extra CSP Directives
read more
Categories: AegisShield
Frame Ancestors
read more
Categories: AegisShield
CSP Connect Sources
read more

keep updated & don’t miss anything!

We regularly develop new plugins and release them for free because they’re solutions we trust and use ourselves.

By entering your email, you agreed to our Privacy Policy and Terms & Conditions

Frequently Asked Questions

Support Docs

Ticketing System

closed list known malicious items description maintains blocked signatures file identifiers works used prioritize automatically flag bad during scans access configure admin aegisshield malware scan advanced review update exposed save changes recommended setting keep defaults add verified samples

Powered by Aegisify Links

2026 - Aegisify.com - Everything Your WordPress Site Needs, One Platform. One Price.

Privacy Policy * Terms of Use * Free Plugin Disclaimer * End User License Agreement