About this plugin
AiutoComputerHelp Persistence Audit is a read-only security auditing plugin focused on mechanisms that can maintain, restore or recreate persistent code in a WordPress installation.
The plugin examines multiple persistence-relevant layers and correlates related artifacts instead of treating an isolated indicator as proof of compromise.
Current audit areas include:
- bootstrap configuration and selected drop-ins;
- MU-plugins;
- database options and transients;
- WordPress Cron;
- the root.htaccess file;
- administrator account metadata;
- registered REST route metadata;
- targeted filesystem anomalies inside the current WordPress installation;
- cross-layer correlation of meaningful artifacts and identifiers.
Findings use four levels: Pass, Info, Review and Warning. A Review or Warning means that the observed evidence deserves investigation; it does not by itself prove malware or compromise.
The filesystem scan offers Standard, Deep and Deep+ traversal modes. Candidate budget limits content inspection only. Deep+ performs much broader directory traversal and can take one minute or more on large installations or shared hosting.
Read-only and privacy design
The plugin does not remove files, modify the database, alter configuration, disable plugins, delete cron events, reset users, execute detected payloads or call suspicious REST endpoints.
It does not send scan results to external services and does not use external reputation APIs.
Filesystem inspection is limited to the current WordPress installation and symbolic links are not followed. Safe previews are bounded and redact common secrets such as database credentials, salts, tokens and authorization values.
Base64 content, when inspected, is decoded only for bounded static analysis and is never evaluated, included or executed.