About this plugin
ai is a WordPress security plugin for local malware scanning, file integrity checks, login security and selected request filtering. shop collection.
Free malware scanning and file integrity
- Local file/database-content checks, confidence, severity and coverage gaps.
- Optional official file-integrity references; a difference alone is not malware.
- Manual/daily cron scans, saved progress, guidance, exports and optional alerts.
- Optional authenticator/passkey second factor and local request filtering.
- Clear findings, grouped Settings, mobile View options and a local plugin collection.
Free local tools need no account or paid key. External sources need separate configuration/permission. ClamAV needs a host engine, protected socket and current definitions.
Structural/ClamAV checks are bounded to 2 MiB per eligible file; integrity reads to 16 MiB. Incomplete results remain visible. No clean-site or comprehensive-detection guarantee is made.
The separate Pro add-on
Pro adds schedules, investigations, reports and reviewed eligible file restoration, using the same scanner. Its first online licence activation unlocks local tools; expiry/outages retain that unlock, explicit Disconnect removes it. Connected services/AI need separate consent and eligible access.
AI cannot approve repairs. Free never downloads Pro code.
Guide | Free and Pro details | Methods and limits | Privacy
External services and privacy
Activation starts no scan/provider request. Connections below need separate permission/configuration; there is no usage/conversion telemetry. txt.
- Welcome choices and email: initially unchecked. Compatibility sharing sends the displayed domain, WordPress/PHP versions and language; independent email signup sends the editable address and reported edition to https://antivirus.ai/newsletter-api/v1/plugin-welcome/. Consented reports refresh at most weekly, plus edition changes. Email needs confirmation; no source, findings or customer records are sent. Stop sharing in Protection settings; unsubscribe confirmed email separately. The operator is A.M.E.X. Internet Marketing ltd, Cyprus, using a United States GoDaddy VPS, Cloudflare and its mail relay. Terms: https://antivirus.ai/terms/. Privacy/withdrawal: https://antivirus.ai/privacy#welcome and https://antivirus.ai/newsletter/privacy.
- WordPress.org references: permitted scan/reference jobs send requested component names/versions, core locale, server IP and timing. Official checksum/package data is compared locally. Privacy: https://wordpress.org/about/privacy/.
- Wordfence Intelligence: a separately permitted/configured feed request uses your API credential and server network connection; no site source files are uploaded. Saving a token does not enable requests. Terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/. Privacy: https://www.wordfence.com/privacy-policy/.
- Signed indicators: an optional host-configured publisher receives protocol/version metadata and server IP when permitted updates run, not inventory, source or samples. Its destination/privacy policy is displayed before enabling. No public publisher or maintained corpus is included.
- ClamAV: separately enabled eligible file bytes go only to a protected daemon on this host, not a cloud scanner. The host manages FreshClam requests and daemon logs. Guidance: https://docs.clamav.net/manual/Usage/SignatureManagement.html.
- Emerging Threats: separately permitted downloads normally request https://rules.emergingthreats.net/blockrules/compromised-ips.txt every 12 hours. The provider sees server IP/timing, not visitor IPs or file contents; matching is local. Licence: https://community.emergingthreats.net/t/licensing-is-the-compromised-ips-list-also-open/676. Privacy: https://www.proofpoint.com/us/legal/privacy-policy.
- Pwned Passwords: separately permitted supported password checks send five SHA-1 hash-prefix characters, server IP and timing to https://api.pwnedpasswords.com, never the password, full hash, username or email. Matching is local. Information: https://haveibeenpwned.com/Passwords. Privacy: https://haveibeenpwned.com/Privacy.
- Exposure checks: separately permitted bounded HTTPS requests go to this site’s public WordPress address. Its host/CDN sees selected paths, server IP and timing; up to 512 response bytes are compared transiently, not uploaded to antivirus.ai.
- Notifications: optional alerts and explicit tests use your configured WordPress mail provider, notification content and recipient. A successful mail handoff does not prove inbox delivery; interrupted or uncertain sends need review. Exports and recovery evidence can be sensitive.
The separately installed Pro service has its own pairing, licence and consent controls. Optional AI sends minimized detector metadata to the configured service/provider, not source files; it does not independently verify infection. com/antivirus-service/terms.
com/policies/privacy-policy/. Free does not contact that Pro service. Hosted uptime, Google homepage reputation and managed country rules are unavailable in this release.
Account/security records and optional history stay local unless an independently chosen connection shares its documented data. Hiding previews does not withdraw existing sharing. Stopping a connection may leave a visible pending withdrawal when unreachable; messages already sent and rotated backups cannot be recalled.
This is self-service software without managed cleanup or response-time guarantees. ai/contact/.
Source code and third-party notices
Readable PHP/JavaScript/CSS and local fonts/logos are bundled; no remote promotional assets load. md. txt.
md.