What it does
The vulnerability feed tells you which installed versions are exposed. The file check answers the other question — has anyone been in here? Once a day, and within a couple of minutes of a site being connected, the WPClientHub One plugin walks the site's files and compares them with what should be there: WordPress core against the official WordPress.org checksums for that exact version and locale, and every WordPress.org plugin against its published checksums. It also looks for the patterns compromises leave behind, wherever they are.
Results appear on the site's Security tab under Files & protection, count towards the security score and the health score, and new findings are emailed as a security alert. The scan runs inside the plugin in short, time-boxed steps and adds nothing to the site's front end.
What the scan looks for
| Finding | Severity |
|---|---|
| A WordPress core file whose contents don't match WordPress.org | Critical |
| A core file emptied to zero bytes (a common way to break a site or hide a loader) | Critical |
| A PHP file inside wp-admin or wp-includes that WordPress doesn't ship | Critical |
| PHP (or another executable type) inside wp-content/uploads | Critical |
| A “dropper kit” — a folder named after its parent holding a loader such as cache.php | Critical |
| A WordPress.org plugin whose files differ from the published version | Critical |
| A missing core file | High |
| Hidden files disguised as icons (a classic way to smuggle code in), unusual executable types such as .phtml or .phar, empty PHP files in plugins and themes | High |
| Unknown PHP files in the web root (outside the files WordPress expects) | High |
| Extra PHP files inside a WordPress.org plugin | High |
| A second WordPress installation nested inside the site | Medium |
| Extra non-PHP files inside core folders | Low |
| PHP files changed in the last 7 days | For information |
Must-use plugins (wp-content/mu-plugins) are listed separately: they load on every request and can't be switched off in wp-admin, which makes them a favourite hiding place. Hosting-company ones are recognised automatically; anything else is flagged as unknown until you mark it as yours.
How to
- Open a site → Security. Files & protection sits at the top: the last scan, how many files were checked, whether core was verified, and a Clean or N to review badge. Press Scan files now to run one immediately.
- Expand a finding group to see the paths. Critical groups open by default.
- Reinstall WordPress core replaces every core file with the official copy of the same version. Themes, plugins, uploads and wp-config.php are not touched. Extra files flagged inside wp-admin/wp-includes are not removed by a reinstall — quarantine those as well.
- Reinstall from WordPress.org next to a modified plugin replaces it with the official package of the same version and keeps it active.
- Tick the paths you want gone and press Quarantine selected. Each item is moved into the plugin's protected vault on the site — not deleted. Only paths from the latest scan can be quarantined; wp-config.php and core files never can.
- Under Protection, open Quarantine to see what has been moved, and press Restore to put an item back exactly where it was.
- Press This is ours next to a must-use plugin you recognise. It stops counting against the score and isn't announced again.
- Press Rotate security keys to write new WordPress salts. Everyone, including anyone holding a stolen session, is signed out. A backup of the old wp-config.php is kept in the vault.
- Check Last known-clean restore point: the newest completed backup taken before the most recent clean scan. Backups taken after that scan might already contain the problem, so they don't qualify.
Every response is recorded in the site's activity log with who pressed it, and anything that changes files is followed by a fresh scan.
Protection switches
| Switch | Default | What it does |
|---|---|---|
| Login protection | On | Locks an IP out after 5 wrong passwords; an IP locked out three times in a day is locked for 24 hours. A username being guessed from many addresses (20 wrong passwords) is locked for unknown IPs, while the addresses its owner signed in from before still get in. |
| Block PHP in uploads | On | Adds a marked .htaccess block to wp-content/uploads so a dropped script can't run. Apache and LiteSpeed only — on nginx the panel tells you to add the rule to the server configuration. |
| Disable the wp-admin file editor | On | Sets DISALLOW_FILE_EDIT, removing the theme and plugin file editors. |
| Block XML-RPC logins | Off | Disables password-authenticated XML-RPC methods. Leave it off if the site uses Jetpack or the WordPress mobile app. |
The same switches are in the plugin's own settings page in wp-admin. Attempts refused by login protection are logged as blocked, not as failed passwords, so an attack shows as one locked-out address rather than hundreds of wrong passwords.
Security alerts
The Security alerts email kind is on by default for owners, admins and techs, and can be routed to Slack, a webhook or another inbox like any other alert (notification routes). Each event is emailed once:
- the file check finds new high or critical findings, or a new unknown must-use plugin;
- 50 or more failed or blocked sign-ins within 15 minutes (at most one email per site per day);
- a successful sign-in on an account right after 10 or more failed attempts on it within the hour;
- an administrator account that wasn't there at the previous sync.
The site's Security timeline (last 30 days) puts these next to lockouts, new users, plugin installs, disconnects and uptime incidents, with failed sign-ins grouped per hour.
Limits & defaults
| Setting | Default |
|---|---|
| Plugin version | WPClientHub One 0.9.0 or newer on the site |
| Scan frequency | Once a day for every connected site, plus a scan a couple of minutes after a site is connected or reconnected, plus Scan files now |
| Paths shown | Up to 200 per finding type (counts are always exact) |
| Security score | Core changes and suspicious files are failed checks, and either one caps the score at 30 until resolved |
| Health score | −40 when the worst open file finding is high or critical, −10 otherwise |
| Plans | Every plan, including Free |
| Permissions | Owner, admin and tech can scan and respond; viewer can look |
What it isn't: the file check is not a malware-signature scanner or a firewall. It compares against WordPress.org and looks for the shapes compromises leave behind; a clean result means nothing it checks for was found.