Title: Site Security Auditor – Plugin & File Checks Author: Gopal Bogati Published: 21 september 2025 Last modified: 5 september 2026 --- Sök tillägg ![](https://ps.w.org/site-security-auditor/assets/banner-772x250.png?rev=3682123) ![](https://ps.w.org/site-security-auditor/assets/icon-256x256.png?rev=3682123) # Site Security Auditor – Plugin & File Checks Av [Gopal Bogati](https://profiles.wordpress.org/gopalbogati/) [Ladda ner](https://downloads.wordpress.org/plugin/site-security-auditor.1.4.0.zip) * [Detaljer](https://sv.wordpress.org/plugins/site-security-auditor/#description) * [Recensioner](https://sv.wordpress.org/plugins/site-security-auditor/#reviews) * [Installation](https://sv.wordpress.org/plugins/site-security-auditor/#installation) * [Utveckling](https://sv.wordpress.org/plugins/site-security-auditor/#developers) [Support](https://wordpress.org/support/plugin/site-security-auditor/) ## Beskrivning Site Security Auditor gives WordPress administrators a practical security review dashboard. See plugin update information, compare plugin and theme files against a trusted snapshot, and understand which settings deserve attention. Open **Tools Security Audit** to start. Each section explains what it checks, what the result means, and what to do next. It is designed for routine maintenance and investigating unexpected file changes, without automatically editing your site. #### What you can do * **Review plugin updates:** see available updates, inactive plugins and missing or stale update information. Open the familiar WordPress update screen to take action. * **Compare files:** save a trusted SHA-256 baseline, then identify added, modified and removed code files in plugin and theme directories. * **Return to your latest report:** the most recent file check stays visible with its timestamp and file count. Simply opening the dashboard does not start another scan. * **Download a file report:** export the latest result as JSON to review with your developer or host. * **Follow a plain-language checklist:** review HTTPS configuration, dashboard code editing and WordPress debug display, with links to Site Health and official guidance. * **Use a responsive dashboard:** clear sections, keyboard-accessible controls and a scrollable plugin table on small screens. #### A useful maintenance routine 1. Review available updates and take a backup. 2. Confirm your files are trustworthy before saving the first baseline. 3. Run a comparison after maintenance or when investigating changes. 4. Match changed files to intentional updates or edits. 5. Replace the baseline only after reviewing and trusting the current files. A baseline records the current state; it does not prove that state is clean. Keep independent backups and ask a trusted professional about unexplained changes. #### Scope and limitations New baselines cover PHP, PHP7, PHTML, INC, TWIG, JSON, JS and CSS files inside the configured plugin directory and registered theme directories. WordPress core, uploads, must-use plugins, database content and other file types are excluded. Symbolic links are not followed and cause an incomplete result. Each run is bounded to 20,000 directory entries, 100 MiB of file data, 8 MiB per file and an approximately 8-second processing budget. Unreadable files or exceeded limits produce an incomplete report. Incomplete scans never replace a baseline or present a partial comparison as complete. Large sites may need a host-level integrity tool. Avoid editing files or running updates during a scan. This plugin is **not a malware scanner, firewall or vulnerability database**. It does not repair files, guarantee security, or certify a plugin as safe. An update or legitimate edit can change a file; unchanged files can still contain problems. #### Privacy and performance No account, API key, telemetry or additional remote metadata requests are required. The dashboard uses the update information already maintained by WordPress; WordPress itself may contact its normal update services. File hashes, relative paths, baseline time and the latest file report are stored in the site’s options, without autoloading them. Reports are restricted to administrators; on multisite they require a network administrator. Downloaded reports contain relative file paths, so share them only with trusted people. Deactivation and deletion preserve these records to avoid silently discarding your trusted reference. ## Skärmdumpar [⌊Security review dashboard with maintenance summaries and the trusted-baseline workflow.⌉⌊Security review dashboard with maintenance summaries and the trusted- baseline workflow.⌉[ Security review dashboard with maintenance summaries and the trusted-baseline workflow. [⌊Saved file comparison with added, modified and removed file groups.⌉⌊Saved file comparison with added, modified and removed file groups.⌉[ Saved file comparison with added, modified and removed file groups. [⌊Plugin maintenance information and a plain-language configuration checklist.⌉⌊ Plugin maintenance information and a plain-language configuration checklist.⌉[ Plugin maintenance information and a plain-language configuration checklist. ## Installation 1. Install Site Security Auditor from Plugins Add New, or upload the plugin ZIP. 2. Activate the plugin. 3. Open Tools Security Audit using an administrator account. 4. Read the baseline warning, confirm that you trust the current files, and choose Save trusted baseline. 5. Return and select Compare files now to review changes. On multisite, a network administrator can open the dashboard from a site’s Tools menu. Baselines and reports are stored per site, while plugin and theme files may be shared across the network. ## Vanliga frågor ### Does it scan for malware or known vulnerabilities? No. It compares code-file hashes with your own baseline and shows maintenance/configuration checks. Use other appropriate controls and professional advice alongside this tool. ### When should I replace the baseline? Only after verifying the current files, for example after reviewing an intentional plugin update. Replacing it accepts the current state as the reference and removes the previous comparison point. ### Why does a plugin say Unknown? WordPress has not supplied current update information for it, or that information is more than two days old. Open WordPress Updates to refresh it. Some premium or custom plugins use separate update systems. Unknown does not mean unsafe or safe. ### What happens to my existing baseline when I update? Your baseline is retained. Baselines made before 1.4.0 continue comparing their original file types, without JS and CSS. A newly saved trusted baseline includes JS and CSS. Review changes before replacing it. ### Why is a scan incomplete? The scan reached a resource limit, encountered a symbolic link, could not read a directory/file, or found a file changing during the run. The report explains the issue. Finish updates and ask your host to check permissions; large sites may need another integrity tool. ### Does it change my security settings automatically? No. It provides guidance and links. Configuration changes can affect hosting or integrations, so review them with your administrator. ### Can I use this every day? You can manually review the dashboard and compare files whenever useful. There are no scheduled scans or email alerts in this version. The dashboard stores only the latest file report; download reports you need to keep. ## Recensioner Detta tillägg har inga recensioner. ## Bidragsgivare och utvecklare ”Site Security Auditor – Plugin & File Checks” är programvara med öppen källkod. Följande personer har bidragit till detta tillägg. Bidragande personer * [ Gopal Bogati ](https://profiles.wordpress.org/gopalbogati/) [Översätt ”Site Security Auditor – Plugin & File Checks” till ditt språk.](https://translate.wordpress.org/projects/wp-plugins/site-security-auditor) ### Intresserad av programutveckling? [Läs programkoden](https://plugins.trac.wordpress.org/browser/site-security-auditor/), kika på [SVN-filförvaret](https://plugins.svn.wordpress.org/site-security-auditor/) eller prenumerera på [utvecklarloggen](https://plugins.trac.wordpress.org/log/site-security-auditor/) via [RSS](https://plugins.trac.wordpress.org/log/site-security-auditor/?limit=100&mode=stop_on_copy&format=rss). ## Ändringslogg #### 1.4.0 * New responsive dashboard, guided baseline workflow and actionable security checklist. * Save the latest file report and download it as JSON. * Run scans only through authenticated, nonce-protected POST actions. * Preserve baselines when scans are incomplete; add resource limits and explicit coverage warnings. * Include JS and CSS in new baselines while preserving legacy comparison scope. * Use cached WordPress update data instead of per-plugin remote lookups on dashboard views. * Recognize network-active plugins and restrict multisite access to network administrators. * Refresh directory branding, documentation, screenshots and release metadata. #### 1.0 * Initial dashboard for plugin information, file baselines and hardening checks. ## Meta * Version **1.4.0** * Senast uppdaterat **17 timmar sedan** * Aktiva installationer **Färre än 10** * WordPress-version ** 5.8 eller senare ** * Testat upp till **7.0.4** * PHP-version ** 7.4 eller senare ** * Språk * [English (US)](https://wordpress.org/plugins/site-security-auditor/) * Etiketter * [File Integrity](https://sv.wordpress.org/plugins/tags/file-integrity/)[Plugin Updates](https://sv.wordpress.org/plugins/tags/plugin-updates/) [security audit](https://sv.wordpress.org/plugins/tags/security-audit/)[site health](https://sv.wordpress.org/plugins/tags/site-health/) * [Avancerad vy](https://sv.wordpress.org/plugins/site-security-auditor/advanced/) ## Betyg Än så länge har inga recensioner skickats in. [Your review](https://wordpress.org/support/plugin/site-security-auditor/reviews/#new-post) [Visa alla recensioner](https://wordpress.org/support/plugin/site-security-auditor/reviews/) ## Bidragande personer * [ Gopal Bogati ](https://profiles.wordpress.org/gopalbogati/) ## Support Har du något att säga? Behöver du hjälp? [Visa supportforum](https://wordpress.org/support/plugin/site-security-auditor/)