CONTROL 1
Short-lived one-time pairing
Pairing tokens are organization-scoped, expire quickly, and are exchanged once for credentials unique to the connected website.
Security
Least-privilege WordPress repair workflows for serious site operations.
WPFixAgent is designed to avoid collecting hosting passwords, generic shell access, or arbitrary remote PHP execution for standard operations.
No
Hosting passwords
Outbound
Polling
Allowlist
Commands
Audit
Trail
Security model
Authenticate and authorizeDashboard sessions identify the user, organization membership, role, and website scope before protected data or actions are available.
Pair least-privilege credentialsA short-lived token creates a site identity and secret without collecting reusable WordPress, FTP, cPanel, SSH, or database passwords.
Sign every connector requestTimestamps, unique nonces, and HMAC signatures protect heartbeats, commands, results, rescue polling, and alert feeds.
Constrain executionThe connector maps each command name to local code with capability checks, setting gates, parameter validation, and separate rescue limits.
Audit the outcomeUser actions, command results, repair stages, verification, and rollback remain visible for incident review and customer support.
CONTROL 2
Outbound-only connector traffic
The WordPress plugin sends signed HTTPS requests and polls for work instead of exposing a public inbound repair or file-management endpoint.
CONTROL 3
HMAC request signing
Connector requests use SHA-256 signatures over method, path, timestamp, nonce, and body with a five-minute timestamp window.
CONTROL 4
Replay protection
Unique nonces are stored and rejected when reused, reducing the risk of a captured request being submitted again.
CONTROL 5
Fixed command allowlists
Normal and rescue actions are registered and parameter-validated. Arbitrary PHP, SQL, shell commands, and unrestricted filesystem paths are unsupported.
CONTROL 6
Organization and role isolation
Website access is scoped to organization membership and separated across owner, administrator, developer, support, viewer, and billing roles.
CONTROL 7
Secret protection and redaction
Connector secrets are encrypted locally where supported, sensitive values are redacted before optional AI diagnosis, and passwords should never be sent by email.
CONTROL 8
Audit and recovery evidence
Pairing, issues, commands, repair stages, emergency actions, results, verification, and rollback outcomes are retained for operational accountability.
CONTROL 9
Independent malware and core-integrity scanning
Beyond API security, the connector scans your actual WordPress site: self-built behavioral malware detection and a checksum comparison against the official WordPress.org release manifest for every core file -- no third-party security vendor or external API, ever.
CONTROL 10
Non-destructive quarantine
A confirmed suspicious file is moved into a locked, non-executable folder with a recovery manifest -- never deleted outright -- so a false positive is always reversible.
CONTROL 11
Configuration hardening on request
Disable public debug-output exposure and the in-dashboard file editor after snapshotting current configuration, closing two common post-compromise persistence paths.
Security model
1
Step 1
Authenticate and authorize
Dashboard sessions identify the user, organization membership, role, and website scope before protected data or actions are available.
2
Step 2
Pair least-privilege credentials
A short-lived token creates a site identity and secret without collecting reusable WordPress, FTP, cPanel, SSH, or database passwords.
3
Step 3
Sign every connector request
Timestamps, unique nonces, and HMAC signatures protect heartbeats, commands, results, rescue polling, and alert feeds.
4
Step 4
Constrain execution
The connector maps each command name to local code with capability checks, setting gates, parameter validation, and separate rescue limits.
5
Step 5
Audit the outcome
User actions, command results, repair stages, verification, and rollback remain visible for incident review and customer support.
Security controls in the product
HMAC signatures, timestamps, and nonce replay protection
Encrypted connector secret at rest
Tenant permissions and audit logs
CLI rescue actions limited to a fixed allowlist
FAQ
Common questions
Do you need my hosting password?
No. Standard connector pairing does not require cPanel, FTP, SSH, or database credentials.
Can the connector run any PHP code?
No. The design is based on registered actions, not arbitrary remote code execution.
Has an independent security audit been completed?
Not yet. This page describes implemented controls, and an independent assessment is still required before a broad production rollout.
Can a stolen request be replayed?
The API enforces a timestamp window and nonce replay protection in addition to signature validation.
What happens if the site secret is exposed?
The connector must be disconnected and paired again to issue new site-specific credentials. Related logs should be reviewed as a security incident.
How does malware scanning work? Do you use a third-party security vendor?
No third-party security vendor or API is used for scanning. Malware detection combines signature matching, obfuscation and entropy analysis, and structural heuristics built and run independently. Core-file integrity is checked against a manifest built directly from the official WordPress.org release.
What happens when a scan finds something?
Depends what it is. A standalone suspicious file gets quarantined -- moved, locked, never deleted. A modified core file gets repaired by redownloading the exact official version. A tampered plugin or theme file can be reinstalled from its official WordPress.org source, which also removes anything injected that doesn't belong.
Free 14-day trial · no card required
Give every WordPress site a safer path from incident to verified recovery.
Install the connector, pair with a one-time token, and start monitoring in minutes -- upgrade whenever you're ready.