Wigmorean Protector

A security layer that watches your WordPress install for changed files, malware patterns, and suspicious logins — and tells you what changed before trouble spreads.

What Protector watches

WordPress core files — any modification outside of an official release
Plugin and theme files — unexpected writes after install
Malware patterns — known shell signatures, obfuscated PHP, eval-base64 chains
Login activity — failed attempts, logins from new IPs, admin account creations

Integrity scanner

Protector downloads the checksums for your exact WordPress version from api.wordpress.org and compares them to what's on disk. Any file with a mismatched hash is flagged. You'll see the file path, when it changed, and a diff of what changed.

Run the scan manually (Wigmorean → Protector → Scan Now) or on a schedule — hourly, daily, or weekly.

Core file validation

Beyond checksums, Protector verifies that core files haven't been injected with extra functions or backdoor endpoints. It does this with structural PHP parsing, not regex — so obfuscated payloads still get caught.

Malware scanner

The malware scanner looks for patterns known to appear in WordPress exploits:

Obfuscated PHP (long base64 strings feeding into eval)
Remote file inclusion via file_get_contents on user input
Suspicious file uploads in wp-content/uploads/ (PHP files where media should be)
Hidden admin accounts not in wp_users but injected via SQL triggers

Login monitor

Every successful and failed login is logged with IP, user agent, country, and outcome. The dashboard shows a running count of failed attempts per IP. After a configurable threshold (default 5 in 10 minutes), the IP is locked out for 24 hours.

You can whitelist your own IP so you never get locked out.

Activity log

The activity log captures high-signal events that change your site's security posture:

User role changes
Plugin activations/deactivations
File uploads (beyond standard media)
Option changes (site URL, admin email)
Database schema changes

Every entry shows who did it, when, and from what IP.

Heads up. If you already run the SafeGuard module (part of the Suite), Protector overlaps on some checks. Pick one — running both is redundant and slower.