Integrity Sentinel

Description

Integrity Sentinel provides WordPress administrators with a focused set of local security and integrity checks, optional vulnerability intelligence, login rate limiting, an administrative audit trail and frontend asset inventory.

The plugin is designed to report verifiable conditions and useful indicators without treating every difference or heuristic match as proof of compromise.

Key Features:
* WordPress Core Integrity: Compares covered Core files with the official checksum manifest for the installed WordPress version and locale.
* Deep Plugin Integrity Scan: Compares eligible WordPress.org plugins with checksums for the version actually installed, detecting modified, missing and unexpected files.
* PHP Heuristic Scan: Looks for a limited set of suspicious obfuscation patterns and reports matches for manual investigation. Heuristic results can include false positives.
* Known Vulnerability Intelligence: Optional integration with the public WPVulnerability API. When explicitly enabled, the plugin sends each plugin slug to WPVulnerability and compares the installed version locally with the affected version ranges returned by the service.
* Login Rate Limiting: Temporarily blocks repeated failed login attempts using the IP address observed by the web server.
* Audit Trail: Stores a bounded local history of selected administrative events such as successful logins and plugin activation/deactivation.
* Server and Configuration Checks: Reviews HTTPS, debug exposure, security keys, selected HTTP headers, file permissions, PHP environment and other operational indicators.
* Update Monitoring: Reports update information already maintained by WordPress for Core, plugins and themes.
* Frontend Asset Inventory: Records the latest frontend scripts and styles observed while an administrator is viewing the public site. Query strings are not stored.
* Scheduled Scans and Email Alerts: Optional scheduled audits with configurable alert thresholds and cooldowns.
* Structured Whitelist: Supports explicit plugin:, theme:, path: and file: rules for heuristic exclusions.

Integrity Sentinel does not guarantee that a site is free of malware or vulnerabilities. Checksum differences, heuristic matches and third-party vulnerability data should be reviewed in context.

Privacy and External Services

Integrity Sentinel stores operational data in the site’s own WordPress database. It does not include remote JavaScript, CSS or tracking pixels.

Local data can include:
* Plugin settings and the most recent scan results.
* Bounded scan history and execution summaries.
* A maximum of 100 recent audit events. These events can contain a username, action details, date/time and the IP address observed by the web server.
* Temporary failed-login counters and temporary IP blocks. Entries expire after the configured internal protection window and are defensively capped.
* The most recent frontend asset inventory generated while an administrator views the public site. The stored page URL does not include its query string.
* A browser-local wpis_coffee_hidden preference can remember that an administrator dismissed the optional project-support card. It contains no account or site content.

The plugin removes its stored options and scheduled event when it is uninstalled. A legacy backup-registry option from earlier development versions is also removed if present.

Integrity Sentinel can contact the following external services when the related scan is requested or scheduled:

1. WordPress.org Core Checksums API

– Service: https://api.wordpress.org/core/checksums/1.0/
– Purpose: Retrieves the official checksum manifest used to verify covered WordPress Core files.
– Data sent in the request: Installed WordPress version and locale. Integrity Sentinel sets a neutral plugin User-Agent instead of the WordPress default site-identifying User-Agent. As with any HTTP connection, the destination service can observe the connecting server/proxy IP address.
– Privacy policy: https://wordpress.org/about/privacy/

1. WordPress.org Plugin Checksum Service

– Service: https://downloads.wordpress.org/plugin-checksums/
– Purpose: Retrieves official file checksums for an installed WordPress.org plugin when the administrator starts the Deep Scan.
– Data sent in the request: Plugin slug and installed plugin version in the request URL. Integrity Sentinel sets a neutral plugin User-Agent. As with any HTTP connection, the destination service can observe the connecting server/proxy IP address.
– Privacy policy: https://wordpress.org/about/privacy/

1. WPVulnerability API — optional and disabled by default

– Service: https://www.wpvulnerability.com/
– API endpoint used: https://www.wpvulnerability.net/plugin/{plugin-slug}/
– Purpose: Provides public vulnerability records for WordPress plugins.
– When contacted: Only when an administrator explicitly enables “External Vulnerability Intelligence” in Integrity Sentinel settings and runs, or schedules, the Updates/Vulnerabilities scan group.
– Data sent by Integrity Sentinel: Plugin slug. The installed plugin version is compared locally and is not intentionally included in the WPVulnerability request. Integrity Sentinel sets a neutral plugin User-Agent. As with any HTTP connection, the destination service can observe the connecting server/proxy IP address.
– API documentation: https://docs.wpvulnerability.com/
– Privacy information: https://www.wpvulnerability.com/privacy/
– License information: https://www.wpvulnerability.com/license/

No visitor content, passwords or administrator email addresses are intentionally transmitted by Integrity Sentinel to these services.