AI explanations now require WordPress 7.0+ and a provider connected under Settings > Connectors. Direct Anthropic\/OpenAI-compatible API keys are no longer supported.<\/p>","1.2.0":"
Fixes a fatal error on PHP 7.4 - 7.x caused by PHP 8-only string functions. No action needed.<\/p>","1.1.0":"
Adds an optional, key-free AI provider for WordPress 7.0+ sites. No action needed; existing AI settings are unchanged.<\/p>","1.0.0":"
Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3737534,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3737534,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3737534,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3737534,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.3.0"],"block_files":[],"assets_screenshots":{"screenshot-1.jpg":{"filename":"screenshot-1.jpg","revision":3737534,"resolution":"1","location":"assets","locale":"","width":1234,"height":609},"screenshot-2.jpg":{"filename":"screenshot-2.jpg","revision":3737534,"resolution":"2","location":"assets","locale":"","width":618,"height":595},"screenshot-3.jpg":{"filename":"screenshot-3.jpg","revision":3737534,"resolution":"3","location":"assets","locale":"","width":1337,"height":618},"screenshot-4.jpg":{"filename":"screenshot-4.jpg","revision":3737534,"resolution":"4","location":"assets","locale":"","width":1229,"height":616},"screenshot-5.jpg":{"filename":"screenshot-5.jpg","revision":3737534,"resolution":"5","location":"assets","locale":"","width":886,"height":510}},"screenshots":{"1":"Dashboard with the health score, category scores and recommended next steps.","2":"Running a scan, with live per-scanner progress.","3":"A finding with its evidence, confidence and recommended action.","4":"Database clean-up preview with the affected records and rollback state.","5":"Settings, showing exactly what leaves the site and how to disable it."}},"plugin_section":[],"plugin_tags":[3005,153,23519,247,600],"plugin_category":[54,59],"plugin_contributors":[275611],"plugin_business_model":[],"class_list":["post-369460","plugin","type-plugin","status-publish","hentry","plugin_tags-compatibility","plugin_tags-database","plugin_tags-diagnostics","plugin_tags-performance","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_category-utilities-and-tools","plugin_contributors-klydexa","plugin_committers-klydexa"],"banners":{"banner":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/banner-772x250.png?rev=3737534","banner_2x":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/banner-1544x500.png?rev=3737534","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/icon-128x128.png?rev=3737534","icon_2x":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/icon-256x256.png?rev=3737534","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/screenshot-1.jpg?rev=3737534","caption":"Dashboard with the health score, category scores and recommended next steps."},{"src":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/screenshot-2.jpg?rev=3737534","caption":"Running a scan, with live per-scanner progress."},{"src":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/screenshot-3.jpg?rev=3737534","caption":"A finding with its evidence, confidence and recommended action."},{"src":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/screenshot-4.jpg?rev=3737534","caption":"Database clean-up preview with the affected records and rollback state."},{"src":"https:\/\/ps.w.org\/klydexa-site-integrity-audit\/assets\/screenshot-5.jpg?rev=3737534","caption":"Settings, showing exactly what leaves the site and how to disable it."}],"raw_content":"\n
Klydexa Site Integrity Audit audits the WordPress site it is installed on and explains what it finds, with evidence.<\/p>\n\n
Everything works locally. Twenty-four deterministic scanners read your plugin code, database and configuration and produce findings that always cite a file, a line, a query or a measurement. AI is optional: when you enable it, it explains and prioritises findings the scanners already produced. It never replaces them, and the plugin is fully usable with AI switched off.<\/p>\n\n
What it checks<\/strong><\/p>\n\n Honest reporting<\/strong><\/p>\n\n Every finding carries a severity and<\/em> a confidence level, so a heuristic is never presented as a proven defect. When something cannot be determined, the plugin says \"Unable to verify\" or \"Not measured\" rather than implying everything is fine. A quick scan that skipped the security scanners shows those categories as unmeasured instead of scoring them 100.<\/p>\n\n Safe fixes<\/strong><\/p>\n\n Clean-up actions preview exactly what they will change, require explicit confirmation, and store a rollback snapshot where a rollback is possible. Klydexa Site Integrity Audit never edits third-party plugin source, never deletes a plugin, and never runs a destructive action as a side effect.<\/p>\n\n Klydexa Site Integrity Audit makes no external requests by default<\/strong> and contains no telemetry<\/strong>. Nothing is ever sent to the plugin authors.<\/p>\n\n Three optional features can make network requests. Each one is off by default and requires both the master privacy switch and its own consent checkbox.<\/p>\n\n Vulnerability intelligence<\/strong> - sends the plugin slug and installed version to the provider you configure, in order to look up published security advisories. Supported providers:<\/p>\n\n AI explanations<\/strong> - sends structured scan findings (severity, category, title, plugin slug and, at the widest sharing scope, file paths and code snippets) to an AI provider, in order to prioritise and explain findings in plain language. Requests are routed through the WordPress AI Client<\/strong> (WordPress 7.0+): the provider is the one connected under Settings > Connectors, handled entirely by WordPress core. This plugin never sees or stores AI credentials, never contacts an AI service itself, and does not choose the destination; the site owner does, from whichever connector they add. Which provider's terms and privacy policy apply depends on the connector you choose. Disable under Settings, AI.<\/p><\/li>\n<\/ol>\n\n Endpoints for the optional vulnerability provider are checked before any request is made. One that is, or resolves to, a private or reserved address is refused, so an endpoint field cannot be used to reach services inside your network.<\/p>\n\n Klydexa Site Integrity Audit never transmits passwords, authentication tokens, other services' API keys, post content, customer or order records, user data, or database dumps.<\/p>\n\n\n The plugin creates its own database tables and removes them on uninstall only if you opt in under Settings, Advanced.<\/p>\n\n\n No. Every scanner runs locally. An API key is only relevant if you choose to enable a vulnerability intelligence provider that requires one. AI explanations use the WordPress AI Client (WordPress 7.0+) and whichever provider you have connected under Settings > Connectors, so no AI key is ever entered into this plugin.<\/p><\/dd>\n Not by itself. Scanning is read-only. Clean-up actions exist, but each one previews its effect, requires confirmation, and is reversible where technically possible.<\/p><\/dd>\n Never. Klydexa Site Integrity Audit inspects, reports and recommends. The strongest action it can take on a plugin is toggling activation, which WordPress itself supports and which is recorded so it can be undone.<\/p><\/dd>\n It means a risky pattern was found in the code, with a file and line reference. Static analysis cannot prove that a pattern is reachable or exploitable, which is why every finding shows a confidence level. Read the evidence before acting, and report genuine problems to the plugin developer.<\/p><\/dd>\n Yes. Scans run in resumable steps with a time budget, results are cached against file fingerprints, queries are indexed and bounded, and analysis of a very large plugin stops at a limit and reports that it was incomplete rather than timing out.<\/p><\/dd>\n Yes. Data, settings and scans are per site. Tables are created for each site on first use. Network-activated plugins are identified as such, and their activation state can only be changed by a network administrator.<\/p><\/dd>\n Reports render as a clean print-friendly page; use your browser's print dialogue to save as PDF. The plugin does not bundle a PDF library.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
eval()<\/code>, shell execution, deserialisation, upload handling and admin action authorisation.<\/li>\nExternal services<\/h3>\n\n
\n
\n
\n
\n
klydexa-site-integrity-audit<\/code> folder to \/wp-content\/plugins\/<\/code>, or install the ZIP through Plugins, Add New, Upload Plugin.<\/li>\n\n
Does it need an API key?<\/h3><\/dt>\n
Will it change my site?<\/h3><\/dt>\n
Does it modify plugin files?<\/h3><\/dt>\n
A finding says my plugin might be insecure. Is it?<\/h3><\/dt>\n
Is it safe on a big site?<\/h3><\/dt>\n
Does it work on multisite?<\/h3><\/dt>\n
Can I export a PDF?<\/h3><\/dt>\n
1.3.0<\/h4>\n\n
\n
SAVEQUERIES<\/code>. Per-query attribution is used only when the site owner has already enabled it; otherwise only the total query count is recorded.<\/li>\n%i<\/code> identifier placeholders for table names.<\/li>\n<\/ul>\n\n1.2.0<\/h4>\n\n
\n
str_starts_with()<\/code> \/ str_contains()<\/code> \/ str_ends_with()<\/code>, which are PHP 8.0+ only. The plugin now includes polyfills for these functions so it runs cleanly on the minimum PHP version it declares.<\/li>\nTested up to<\/code> plugin header from the main plugin file; it is now declared only in this readme, as required.<\/li>\n<\/ul>\n\n1.1.0<\/h4>\n\n
\n
load_plugin_textdomain()<\/code> call; WordPress.org has served translations for this plugin automatically since WordPress 4.6.<\/li>\n<\/ul>\n\n1.0.0<\/h4>\n\n
\n