Hanu Malware Guard

Description

Hanu Malware Guard is a self-contained WordPress security plugin covering eight areas:

1. Malware Scanner — recursively scans themes, plugins, mu-plugins and uploads for a curated set of regex heuristics matching common backdoor/webshell patterns (obfuscated eval(), webshell string signatures, command execution of user input, arbitrary file writes, etc). Any executable PHP-family file found inside wp-content/uploads is flagged outright, since WordPress never legitimately places runnable code there.

2. File Integrity Monitor — hashes every scanned file and records a baseline. Later scans report files that are new, modified, or deleted since the previous pass, so you can see exactly what changed and when.

3. Cron Guard — catches cron-based persistence. WordPress fires whatever hook name is stored in its cron option regardless of whether any currently-loaded code registers a handler for it. Malware commonly schedules a job under an unfamiliar hook name and re-adds its own callback dynamically, so the job keeps firing even after the plugin/theme file that “owns” it is deleted. Hanu Malware Guard snapshots every scheduled cron event on each page load, flags any hook with no currently registered callback (“orphan”) or a randomly-generated-looking name, and lets you:

   • Block a hook: unschedules every pending event for it immediately and blacklists the hook name so WordPress refuses to re-schedule it in the future (via the pre_schedule_event filter).
   • Trust a hook: marks it as known-good so it stops appearing as a flag.
   • Cross-references file changes against flagged cron activity so you can see file changes that happened right around when a suspicious cron job ran.

4. Login Brute-Force Lockout — locks out an IP/username combination after too many failed logins within a configurable window. Runs as an early authenticate filter, so it covers both wp-login.php and XML-RPC logins (both authenticate through the same core wp_authenticate() call). Manage active lockouts and view recent failed attempts on the Login Security page.

5. Firewall — blocks the handful of request patterns that account for most automated WordPress attacks: XML-RPC pingback amplification abuse (optional full XML-RPC disable), ?author=N and REST /wp/v2/users username enumeration, and requests whose URL contains obvious SQL-injection / path-traversal / PHP-injection strings. Logged-in administrators are always exempt from the query-string check so normal site use is never at risk of self-lockout. Blocked requests are logged on the Firewall page.

6. Security Headers — sends X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and a Content-Security-Policy: frame-ancestors 'self' (clickjacking protection only — no script-src policy, since that reliably breaks themes/page builders unless hand-tuned per site).

7. Core File Integrity Check — compares wp-admin/wp-includes against the official checksums WordPress.org publishes for your exact version, and additionally flags any PHP file physically present in those folders that isn’t part of the official manifest at all (a classic place to hide a backdoor, since admins assume “core” never changes). Findings appear in Scan Results alongside everything else.

8. Activity Log — records logins (success/failure/lockout), new admin users and role escalations, plugin/theme activation and switching, core/plugin/theme updates, and use of the built-in file editor, so you have a timeline of what changed and by whom.

Additional hardening options (Settings page): block PHP execution inside wp-content/uploads (.htaccess/web.config, with an Nginx snippet shown for reference), and disable the built-in wp-admin file editor.

External services

This plugin makes one outbound HTTP request, only when you run “Check Core File Integrity” (manually or via the daily scheduled scan): it calls the official WordPress.org checksums API at https://api.wordpress.org/core/checksums/1.0/?version={your WP version}&locale={your locale} to fetch the known-good hash list for your exact WordPress version. No site data, file contents, or personal information is sent — only your WordPress version number and locale, which is required for the API to return the right checksum set. See the WordPress.org API documentation and privacy policy: https://wordpress.org/about/privacy/. No other external service is contacted by this plugin.

Technical details