Aviiimageworks Security Monitor

Aviiimageworks Security Monitor is a detection-first security suite for WordPress. Its standalone Aviiimageworks Security menu brings together a dashboard, application-firewall monitoring, bounded integrity scanning, a local evidence vault, security reports, and granular module settings.

The plugin does not delete, quarantine, rewrite, repair, or change scanned files. Findings are stored locally in the WordPress database and shown only to administrators. Retention can be set to 7, 30, 60, or 90 days.

Features

• Non-destructive scans of PHP files in plugins, themes, and uploads.
• Conservative signatures for common web shells and encoded payloads.
• Bounded scans with file-count and file-size safety limits.
• Optional WordPress.org core checksum verification.
• Production configuration checks for debug output, file editing, and wp-config.php permissions.
• Monitor-only request inspection for high-confidence injection, script, traversal, and remote-file probes.
• Failed administrator-login and XML-RPC activity monitoring.
• New-user, role-change, plugin, theme, upload, and comment security signals.
• Selected database URL checks for unexpected off-site redirects.
• Standalone dashboard, Firewall & WAF, Scanner & Vault, Reports, and Settings screens.
• CSV security-evidence exports.
• Daily scheduled scans and manual scans.
• Optional email summaries through the site’s configured WordPress mail system.
• Explicit data-removal option for uninstall.

Safety model

Aviiimageworks Security Monitor reports suspicious indicators for administrator review. A finding is not proof that a request, file, account, or site is malicious. The plugin never performs automatic remediation and does not promise that a site is secure or free from malware.

Always review findings with a qualified administrator and create a verified backup before changing site files.

Privacy

By default, the plugin:

• Performs local scans only.
• Stores file-relative paths, signature identifiers, severity, details, and timestamps in the local WordPress database.
• Does not transmit findings, file contents, IP addresses, usernames, or site data to AVII IMAGEWORKS.
• Does not enable email notifications.

Administrators may explicitly enable email summaries. Those messages are sent through the WordPress site’s configured mail system to the address entered in plugin settings. AVII IMAGEWORKS does not receive them unless the administrator deliberately enters an AVII IMAGEWORKS address.

Stored findings older than 30 days are removed automatically. Administrators can clear findings at any time. Plugin data is retained on uninstall by default; an administrator can opt in to deletion before uninstalling.

External services

The optional core checksum feature contacts the official WordPress.org checksum API at https://api.wordpress.org/core/checksums/1.0/.

This request sends the installed WordPress version, site locale, normal HTTP connection metadata, and a user-agent containing the plugin version and site URL. WordPress.org returns expected checksums for WordPress core files. No file contents or scan findings are sent. The feature is disabled by default and runs only after an administrator enables it.

WordPress.org privacy policy: https://wordpress.org/about/privacy/