Recover from malware without breaking your site

Four scan types. Quick checks changed files, admin accounts and scheduled tasks; Full adds official checksums, all files and the database; Integrity and Database scans focus on one area each.

Chunked, resumable engine. Each request does a bounded slice of work and saves its position, so scans survive PHP timeouts and can run from the browser, WP-Cron or WP-CLI.

Layered detection. Location and extension checks, 27 malware signatures, PHP token analysis, obfuscation heuristics and SEO spam heuristics combine into a confidence score for each finding.

Sensitivity setting. Low, medium or high sensitivity sets the confidence a file needs before it is reported.

Broad file coverage. Checks PHP, JavaScript, HTML, .htaccess, ini files, images that may hide PHP and extension-less files, never follows symlinks, and skips .git, .svn and node_modules.

Shared hosting controls. Low-resource mode, configurable seconds per slice, a maximum file size and path or wildcard exclusions keep scans gentle on modest servers.

Database scan. Walks posts, postmeta, options, comments and user URLs for injected scripts, scripts from high-abuse domains, PHP code, hidden link blocks, encoded payloads and spam.

Configuration checks. Flags a mismatch between the home and siteurl hosts, and active-plugin entries that point to missing or unusual files.

Hidden and suspicious administrators. Finds administrators concealed from the Users list, attacker-style usernames, disposable or missing admin e-mail addresses, and new or unreviewed admin accounts.

Suspicious scheduled tasks. Finds WP-Cron tasks with code-like or URL arguments, callbacks living in uploads, hidden or temporary files and random-looking hook names.

Per-finding actions. Clean automatically, restore an original core file, restore from a trusted WordPress.org package, disable a plugin, quarantine, ignore, or for accounts and tasks, trust, demote, revoke sessions or disable.

Preview, backup and syntax check. A dry-run line diff comes before any file change, a backup is stored in a protected vault, and cleaned PHP must pass a syntax check or the original is restored.

Post-change site check. Aegis loads your front page before and after risky changes and rolls back automatically if the site stops responding correctly.

Quarantine vault. Stores compressed, non-executable copies in a private folder, above the web root where possible, which can be restored and are only purged after you type DELETE.

Action history and investigation. Every action can be rolled back in one click, and an Investigation report sets out the infection window, persistence, related accounts and an after-cleanup checklist.

Careful database cleanup. Edits plain text columns only, removing verified injected script and iframe blocks with a backup, while serialised and JSON values are reported but never rewritten.

Learning and Enforce modes. Learning mode, the default, logs requests that would be blocked, and Enforce mode returns HTTP 403 with a reference number.

27 versioned rules. Cover SQL injection, XSS, remote code execution, Log4Shell-style JNDI, Shellshock, directory traversal, remote file inclusion, dangerous uploads, XXE, XML-RPC multicall and probes for backups, .env and .git files.

Virtual patches. Two virtual patches, for WP File Manager CVE-2020-25213 and Duplicator CVE-2020-11738, switch on only while a vulnerable version is installed.

Evasion-resistant inspection. Normalises input through repeated URL and HTML-entity decoding, null bytes and SQL comments, and rejects uploaded images that contain PHP.

IP bans and country blocking. Automatic bans after repeated blocks, 404 floods and XML-RPC rate limits, manual 24-hour or permanent bans, IP and CIDR lists, and country blocking via Cloudflare or server GeoIP data.

Per-rule control. Switch individual rules on or off, add one-click Allow this exceptions from the activity list, and confirm search-engine crawlers with reverse and forward DNS.

Login attempt limits. By default, 5 failures in 15 minutes trigger a 30-minute lockout that doubles on repeats, and three lockouts in a day become an IP ban.

TOTP two-factor authentication. Works with any authenticator app through a setup key or tap-to-open link, and issues ten single-use recovery codes.

Hardened 2FA challenge. Each challenge is bound to the user, IP and a one-time key with limits on wrong codes, and XML-RPC password logins are refused for 2FA users.

Enumeration blocking. Generic login errors and blocking of author queries, the public REST users list and the users sitemap keep account names private.

Strong password policy. Enforces a minimum length, a common-password list, no username or e-mail name, and either a character mix or a passphrase of 20 or more characters.

New administrator guard. Alerts on, or blocks and reverts, admin rights granted outside a logged-in admin session, and alerts when an admin signs in from a new IP.

Emergency lockdown. Restricts wp-admin, wp-login and admin REST access to listed IPs or CIDR ranges, and always adds your current IP when enabled from the dashboard.

Log out all users. Ends every session on the site while keeping you signed in.

Administrator overview. Shows each administrator's 2FA status and session count, and lets you reset 2FA for other administrators.

20 checks in five groups. Covers WordPress, headers, access, files and server configuration, with 14 items applied in one click and 6 manual items with exact instructions.

One-click fixes. Includes disabling the file editor and XML-RPC, security headers, HSTS, blocking PHP in uploads and sensitive files, wp-config.php permissions and moving exposed debug logs or backups.

Real verification over HTTP. Nine items are checked over HTTP, for example by writing a harmless probe file in uploads and testing whether the server executes it.

Reversible by design. Every applied item shows its risk and can be rolled back, .htaccess changes are written atomically between Aegis markers, and wp-config.php is never edited.

Rules for Nginx and OpenLiteSpeed. Where .htaccess does not apply, Aegis shows the equivalent server rule to copy.

Official checksums. WordPress core files and WordPress.org plugins are compared with official checksums, and unknown PHP files in wp-admin or wp-includes are flagged.

Trusted baseline. The first completed scan builds a baseline, and later scans record new, modified and deleted files and permission changes.

Change timeline. Shows detection time, change type, risk, path, old and new hash, modified time and whether a change matches an official package or an update.

Security score. A 0 to 100 score with an A to F grade lists every deduction, alongside counters, a 14-day attack trend and recent events.

Activity log. Filter events by type and minimum severity, with retention configurable and set to 90 days by default.

Notifications. E-mail, Slack, Telegram and Discord alerts, each with its own minimum severity, a test button and a de-duplication window, with webhook secrets stored encrypted.

Self-protection. Only administrators can deactivate or delete Aegis, deactivation is logged, and the plugin can verify its own files against its checksums.