WordPress plugin

Download the plugin (zip). Requires WordPress 6.0+ and PHP 7.4+. GPLv2 or later.

Install

1. In wp-admin, go to Plugins → Add New → Upload Plugin, choose the zip, install and activate.
2. In Lyntcast, open Sites → Connect WordPress, enter your site address and approve the connection. The plugin is configured automatically (its settings are under Settings → Lyntcast).
3. Leave it in Monitor mode for a week to see what it would catch, then switch to Enforce.

Monitor and Enforce

Settings

• Content to protect: choose the post types the plugin guards.
• Can publish without approval: roles exempt from holds.
• Hold edits to published content: in Enforce mode, the live page stays as it is and the edit goes to Lyntcast for approval.
• Block injected code: new <script> tags, inline event handlers, javascript: links, hidden spam text, forms, unknown iframes and obfuscated code.
• Admin alerts and quarantine: you’re alerted when an administrator account is created or promoted. In Enforce mode, administrators created outside wp-admin (or WP-CLI) are demoted on the spot, which is how malware plants hidden admin accounts.
• WooCommerce price guard: block price drops of more than a set percentage made outside Lyntcast (0 = off). In Monitor mode they are reported. Price history recorded here powers the EU 30-day “was” price rule.
• Turn off XML-RPC: an old remote-publishing interface often used in attacks.
• Fix missed schedules: publish scheduled posts WordPress missed.

Reinfection alerts

When a hacked site keeps coming back after a cleanup, something is usually living outside the files you deleted. From version 0.3.0 the plugin watches those places and tells you, in Lyntcast (Slack and email to owners and admins) and under Settings → Lyntcast → Integrity in WordPress.

• Plugins and themes: a plugin installed, activated or updated, or a theme installed or updated, other than by a signed-in administrator in wp-admin (or WP-CLI, or a background auto-update). The alert says who did it and how: REST, an Application Password, XML-RPC, cron or unknown code. Theme switches are always reported. Changes made the normal way are recorded in the audit log without an alert.
• Hourly integrity check of:
  • new or changed must-use plugins (wp-content/mu-plugins), which run on every page and can't be switched off in wp-admin;
  • PHP files in wp-content/uploads (.php, .phtml, .phar and similar), with how many there are and where;
  • drop-ins and other PHP files directly in wp-content (db.php, object-cache.php, advanced-cache.php…);
  • .htaccess, .user.ini, php.ini and wp-config.php, and PHP's auto_prepend_file (a file run before every page);
  • new scheduled tasks (WP-Cron), a common way to reinstall malware;
  • plugins switched on by writing to the database directly, without being activated;
  • autoloaded settings containing base64_decode, eval, gzinflate or str_rot13 calls, or scripts loaded from other sites.

The first check records what is there as the baseline, without alerts. After that, each new or changed item is reported once. Mark as expected (in WordPress) makes it part of the baseline and closes the alert in Lyntcast. When you remove something, it leaves the baseline, so if it comes back you are told again. That is the signal that the real source of the infection is still there.

Detect and alert only. The plugin never deletes a file, deactivates a plugin or changes a setting on its own, in Monitor or Enforce mode: a wrong guess would take the site down, and the person who knows the site should decide. The check runs from WP-Cron (or after an administrator's page load if cron hasn't run for an hour), stops after about a second and caps how many files it looks at; large uploads folders are covered as far as time allows each hour, newest months first. Nothing runs on the pages your visitors see.

In Lyntcast, open alerts show under Sites → Needs attention and on each WordPress site, count towards the site's lockdown checks, and appear in the portfolio view for people who work across several workspaces.

Change trail

Every create, update, trash and delete is reported to Lyntcast with who did it and how: the admin screen, REST, an Application Password, XML-RPC, WP-CLI or cron. Held publishes and held edits appear in the review inbox like agent changes.

Security scan and clean restore

From Sites, the security scan looks for injected code in stored content and for content shown only to search engines (cloaking). Restore clean version rolls a single post back to its last clean revision. The restore is recorded and can itself be undone.

Site watch

For WordPress sites, Lyntcast checks robots.txt, the sitemap and the home page as Google sees it every hour, against a baseline you accept. You’re alerted once per problem: robots.txt de-indexing the site or pointing to a foreign sitemap, sitemap pages on other domains, sudden sitemap growth (injected spam pages), and new outbound links on the home page. “Accept as normal” resets the baseline.

What it can’t do

Lyntcast protects content: what gets published, by whom, and how to undo it. The reinfection checks tell you where to look; they don't clean a site. Keep WordPress, plugins and themes updated and use strong passwords. No content tool can stop an attacker who can run code on your server.