VulnTitan – Malware Scanner, Vulnerability Scanner & Security

Descripció

VulnTitan is a WordPress security plugin focused on malware scanning and removal, vulnerability detection, file integrity monitoring, firewall protection, and anti-spam controls for comments and supported forms.

Instantly scan your WordPress site for malware infections and known vulnerabilities, review detailed results, and clean or remove malware safely using a guided fix workflow with automatic backups.

VulnTitan focuses on practical protection: vulnerability detection, malware scanning and removal, file integrity monitoring, firewall protection, anti-spam defense for comments and supported forms, hidden custom login access, and a weekly executive security digest every 7 days.

The light indigo dashboard brings malware, vulnerability, and file integrity scanners into clear view. Review live activity in Firewall and configure protection in eight organized Settings groups, with existing options and saved settings preserved when updating.

Malware Scanner

The WordPress malware scanner inspects your site files for suspicious code patterns and known malicious signatures.

• Detect malware infections in core, plugins, and themes
• Review problematic files with contextual code preview
• Safe-fix workflow with automatic backups
• Clear severity indicators and actionable recommendations

Vulnerability Scanner

The vulnerability scanner checks your installed WordPress core, plugins, and themes against a real-time vulnerability database powered by the VulnTitan API.

• Detect vulnerable plugins and themes
• Identify outdated components with known security risks
• Real-time vulnerability intelligence
• Clear risk explanations and remediation guidance

File Integrity Scanner

Monitor unauthorized file changes and unexpected modifications.

• Baseline comparison for WordPress files
• Queue-based processing for performance safety
• Visual status legends for fast review
• Actionable next steps for suspicious changes

Firewall, Login, Comment & Form Protection

VulnTitan includes firewall, WAF, login protection, and anti-spam controls to block common attack patterns and protect WordPress login, comment, and supported form submission surfaces.

• Early MU-plugin runtime request guards
• SQL injection (SQLi) payload protection
• Command injection detection
• Suspicious path traversal blocking
• Endpoint whitelisting controls
• Login lockout protection against brute-force attacks
• TOTP-based two-factor authentication for selected roles
• Recovery codes and trusted-device support for enrolled accounts
• CAPTCHA protection for WordPress login/registration, WooCommerce login/registration, WordPress lost-password, and optional comment forms
• XML-RPC allow, disable, or rate-limit policy controls with IP allowlisting
• Weak-password blocking during profile updates, password resets, and compatible registrations
• Comment Shield with honeypot, signed tokens, submit-time validation, duplicate detection, guest link limits, IP rate limiting, and moderation-aware logging
• Form Shield for Contact Form 7 and Fluent Forms with honeypot, signed submit tokens, link heuristics, repeated-domain detection, and IP rate limiting
• Form spam blocks are logged in Firewall activity with provider-aware source labels for easier review
• Suspicious comments can be held for moderation or blocked immediately
• REST comments can enforce signed anti-spam tokens and CAPTCHA when anonymous REST commenting is enabled elsewhere
• Configurable custom login slug so administrators can use a private login URL instead of the default wp-login.php
• Default wp-login.php and guest wp-admin access can be hidden behind a 404 response when custom login is enabled
• Weekly executive security report email with 7-day firewall, login abuse, WAF, form spam, and comment moderation statistics

Security-First Architecture

• Secure storage and cleanup of scan queues and logs
• Hardened backup handling outside ABSPATH by default
• Hardened malware and integrity scan actions with stricter capability checks and in-root path validation
• Adaptive performance tuning for safe large-site scanning

WP-CLI Support

VulnTitan supports WP-CLI commands for malware, integrity, and vulnerability scans so administrators can run checks from the terminal, scripts, or server automation.

• wp vulntitan scan malware
• wp vulntitan scan integrity
• wp vulntitan scan vulnerability
• wp vulntitan scan all
• Optional flags: --scope=plugins, --format=json, --fail-on-findings

External services

This plugin connects to an external API at https://vulntitan.com/api/vulnerabilities to fetch up-to-date vulnerability data for WordPress core, plugins, and themes. This data is essential for detecting known vulnerabilities during scan operations.

When a vulnerability scan is performed, the following data is sent to the VulnTitan API:
– The slug and version of each plugin
– The slug and version of each theme
– The WordPress core version

This data is transmitted only during scans initiated by the user or by scheduled scan settings. No personal, user-identifying, or sensitive site data is collected, transmitted, or stored.

The external service is provided and operated by VulnTitan.com.

• Terms of Service: https://vulntitan.com/terms
• Privacy Policy: https://vulntitan.com/privacy

Optional deactivation feedback

When you deactivate VulnTitan from its individual Deactivate link on the Plugins screen, an optional survey lets you share why you are leaving. Select Send feedback & deactivate to explicitly agree to email your selected reason, optional comment, and VulnTitan, WordPress, and PHP versions to deactivated@vulntitan.com for product improvement. The survey shows these details before sending.

Feedback uses your site’s configured WordPress mail service (wp_mail). The message body does not automatically include your site URL, administrator email, IP address, installed plugin list, or scan results. The mail service’s sender address and routing headers may identify your site; this is not an anonymous email service. Avoid entering personal information or secrets in the optional comment.

Skip & deactivate sends no feedback. Closing the survey cancels deactivation. Bulk, WP-CLI, and other programmatic deactivations do not send survey feedback. Email failures do not prevent deactivation. A short local cooldown prevents repeat submissions; no background usage tracking is added.

Privacy Policy: https://vulntitan.com/privacy