Scan and hardening checks
One button checks HTTPS, updates, the admin login, debug display, the file editor and more. Each finding says what to open next. A pass means that check found nothing, not that the site is clean.
Version 0.1.0 · Free WordPress plugin
Ironlatch Security Scanner.
Security checks that show their evidence. Ironlatch Security Scanner scans your site and shows you what it found and where. Nothing changes until you approve it.
It isn't on WordPress.org yet. The download link will appear here once the plugin is approved. WordPress 6.6+ and PHP 8.1+. AI assistant access needs WordPress 6.9+ and the official MCP Adapter plugin.
Example findingMalware scan
Suspected code A PHP file in uploads looks like a web shell
| File | /wp-content/uploads/2026/10/cache.php |
|---|---|
| Evidence | Line 3 runs code taken straight from the request. The finding names the rule that matched. |
| Next step | Check the file with your host. The plugin hasn't deleted or changed it. |
What's in version 0.1.0
Every protection is off when you install the plugin. Nothing runs in the background until you press Scan for the first time. After that, the scan repeats once a day.
Malware scan
63 local rules look for web shells and injected code in plugins, themes, uploads, mu-plugins, unlisted folders and loose PHP files. A hit names the file, the line and the rule. Nothing is deleted, and files stay on your server.
File integrity and repair
Compares core and WordPress.org plugin files with the published checksums, and up to three themes with their release ZIP. You can repair a changed plugin file after reviewing both hashes, then roll it back.
Vulnerability lookups
Off until you turn it on. Checks core, plugin and theme versions against WPVulnerability and can email you about high-severity plugin issues.
Login and accounts
Sign-in attempt limits, emailed sign-in codes, a hidden bot field, a sum question, breached-password checks, idle sign-out, registration approval, password rules and session lists. For an authenticator app, it points you to the Two Factor plugin.
Traffic
Hostname, browser and referrer block lists, a live request log, hotlink protection, comment and registration limits, REST rate limits, network rules and a security headers check. Each one can be turned off from WP-CLI.
AI assistant access (MCP)
Off by default. An assistant can list findings, run the hardening checks and propose a sign-in limit change. Nothing changes until an administrator approves it in wp-admin.
Your files stay on your server.
The scans run on your own server. File contents, passwords and personal data are never sent anywhere, and AmazingPlugins doesn't receive any data from your site.
The plugin contacts outside services only for the features that need them. WordPress.org provides checksums and release files for the integrity scan. WPVulnerability answers version lookups after you turn them on. Pwned Passwords gets the first five characters of a password hash after you turn on breached-password checks. The plugin's readme lists exactly what each one receives.
AI can suggest. You approve.
On WordPress 6.9 or newer, with the official MCP Adapter plugin, an administrator can let an AI assistant list findings and run the local hardening checks. It can also propose a sign-in limit change. You see the proposal in wp-admin, and nothing changes until you approve it.
The assistant can't approve its own proposal, start a file repair or run arbitrary commands. This is off by default.
What it doesn't do.
- It doesn't have a maintained malware signature feed. Its rules update with plugin releases.
- It doesn't remove malware or rebuild a whole plugin.
- It doesn't check from outside your server whether a file is publicly reachable.
- It doesn't have a built-in authenticator app. It points you to the Two Factor plugin instead.
- Daily scans run on WP-Cron, so a quiet site may run them late.
If you need a managed firewall rule feed today, compare it with Wordfence Free. For public file checks, see the Custonis comparison. The WordPress security checklist covers steps you can take on any site.