Case 08 · WPress Sentinel feature
Scan it. Back it up.
Prove it restores.
Inside WordPress, WPress Sentinel scans the site from every angle, hardens what it finds, and keeps full-site backups that are checked, volume by volume, before they are ever trusted with a restore.
- 01 // Role
- Security engineering · Product
- 02 // Product
- WPress Sentinel — WordPress plugin
- 03 // Covers
- Scanning · Hardening · Backup · Restore
- 04 // Status
- Live — presssentinel.com
A The brief
A backup nobody has checked is a hope, not a plan — and a scan that marks unreadable files as clean is worse than no scan. Site owners needed one plugin that finds problems honestly and can put the site back exactly as it was.
A.2 What it had to do
- 01Check core files against WordPress’s own published checksums
- 02Report anything it couldn’t read as unread — never as clean
- 03Back up files and database without exposing either
- 04Refuse a restore from any volume that doesn’t match its hash
B · Scan · Back up · Restore
Proven, not promised.
Three stations on one console. Run the scan, build a backup through its eight stages, then restore it — or tamper with a volume first and watch the restore refuse.
- Core filesvs WordPress.org checksums1 modified · restorable
- Suspicious code13 conservative patternsNothing flagged
- Hardening auditConfig, headers, exposure2 to fix · 1 click each
- File changesSHA-256 against baselineNo changes since baseline
- LoginsFailures, spikes, escalationsNormal · IPs stored hashed
- VulnerabilitiesPlugins and themes, by versionNone matched today
Anything it can’t read is reported as unread — never as clean.
- 01Prepare
- 02Index
- 03Archive files
- 04Database
- 05Archive database
- 06Manifest
- 07Verify
- 08Complete
- vol-01.zip
sha256 9f2c…41aehashed - vol-02.zip
sha256 b07d…e913hashed - vol-03.zip
sha256 3ac8…5f02hashed
Built in 15-second slices by the job queue, in a vault proven private before it’s called private.
- vol-01.zip
sha256 9f2c…41ae— - vol-02.zip
sha256 b07d…e913— - vol-03.zip
sha256 3ac8…5f02—
- Re-verify every volume
- Dry run · compatibility check
- Restore files and database
6 checks · 8 backup stages · every volume hashed
C · Capabilities
What it does.
- 01Core integrity
- Every core file compared with the checksums WordPress.org publishes; a modified file can be restored from the official release.
- 02Suspicious-code scan
- Thirteen conservative patterns. Findings are reported as potentially suspicious — never as confirmed malware — and can be quarantined.
- 03Twenty-check hardening
- Debug mode, salts, file editing, permissions, headers, XML-RPC, user enumeration, exposed config and readme files, versions and more.
- 04File and login monitoring
- SHA-256 baselines show added, changed and removed files; sign-in failures, spikes and role escalations are recorded with IPs stored only as salted hashes.
- 05Known vulnerabilities
- Installed plugins and themes matched by version against the Sentinel Intelligence database — and if no source is connected, it says so.
- 06Full-site backups
- Full, files-only or database-only, on a daily, weekly or monthly schedule, with five kept by default and any backup protected from rotation.
- 07A private vault
- Stored outside the web root where the host allows it; otherwise locked down and tested over HTTP — it is only called private once that is proven.
- 08Restore with a dry run
- A full verification and compatibility pass with nothing written, then a restore that sets originals aside until it completes.
D · Engineering
How it’s built.
- 01
Hash, then trust
Each volume’s SHA-256 is recorded as it is written and checked again before the backup is marked complete. One mismatch at restore time stops everything before a byte is written.
- 02
Built in slices
Backups run as fifteen-second slices from the job queue — resumable, in constant memory, independent of the browser tab.
- 03
No password on the command line
The database is dumped in pure PHP rather than with mysqldump, so credentials never appear in a process list.
- 04
Nothing half-saved
Files that can’t be read in full are skipped and reported, not stored cut short — and restores refuse symbolic links.
Stack
Brand system
- Sentinel blue
#2F86FF - Bronze
#D39A63 - Ground
#08090C - Verified
#35C88A
E · Impact
By the numbers.
- 20
- Hardening checks
- 13
- Suspicious-code patterns
- 8
- Stages in every backup
- 0
- Bytes written before every volume verifies
Vulnerability data: NVD, Wordfence Intelligence, WPVulnerability.net, WordPress.org.