Case 02 · Security product
Know your site is safe.
Then let it fix itself.
WPress Sentinel is the WordPress security platform we designed, engineered and launched: a free scanner that sees a site the way an attacker does, and a plugin that closes every gap from the inside — then proves the site still works.
- 01 // Role
- Product · Security engineering · Brand · Website
- 02 // Platform
- WordPress plugin + external scanner
- 03 // Launched
- 2026
- 04 // Status
- Live — presssentinel.com
A The brief
Most WordPress security tools stop at a warning — or show a green tick for checks they never ran. Owners still couldn’t answer the one question that matters after an update: is the site still safe, and does it still work?
A.2 What it had to do
- 01Show an owner what an attacker sees — in seconds, with nothing installed
- 02Turn every finding into a fix that can be applied, and undone
- 03Make updates safe: a recovery point first, a rollback if anything breaks
- 04Never claim something is fine when it hasn’t been checked
B · Signature
Thirty-six checks. One report.
The free scanner reads a site from the outside — WordPress itself, infrastructure and headers, DNS and reputation — and shows its working as it goes. This is its real check list.
WordPress itself21 / 21
Infrastructure & headers12 / 12
DNS & domain2 / 2
Reputation1 / 1
Findings — ranked by severity
- highSecurity headersNo Strict-Transport-Security or X-Content-Type-Options headerInfrastructure & headers
- mediumXML-RPC endpointxmlrpc.php answers — brute-force amplification possibleWordPress itself
- mediumUser enumeration (REST)User names listed at /wp-json/wp/v2/usersWordPress itself
- lowReadme exposurereadme.html reveals the WordPress versionWordPress itself
- lowCSP analysisNo Content-Security-Policy setInfrastructure & headers
- infoSecurity.txtNo /.well-known/security.txtInfrastructure & headers
Verify the site is yours and each finding opens up: what it means, how to fix it, and the evidence.
The scanner’s real check list, replayed fast on a sample site. A real scan takes about thirty seconds and changes nothing.
C · Live
The product, live.
presssentinel.com — the scanner, the plugin and the intelligence behind them, on one console-style site. Pick a screen to look around.
D · Inside WordPress
Monitor. Protect. Fix. Verify.
Installed, the plugin closes the loop the scanner can’t: it watches, matches every plugin against our own vulnerability database, fixes what is safe to fix, updates behind a recovery point — and verifies pages and forms still work afterwards.
Choose a run to watch the loop.
- 01 · MonitorFiles, accounts, logins and scheduled tasks — watched all the time.
- 02 · MatchEvery plugin and theme version checked against our own vulnerability database, rebuilt daily.
- 03 · FixSupported fixes applied in one click — with a recovery point first and an undo after.
- 04 · UpdateEvery update scored 0–100 for risk, and applied behind a recovery point.
- 05 · VerifyPages and forms tested after the change. If something broke, it rolls back on its own.
E · Capabilities
What it does.
- 0136-point external scan
- Read-only, about thirty seconds, nothing installed. Every finding ranked from critical to informational.
- 02Our own vulnerability database
- Every installed plugin and theme version matched against tens of thousands of advisories, rebuilt every day.
- 03Fix Center
- Supported fixes applied in one click from inside WordPress — each with a recovery point and an undo.
- 04Safe Update
- A nine-step workflow scores every update’s risk from 0 to 100, runs the site’s own tests and rolls back on its own.
- 05A score you can trace
- Health built from five measured categories — never a single number from nowhere.
- 06Evidence for owners
- Prove the site is yours with a meta tag, a file or a DNS record, and every finding opens up with its fix and evidence.
- 07Monitoring that stays private
- File integrity, logins, uptime, broken links, PHP errors and SSL — with login IPs stored only as salted hashes.
- 08AI Doctor
- A plain-language diagnosis of what is wrong and why, using the owner’s own AI key.
F · Engineering
How it’s built.
- 01
“Unable to verify” is not a pass
When a check can’t be completed, Sentinel says so. A false green tick is treated as a bug.
- 02
Signed and sealed
Licence responses are Ed25519-signed, the backup vault sits outside the web root wherever the host allows, and fix details are released only to verified owners — enforced on the server.
- 03
Holds on any host
Security headers are sent from PHP, so they stay in place on servers that ignore .htaccess.
- 04
Tested before it ships
Strict-typed PHP and a React + TypeScript admin, checked by static analysis and unit, integration and stress tests — with a bug sweep before every release.
Stack
Brand system
- Sentinel blue
#2F86FF - Bronze
#D39A63 - Ground
#08090C - Verified
#35C88A
G · Impact
By the numbers.
- 36
- External checks in about 30 seconds
- 74,291
- Advisory records, refreshed daily
- 9
- Steps in every Safe Update
- 5
- Measured health categories
Vulnerability data: NVD, Wordfence Intelligence, WPVulnerability.net, WordPress.org.