=== realmaker Security Quick Check ===
Contributors: realmaker
Tags: security, malware, php2shell, integrity, checksums
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Small, free quick check for traces of a break-in, for example after the PHP2Shell vulnerability. Read-only.

== Description ==

realmaker Security Quick Check is a small, free tool. It is not a full security scanner and not a premium product. It looks for typical traces of a break-in and shows what deserves a closer look, with a short explanation and advice for every point.

It was written after the PHP2Shell vulnerability (CVE-2026-109618, CVE-2026-109619) in October 2026, but the checks are useful for any WordPress site.

**What it checks**

* PHP version: does it contain the PHP2Shell fix? The build date shows whether a host may have added the fix without changing the version number. Hosts that confirmed such a backport for all servers are recognized by the server name.
* Available updates for WordPress, plugins and themes.
* WordPress core files against the official checksums from wordpress.org (localized and English package).
* Plugins from wordpress.org against their official checksums, including unknown PHP files in plugin folders.
* All other PHP files for typical traces of backdoors and web shells.
* PHP files in the uploads folder, hidden PHP files and PHP code inside images.
* .htaccess, .user.ini and php.ini for settings that load code or redirect visitors.
* Other applications next to WordPress, such as old installations, and whether they answer from outside.
* Administrators and application passwords, read directly from the database.
* Scripts in posts, pages and settings, changed files and content in a selectable period, and scheduled tasks.

**What it does not do**

* It changes nothing. It does not delete, repair or quarantine files.
* It is no proof that a site is clean. Malware on a site that has already been taken over can hide from tools that run inside the same site.
* Premium plugins, custom plugins and themes cannot be compared with official checksums. The code search still covers them.

**Privacy**

For the comparison, the WordPress version and the folder names and version numbers of your plugins are sent to wordpress.org (api.wordpress.org and downloads.wordpress.org). Nothing else leaves your site. The report is stored in your database until you delete it or uninstall the plugin.

== Installation ==

1. Upload the ZIP under Plugins → Add New → Upload Plugin and activate it.
2. Open Tools → Security Quick Check and click "Start check".
3. Read the report. If you no longer need the plugin, delete it; this also removes the stored report.

== Frequently Asked Questions ==

= Does the check slow down my site? =

No. It only runs when you start it, in small steps of a few seconds each.

= The check reports a changed plugin file. Am I hacked? =

Not necessarily. If you or your agency changed the plugin, the difference is expected. Otherwise reinstall the plugin from its original source.

= My host blocks uploads because of PHP2Shell. Does the check still work? =

Yes. The page sends its requests without multipart uploads, so such a block does not affect it.

== Changelog ==

= 1.0.1 =
* Servers of hosts that patched PHP2Shell on all servers with a backport (currently Serverprofis) are recognized by their server name. With a fresh PHP build, the PHP check shows green there, even though the version number stays the same.
* The report shows the server name.

= 1.0.0 =
* First release.
