SecAudit
Security audits for WordPress, built by AngelForce. SecAudit finds what puts a WordPress site at risk and turns it into evidence you can show to customers and auditors.
SecAudit is launching soon. Join the launch list at secaudit.eu.
What SecAudit checks
- Malware and web shells
- Signature and hash matching, plus entropy analysis to spot obfuscated code.
- Vulnerable code
- Taint analysis of your own plugin and theme code for SQL injection, XSS, file inclusion, privilege escalation and missing CSRF checks.
- File integrity
- A baseline of your files, alerts on changes, and WordPress core checked against official checksums.
- Known vulnerabilities
- Plugins, themes and core compared with current versions and mapped to CVEs; end-of-life PHP is flagged.
- Spam injection
- Hidden links and SEO spam in posts, options and theme files.
- Compliance reports
- Findings mapped to OWASP, GDPR Article 32 and NIS2 Article 21, exported as HTML and CSV.
Why we built it
In our work we see the same WordPress problems again and again: outdated plugins, injected spam links, backups left in public folders and administrator accounts nobody remembers. SecAudit checks for them automatically and shows what to fix first.
SecAudit seal verifier
Check that a SecAudit security seal on a WordPress site is genuine, current and confirmed by its owner.
SecAudit verifiedSigned record, checked in your browser
Verify a seal