A plugin that was running and not in the plugin list

What happened.

On 1 October a company's terms and privacy pages began showing "No results found". The pages were still in WordPress. A plugin nobody had installed was running, and the Plugins screen in wp-admin did not list it: the database held 15 active plugins, the screen showed 14.

It had placed one rewrite rule ahead of WordPress's own page rule, and that one line took every top-level page off the site. It was found and fixed in about ten minutes, through Respira, with no server access.

What the scanner looks for.

One scan reads a site and checks four things:

• Every known vulnerability in WordPress, your plugins and your themes: more than 41,000 records from the Wordfence Intelligence database, refreshed every six hours. It names the version that fixes each one.
• The incidents in the news, each with its own traces: the WordPress security releases of August and September, the backdoored builds of Admin Menu Editor Pro, and others as they are published.
• Signs that someone was already in: changed WordPress core files, administrators added recently, application passwords, PHP files sitting in uploads.
• New in 9.1.10, what wp-admin does not show: a plugin that is active and hidden from the plugin list, and a rewrite rule that answers your pages before WordPress does.

When something turns up, your AI can fix it with your approval: update to the exact version, or quarantine a plugin, which stops it without any of its own code running and keeps every file. Nothing is deleted.

What it covers and how it works: the Respira WordPress vulnerability scanner.

Two minutes, for all your sites.

Update the plugin to 9.1.10 or later from wp-admin. Then open the Security page of your dashboard and press Scan all sites. It reads and changes nothing, and it goes three sites at a time. The page is part of every paid plan.

Of the 67 sites scanned from the dashboard so far, 61 had at least one thing worth a look.

Or ask the AI you already use:

Run the security audit on my site with a deep scan. Tell me in plain words whether anything is active that the plugin list does not show. Change nothing.