Hanu Malware Guard

Hanu Malware Guard is a self-contained WordPress security plugin covering eight areas:

1. 01Malware Scanner — recursively scans themes, plugins, mu-plugins and uploads for a curated set of regex heuristics matching common backdoor/webshell patterns (obfuscated eval(), webshell string signatures, command execution of user input, arbitrary file writes, etc). Any executable PHP-family file found inside wp-content/uploads is flagged outright, since WordPress never legitimately places runnable code there.
2. 02File Integrity Monitor — hashes every scanned file and records a baseline. Later scans report files that are new, modified, or deleted since the previous pass, so you can see exactly what changed and when.
3. 03Cron Guard — catches cron-based persistence. WordPress fires whatever hook name is stored in its cron option regardless of whether any currently-loaded code registers a handler for it. Malware commonly schedules a job under an unfamiliar hook name and re-adds its own callback dynamically, so the job keeps firing even after the plugin/theme file that “owns” it is deleted. Hanu Malware Guard snapshots every scheduled cron event on each page load, flags any hook with no currently registered callback (“orphan”) or a randomly-generated-looking name, and lets you: Block a hook: unschedules every pending event for it immediately and blacklists the hook name so WordPress refuses to re-schedule it in the future (via the pre_schedule_event filter).
4. 04Trust a hook: marks it as known-good so it stops appearing as a flag.
5. 05Cross-references file changes against flagged cron activity so you can see file changes that happened right around when a suspicious cron job ran.
6. 06Login Brute-Force Lockout — locks out an IP/username combination after too many failed logins within a configurable window. Runs as an early authenticate filter, so it covers both wp-login.php and XML-RPC logins (both authenticate through the same core wp_authenticate() call). Manage active lockouts and view recent failed attempts on the Login Security page.
7. 07Firewall — blocks the handful of request patterns that account for most automated WordPress attacks: XML-RPC pingback amplification abuse (optional full XML-RPC disable), ?author=N and REST /wp/v2/users username enumeration, and requests whose URL contains obvious SQL-injection / path-traversal / PHP-injection strings. Logged-in administrators are always exempt from the query-string check so normal site use is never at risk of self-lockout. Blocked requests are logged on the Firewall page.