Nightward watches WordPress from the inside. Every outbound request, faked response, new administrator and changed file is traced to the plugin file and line responsible. A report reaches your inbox every evening, and anything critical arrives the moment it happens.
The same callback has faked responses for 3 different domains: it can intercept any outbound request of this site.
Most WordPress security tools look at the site from the outside: they match files against known malware and block suspicious visitors. Useful, but they rarely answer the question you have when something odd happens.
tells you a file looks like known malware. A new or custom backdoor looks like nothing at all.
tells you a request from outside was blocked. It sees nothing that installed code does inside the site.
tells you which installed plugin or theme did what, in which file, on which line, and when.
Runtime monitors see what code does while pages load. Scheduled checks look at files, users and configuration every hour and every night. Everything goes into one event log with five severity levels.
wp_remote_*Every request the site makes, grouped by host and the plugin that made it. Paste sites, tunnels, request-capture services, dynamic DNS, Telegram bots and Discord webhooks are flagged.
pre_http_requestCode that answers a request itself so it never leaves the server. The exact callback is named, even when several anonymous functions share one priority.
authenticate · user_has_capWho is attached to login, permissions, the users and plugins lists, updates and mail. New callbacks and code compiled with eval() are reported.
user_register · set_user_roleAdministrators created by code, inserted with raw SQL or hidden from the Users list. Admin credentials changed by plugins, new application passwords, logins from new networks.
siteurl · default_roleSite address, admin e-mail, default role, registration, role capabilities, plugins activated by code. Options written on almost every page view. Autoload weight.
checksums · snapshotCore and WordPress.org plugins against official checksums. Premium plugins and themes against their own first snapshot: a change without a version bump is reported.
uploads · mu-pluginsScripts in uploads, PHP hidden in images, .htaccess and .user.ini tricks, unknown PHP in wp-content, new must-use plugins.
wp-cronNew tasks, random-looking names, PHP or base64 in arguments, tasks with no handler left behind by removed plugins.
upgrader_pre_downloadWhere pending and downloaded updates come from. A WordPress.org plugin updated from another server is blocked.
loopbackChecked from outside: public debug logs, .env and wp-config backups, PHP execution in uploads (with a real test file), XML-RPC, user enumeration, headers.
Pirated plugins answer their own licence checks so the request never leaves your server. Nightward places a marker after every callback on pre_http_request, so it knows which one replaced the response.
An administrator created from the Users screen is routine. One created by a plugin during an anonymous request is not. Nightward records who did it and from which file.
Premium plugins have no public checksums, so Nightward takes a snapshot at the first scan. Later, a file that changed while the version number stayed the same is reported. Files with known malware markers such as eval(base64_decode( are raised to critical.
Scans run in small batches through WP-Cron, so they finish on shared hosting without hitting time limits.
The daily report lists what happened since the last one, the most serious first. Critical findings do not wait for it: they are sent the moment they are detected.
Every host the site contacted in the last 30 days, which plugin contacted it, how often, and how many responses were faked. Trust a host with one click.
Each check shows what was found and how to fix it. Exposed files are requested from outside, the way an attacker would.
Report time and recipients, alert level and hourly limit, each monitor on or off, trusted hosts and scan schedule.
A monitor you trust should say where its view ends. These limits are also listed inside the plugin.
Yes. Nightward does not block traffic or scan for signatures, so it does not compete with them. It covers what they do not: the behaviour of installed code, with attribution. On a test site with Sucuri, MalCare and Atlant Security installed, all four ran side by side.
Monitoring on each request is limited to a few in-memory checks. A stack trace is taken only when the site makes an outbound HTTP request. The hook check compares a short signature that is stored in one autoloaded option, and option writes are sampled on one page view in twenty. File scans, audits and hardening checks run in the background through WP-Cron.
No. There is no account, no telemetry and no external service. The only outbound requests Nightward makes are to WordPress.org checksum endpoints and to your own site for hardening checks. Reports are sent with your site's own wp_mail().
For the first 24 hours Nightward learns what is normal for your site: which hosts plugins contact, which hooks they use, which scheduled tasks exist. These are recorded silently. Critical findings are reported from the first minute.
No. Review the finding, then press "Accept current files" for that package on the Integrity screen. The current files become the new reference.
Nightward is distributed from this site. New versions are published here with a changelog in the documentation, and the source code is on GitHub.
Nightward is built and tested for single sites. It can be network-activated, but reports and settings are not yet separated per site.
Nightward is made by Ihor Muzychenko, a WordPress developer from Ukraine with more than ten years of client work on Bricks, ACF, WooCommerce and Polylang sites.
It grew out of routine audits of plugins from unofficial sources, where the question was never "is this file malware?" but "what does this code do on a live site?". More at muzychenko.dev.
Upload the zip under Plugins → Add New → Upload Plugin and activate.
Version 1.0.2 · released 28 September 2026 · WordPress 6.2+ · PHP 7.4+