Title: Blueternal BOLT Security Toolkit Author: jfgamsby Published: 17.5.2026 Last modified: 17.5.2026 --- Hae lisäosia ![](https://ps.w.org/blueternal-bolt-security-toolkit/assets/icon-256x256.png?rev =3534695) # Blueternal BOLT Security Toolkit [jfgamsby](https://profiles.wordpress.org/jfgamsby/) [Lataa](https://downloads.wordpress.org/plugin/blueternal-bolt-security-toolkit.0.6.9.zip) * [Tiedot](https://fi.wordpress.org/plugins/blueternal-bolt-security-toolkit/#description) * [Arvostelut](https://fi.wordpress.org/plugins/blueternal-bolt-security-toolkit/#reviews) * [Asennus](https://fi.wordpress.org/plugins/blueternal-bolt-security-toolkit/#installation) * [Kehitys](https://fi.wordpress.org/plugins/blueternal-bolt-security-toolkit/#developers) [Tuki](https://wordpress.org/support/plugin/blueternal-bolt-security-toolkit/) ## Kuvaus Blueternal BOLT Security Toolkit (BOLT) scans your WordPress site and hosting environment for security issues, surfaces plain-English findings in wp-admin, and gives you step-by-step fix instructions for every check. BOLT is designed for the gap between generic WordPress security plugins and full server access: it helps site owners, agencies, and hosting teams see what is actually misconfigured on the current host, which issues matter most, and which ones BOLT can safely fix from WordPress plugin context. **Free features:** * 31-point security scan across Server Environment, WordPress Core, Authentication, Site Exposure, Security Headers, Updates, and Writable Directories * Checks PHP version, MySQL version, OPcache, dangerous PHP functions, directory listing, PHP override effectiveness, loopback request health, WP-Cron health, WP_DEBUG, wp-config.php permissions, DISALLOW_FILE_EDIT, database prefix, XML- RPC, REST API exposure, application passwords, user registration, default admin username, administrator account sprawl, debug log exposure, readme.html exposure, public backup or dump artifacts, HTTPS, HSTS, core/plugin/theme updates, uploads permissions, and executable files in uploads * Server/PHP profile detection for Apache, Apache with PHP-FPM/FastCGI, LiteSpeed/ LSAPI, Nginx with PHP-FPM, IIS, and unknown/shared-host stacks * ”How to fix” accordion with manual instructions for every check * Recommendations summary of all failing and warning items * Host-aware action states so supported fixes show as actionable and unsupported ones stay manual * Dedicated Hardening tab with supported one-click hardening actions and manual priorities * One-click auto-fixes for WP_DEBUG, File Editor, Directory Listing, HSTS, executable files in uploads, XML-RPC, and REST API restriction when the current host supports them * One-click removal for public readme.html exposure and public backup, dump, environment, installer, and diagnostic artifacts * Persistent fix history with grouped sessions and full undo for all BOLT-applied changes, including restoring original wp-config.php and .htaccess content * REST public-route allowlist manager for intentional unauthenticated REST endpoints * Application Password Governance inventory with stale, unused, and administrator- owned API credential review * Attack Path Analysis: identifies realistic compromise chains based on your current configuration and shows the fastest way to break them * Near-Miss Detection: highlights conditions that are close to forming an attack path before they become exploitable * AI Security Briefing panel is visible in the Overview tab; generation and AI Settings require BOLT Pro * Weekly scheduled scan reports by email * Optional BOLT-branded PDF attachment on scheduled scan emails using dompdf when available, with a built-in plain PDF fallback * Reports tab status panel showing whether the BOLT WP-Cron event is registered, when it will run next, the last delivery/PDF status, and a manual test-send button * Email only when new issues appear * Alerts tab shows the Slack and generic webhook controls; delivery and test alerts require BOLT Pro * Activity tab with the last 7 days of security timeline entries for logins, user changes, software changes, scans, reports, alerts, and auto-fixes * Baseline drift detection with one active baseline, save/update/clear baseline actions, regressions since the approved scan, and finding-level before/after value diffs * Vulnerability Intelligence rows can show pass/fail status and CVE IDs when advisory findings are present; full advisory detail requires BOLT Pro * Accepted Risk Register with owner, reason, expiration date, reopen controls, and action-queue suppression for documented unresolved findings **Available through the separate BOLT Pro add-on/service** ([learn more at blueternalsolutions.com/bolt-pro](https://blueternalsolutions.com/bolt-pro)): BOLT Pro adds more coverage and less manual work through hosted checks, automation, and reporting controls. * Domain/IP reputation scan through the BOLT platform endpoint, with normalized results from Spamhaus DBL, SURBL, URIBL, Spamhaus ZEN, SpamCop, and SORBS * On-demand reputation re-checks from the Reputation tab * WordPress core file integrity monitoring against official checksums * Unexpected-file detection inside wp-admin and wp-includes * PHP malware-pattern scanning across plugins, themes, mu-plugins, and uploads, with Malware Triage Center support for hash-based expected-file decisions * Vulnerability intelligence for WordPress core, plugins, and themes through a configurable BOLT advisory feed * Full vulnerability advisory detail, including affected version range, CVSS score, and patch link when supplied by the advisory feed * AI Security Briefings and AI Settings * Daily and monthly scheduled scan cadences * Multiple report recipients and custom report branding * Slack and generic webhook alerts, including critical-only and baseline-regression- only filters * Full Activity timeline * Named baseline snapshots ### External Services BOLT only sends data to an external service when the corresponding feature is configured or explicitly used by an administrator. #### Blueternal Solutions When a site has BOLT Pro active and an administrator generates the AI Security Briefing without saving their own OpenAI API key, BOLT sends a compact, redacted JSON payload of selected fail/warn scan findings to the Blueternal Solutions BOLT API for hosted analysis. Free installs show the AI panel but cannot generate briefings. The payload can include finding labels, statuses, severities, messages, recommendations, remediation guide URLs, limited environment notes, baseline drift summaries, a payload hash, plugin version, site/home URL, and a random install identifier used for service quota. It does not send raw files, database contents, passwords, secret keys, or arbitrary page content. The hosted AI service uses Blueternal Solutions server-side credentials and may process the redacted payload through an AI provider to return the structured briefing. The separate BOLT Pro add-on/service may also contact Blueternal Solutions endpoints for license validation, reputation checks, vulnerability intelligence, and upgrade pages. Depending on the Pro feature used, requests may include the site URL, plugin version, license key, domain, IP address, and installed WordPress core/plugin/theme version metadata needed to return the requested service response. Service endpoint: `https://blueternalsolutions.com` Terms: https://blueternalsolutions. com/bolt-terms-of-service/ Privacy policy: https://blueternalsolutions.com/bolt- privacy-policy/ #### OpenAI If BOLT Pro is active and an administrator saves an OpenAI API key in BOLT settings or defines `BOLT_OPENAI_API_KEY`, the AI Security Briefing sends the compact, redacted JSON payload directly from the site to OpenAI instead of using the hosted BOLT service. The payload can include finding labels, statuses, severities, messages, recommendations, remediation guide URLs, limited environment notes, and baseline drift summaries. It does not send raw files, database contents, passwords, secret keys, or arbitrary page content. Service endpoint: `https://api.openai.com` Terms: https://openai.com/policies/terms- of-use/ Privacy policy: https://openai.com/policies/privacy-policy/ #### Google Safe Browsing If BOLT Pro is active and an administrator saves a Google Safe Browsing API key, the Browser Blocklist reputation check sends the site’s home URL and domain URL to the Google Safe Browsing Lookup API v4 when a reputation check runs. This is used only to determine whether the site is flagged for malware, phishing, unwanted software, or potentially harmful applications. The request also includes the saved API key, a BOLT client identifier, and the plugin version. BOLT does not send scan findings, files, database contents, passwords, license keys, or arbitrary page content to Google Safe Browsing. Service endpoint: `https://safebrowsing.googleapis.com/v4/threatMatches:find` Terms: https://developers.google.com/terms Privacy policy: https://policies.google.com/ privacy #### Slack If BOLT Pro is active and an administrator saves a Slack incoming webhook URL in BOLT Alerts, scheduled alerts or the manual test alert send alert text to the configured Slack webhook. The payload can include the site name, site URL, BOLT admin URL, scan score, score label, score delta, baseline score delta, issue count, issue labels, issue severities, issue statuses, issue messages, baseline drift summaries, capture time, and whether the alert is a test. It does not send raw files, database contents, passwords, secret keys, license keys, or arbitrary page content. Service endpoint: the Slack incoming webhook URL configured by the administrator, usually `https://hooks.slack.com/services/...` Webhook documentation: https://api. slack.com/incoming-webhooks Terms: https://slack.com/terms-of-service/api Privacy policy: https://slack.com/privacy-policy #### Generic Webhook If BOLT Pro is active and an administrator saves a generic webhook URL in BOLT Alerts, scheduled alerts or the manual test alert send a JSON alert payload to the exact URL configured by that administrator. The payload can include the site name, site URL, BOLT admin URL, scan score, score label, score delta, critical-only and baseline- only alert flags, baseline score delta, issue count, issue labels, issue severities, issue statuses, issue messages, recommendations, baseline drift summaries, capture time, and whether the alert is a test. It does not send raw files, database contents, passwords, secret keys, license keys, or arbitrary page content. Service endpoint: the generic webhook URL configured by the administrator. Terms and privacy policy: determined by the administrator-configured destination service. ## Asennus 1. Upload the plugin to the `/wp-content/plugins/` directory, or install through the WordPress Plugins screen. 2. Activate the plugin through the Plugins menu. 3. Go to **BOLT Security** in the WordPress admin menu. 4. Run a scan and review the findings. ## UKK ### Does this plugin require root or shell access? No. BOLT works entirely through PHP and the WordPress filesystem API — the same permissions your site already runs under. ### Can this plugin perform full sysadmin tasks from WordPress? No. BOLT can detect many server and WordPress security issues, automate some changes that are reachable from plugin context, and guide the rest. It cannot honestly replace root or sudo from inside WordPress. Some fixes are always one-click, some are host- dependent, some are manual only, and some would require a future companion agent or external integration. ### What does the scanner check? The free tier covers 31 checks across PHP and database versions, PHP resource limits, local PHP override effectiveness, OPcache, dangerous PHP functions, directory listing, loopback request health, WP-Cron health, uploads permissions and executable files, WP_DEBUG, wp-config.php permissions, DISALLOW_FILE_EDIT, database prefix, XML-RPC, REST API, application passwords, user registration, default admin username, administrator account sprawl, debug log exposure, readme file exposure, public backup or dump artifact exposure, HTTPS, HSTS, and core/plugin/theme update status. Pro adds server- side domain/IP reputation scanning, WordPress core file integrity monitoring, suspicious PHP malware-pattern detection, and vulnerability intelligence for WordPress core, plugins, and themes. Free displays vulnerability status and CVE IDs when advisory findings are present; Pro shows the full advisory detail. ### How do Attack Paths, Near Misses, and Amplifiers work? BOLT separates chained risk into three layers. Attack Paths are realistic compromise chains where multiple findings combine into a practical risk. Near Misses are partial chains where one important condition exists, but another required condition is missing. Amplifiers are findings that do not create an attack path by themselves, but increase the impact of a real path. For example, writable wp-config.php is not treated as remote compromise by itself. Alone, it appears as a near miss because it could support persistence if a write- capable foothold appears later. Combined with a real write-capable compromise path, it appears as a persistence amplifier. ### How does file integrity monitoring work? BOLT Pro can verify WordPress core files against official checksum data and detect unexpected files inside `wp-admin` and `wp-includes`. If the checksum service is temporarily unavailable, the integrity checks fall back to a warning instead of failing the whole scan. ### How does malware scanning work? BOLT Pro can scan PHP files in plugins, themes, mu-plugins, and uploads for suspicious combinations of malware-like patterns such as obfuscation, hidden iframe payloads, encoded blobs, and dangerous execution chains. The scan is heuristic and should be treated as an investigation starting point rather than definitive malware attribution. ### How does vulnerability intelligence work? BOLT Pro can query a configurable advisory feed and compare installed WordPress core, plugin, and theme versions against known affected version ranges. Successful responses are cached locally for 6 hours, and the last good cache is reused if the endpoint is temporarily unavailable. ### How do one-click fixes work? Auto-fixes write the correct configuration change directly where WordPress has a safe capability path, such as wp-config.php, .htaccess, or an mu-plugin. BOLT logs fix metadata in the database, but it does not store backup copies of config or code files. Undo is available only for files BOLT creates itself, such as its XML-RPC and REST API mu-plugin files. Changes to existing files should be reviewed before applying and rolled back through your host backup or version control if needed. BOLT distinguishes between fixes that are verified immediately, fixes that are pending the next request, and fixes that are manual only on the current host. BOLT does not auto-write `disable_functions`; PHP treats that as system-level configuration that must be changed in php.ini, PHP-FPM pool config, LiteSpeed/PHP selector, or a hosting control panel. Uploads execution blocking is one-click only when the current stack is Apache/LiteSpeed-style and can use an uploads `.htaccess` rule. REST API restriction uses an mu-plugin instead of a blanket web-server block so logged-in WordPress requests and detected routes selected in the allowlist manager can keep working. Developers can also extend the allowlist with `bolt_rest_api_allowed_public_routes`. Nginx/PHP-FPM and FastCGI-only stacks receive manual server-rule guidance where server rules are required. ### Does BOLT store rollback copies? BOLT does not store rollback copies of config files, code files, public artifacts, or executable uploads. It stores fix history metadata in the WordPress database and relies on your normal host backup, staging workflow, or version control for rollback of existing files. ### Does PDF reporting work out of the box? Yes, when PDF attachment is enabled. Free reports use BOLT branding and one recipient. BOLT uses `dompdf` if WordPress already loads it; otherwise it attaches a built- in plain PDF report. BOLT Pro adds multiple recipients and custom report branding. ### How does Pro licensing work? BOLT Pro is distributed separately from WordPress.org. The Pro add-on validates its license against the Blueternal Solutions platform and caches successful responses locally. ### What does the Activity tab record? BOLT records authentication events, password resets, user creation and role changes, plugin and theme activation/update activity, WordPress core updates, and BOLT-native events such as scans, reports, alerts, and auto-fixes. Free shows the last 7 days. BOLT Pro shows the full retained timeline. Failed-login entries show whether the attempted login maps to an existing account; matched accounts link to recent successful and failed login history with source IPs where available. ### How does baseline drift detection work? BOLT can save one known-good scan as the active baseline, compare each new scan against that approved state, and summarize new failures, new warnings, resolved issues, improvements, and detail-level finding changes since the baseline. The Baseline tab also lets you run a fresh scan or reset the active baseline after host/runtime changes so drift markers and safe-fix eligibility are recalculated immediately. BOLT Pro adds multiple named baseline snapshots. ### What is the Hardening tab for? The Hardening tab groups BOLT’s supported one-click protections into one place. It shows what this host can fix automatically right now, offers one safe hardening action, and includes a manual hardening checklist pulled from the latest scan. ### How does the AI analysis feature work? BOLT Pro can optionally send a compact redacted JSON payload of actionable fail/ warn findings for interpretation. Without a saved OpenAI API key, the request goes to the Blueternal Solutions BOLT API after hosted BOLT AI consent is enabled in AI Settings. With a saved key or `BOLT_OPENAI_API_KEY`, the request goes directly to OpenAI from the site. Free installs show the AI Security Briefing panel but cannot generate a briefing or configure AI Settings. BOLT does not send raw files, full database contents, or arbitrary page content. The Overview tab AI Security Briefing is explicit and manual; it does not generate anything automatically on page load. ### What are the Pro plan options? Current plan details are listed at [blueternalsolutions.com/bolt-pro](https://blueternalsolutions.com/bolt-pro). ## Arvostelut There are no reviews for this plugin. ## Avustajat & Kehittäjät “Blueternal BOLT Security Toolkit” perustuu avoimeen lähdekoodiin. Seuraavat henkilöt ovat osallistuneet tämän lisäosan kehittämiseen. Avustajat * [ jfgamsby ](https://profiles.wordpress.org/jfgamsby/) [Käännä “Blueternal BOLT Security Toolkit” omalle kielellesi.](https://translate.wordpress.org/projects/wp-plugins/blueternal-bolt-security-toolkit) ### Oletko kiinnostunut kehitystyöstä? [Browse the code](https://plugins.trac.wordpress.org/browser/blueternal-bolt-security-toolkit/), check out the [SVN repository](https://plugins.svn.wordpress.org/blueternal-bolt-security-toolkit/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/blueternal-bolt-security-toolkit/) by [RSS](https://plugins.trac.wordpress.org/log/blueternal-bolt-security-toolkit/?limit=100&mode=stop_on_copy&format=rss). ## Muutosloki #### 0.6.9 * Extended auto-fix undo to cover modifications to existing files: wp-config.php and .htaccess originals are now saved to the database before BOLT changes them and restored on undo. * Added cleanup of legacy bolt-backups and sasa-backups upload directories on plugin activation and uninstall. * Added sasa_auto_fix_history and bolt_rest_api_custom_public_routes to the uninstall option cleanup list. #### 0.6.8 * Removed filesystem copy storage from the WordPress.org build. * Changed public readme and public artifact fixes to delete exposed files instead of storing copies. * Changed fix history to database-only metadata with undo limited to files BOLT creates itself. #### 0.6.7 * Documented Google Safe Browsing in External Services. * Removed an unnecessary WordPress admin theme include from scan update checks. #### 0.6.6 * Added Attack Paths, a deterministic local rules engine that turns current scan findings into practical chained compromise scenarios. * Added an Overview panel showing the top three attack paths with evidence, required conditions, baseline-new status, shortest fix path, and break-chain actions. * Added a highlighted best break-chain action and near-miss detection for partially formed attack paths. * Added a Most effective fix right now section that highlights the single action that breaks the most visible attack paths. * Added wp-config.php persistence context so unsafe permissions appear as a near miss when alone or as a subtle amplifier on real write-capable attack paths. * Added Free vs Pro gates for report cadence, multiple report recipients, custom branding, alerts, AI briefings, full activity history, on-demand reputation checks, advisory detail, and named baseline snapshots. #### 0.6.5 * Added Malware Triage Center for structured suspicious PHP file review. * Added hash-based expected-file decisions so unchanged known-good malware-pattern hits stay out of Priority Actions while changed files are flagged again. #### 0.6.4 * Added Application Password Governance: BOLT now inventories actual WordPress application passwords, highlights stale, unused, and administrator-owned credentials, and links administrators to the relevant user profiles for review and revocation * Changed the Application Passwords scan from a generic feature-availability warning into a credential-aware local governance check * Added an Accepted Risk Register so administrators can document intentional unresolved findings with an owner, reason, and expiration date * Suppressed unexpired accepted risks from Top Actions, overview hardening action queues, new-issue report sections, alerts, and AI action payloads while keeping the underlying score unchanged #### 0.6.3 * Removed public landing-page hooks so BOLT no longer alters front-end pages based on page slugs * Removed review-blocking HEREDOC/NOWDOC syntax from generated hardening rules and BOLT-created mu-plugin code * Documented Slack incoming webhook and generic webhook alert deliveries in the External Services section * Removed the New/Changed/Improved/Resolved baseline-drift badges from the Overview tab category tables and from the Hardening tab; drift markers belong on the Baseline tab where they have proper saved-baseline context * Standardized drift badge width on the Baseline tab so all four pill labels render at the same size regardless of text length * Hardened the public install-proof endpoint: non-matching install identifiers now return HTTP 200 with `ok:false` instead of 403, so the endpoint is no longer an existence oracle for guessed install ids * Added a 60/hour per-IP rate limit to install-proof requests to throttle brute- force attempts * Tightened the loopback-probe nonce window from roughly two hours to roughly five to ten minutes (5-minute bucket with current and previous accepted), reducing replay surface while still tolerating bucket boundaries * Hardened the auto-fix undo and bulk-session-undo handlers so missing or invalid fix entries redirect with a generic notice instead of `wp_die`’ing on a reflected query parameter; the per-fix nonce action is preserved so an admin cannot be CSRF’d into undoing a different fix than they intended #### 0.6.2 * Added a conditional one-click HSTS Header fix for HTTPS Apache/LiteSpeed-style. htaccess stacks * Refreshed the stored scan snapshot after verified individual Fix Now actions so cleared findings disappear immediately * Added a one-click removal fix for WordPress Readme File findings * Made Domain Blacklist warning recommendations context-aware so Pro reputation warnings no longer say ”Upgrade to Pro” * Linked Overview Recommendations to the current Priority Actions so resolved findings no longer linger there * Forced manual scans to refresh WordPress update data before ranking plugin/theme update priority actions * Added a one-click removal fix for Public Backup / Dump Files findings * Scoped Core File Integrity to runtime WordPress application files so bundled theme/plugin updates and removed package docs do not trigger critical core failures * Routed Pro blacklist checks through the BOLT platform reputation endpoint, with direct DNSBL only as a labeled fallback * Required license verification to match an active site seat, reacquired saved seats on plugin reactivation, and serialized platform seat assignment * Detected and backed up wp-config.php when WordPress stores it one directory above ABSPATH * Cleaned uninstall data more completely, including report status, tracked AI cache transients, REST allowlist options, and BOLT-created REST/XML-RPC mu-plugin files * Removed unused legacy scanner/admin prototype files from the distribution tree * Fixed DNSBL parsing so blocked/refused blacklist lookup responses are reported as inconclusive instead of listed * Added an Overview Fix Plan that separates one-click fixes from server-limited and manual priorities * Reworked the Hardening server profile card for clearer server/PHP handler context * Added explicit diagnostics when PHP reports apache2handler while host settings claim PHP-FPM * Bumped admin assets so the refreshed profile UI is not hidden by browser cache * Simplified the AI Security Briefing by keeping detailed fix guidance in the scan table * Increased AI structured-output headroom, added a retry for incomplete OpenAI responses, and invalidated older cached briefings * Added BOLT hosted AI briefing support, optional direct OpenAI override, guide links, and a smaller fail/warn payload * Added a REST API Fix Now action that writes a BOLT mu-plugin to restrict unauthenticated REST requests * Preserved BOLT license, reputation, hosted AI, webhook, and vulnerability-feed REST routes when REST hardening is enabled * Added persistent fix history for auto-fixes * Added grouped fix sessions and a REST public-route allowlist manager to the Hardening tab * Added finding-level baseline drift value diffs to the Baseline tab, reports, alerts, and AI payload evidence * Added detected REST route selection to the REST public-route allowlist manager * Hardened Loopback Requests and WP-Cron Health with a signed BOLT loopback probe, overdue-event diagnostics, cron-lock detection, and Reports tab health visibility #### 0.6.1 * Added central server/PHP profile detection for capability decisions * Removed misleading one-click fix for disable_functions * Restricted uploads execution auto-fix to Apache/LiteSpeed-style .htaccess stacks * Removed adjacent auto-fix `.bak` files * Updated PHP/database scan recommendations to a safer current production baseline #### 0.6.0 * Added MVP AI Security Briefing for the Scan tab with explicit manual generation * Added structured AI security summary and prioritized action plan using the OpenAI Responses API * Added AI settings page for API key, model, cache hours, and maximum findings * Bumped plugin version to 0.6.0 #### 0.5.2 * Added a dedicated Hardening tab in wp-admin * Added a one-click hardening action using the existing auto-fix engine * Added grouped one-click hardening controls and manual hardening priorities * Bumped plugin version to 0.5.2 #### 0.5.1 * Added active baseline drift detection against a saved scan baseline * Added baseline save, update, and clear actions on the scan tab * Added regressions, improvements, and resolved issue summaries since baseline * Added optional alert mode for baseline regressions only * Added a manual test alert action for configured alert destinations * Bumped plugin version to 0.5.1 #### 0.5.0 * Added a dedicated Activity tab with filterable security timeline entries * Added audit logging for authentication events, software changes, and BOLT actions * Added activity cleanup during uninstall * Bumped plugin version to 0.5.0 #### 0.4.1 * Added Pro malware-pattern scanning for suspicious PHP files * Added malware guidance in the admin UI and docs * Bumped plugin version to 0.4.1 #### 0.4.0 * Added Pro WordPress core file integrity monitoring using official checksum verification * Added detection for unexpected files inside wp-admin and wp-includes * Added file integrity guidance in the admin UI and docs * Bumped plugin version to 0.4.0 #### 0.3.1 * Added a dedicated Alerts tab for outbound Slack and generic webhook destinations * Added Pro alert delivery for newly detected scheduled-scan issues * Added critical-only filtering for outbound alerts * Bumped plugin version to 0.3.1 #### 0.3.0 * Added Pro vulnerability intelligence for WordPress core, plugins, and themes * Added configurable cached vulnerability feed support with advisory version matching * Added vulnerability documentation for feed configuration and payload shape * Bumped plugin version to 0.3.0 #### 0.2.4 * Added new hardening checks for database prefix, user registration, default admin username, debug log exposure, readme.html exposure, and application passwords * Expanded scan categories with Authentication and Site Exposure sections * Synced plugin version metadata with the current codebase #### 0.2.0 * Refactored plugin bootstrap and lifecycle hooks * Rebuilt admin UI around consistent scan/report data model * Wired scheduled scans and email reports end-to-end * Replaced prototype license handling with remote HTTPS license validation * Added seat-based license enforcement via the Blueternal platform * Added Stripe-integrated license issuance (checkout.session.completed webhook) * Added Pro plans: Single ($49), Agency ($99), Developer ($199) — annual * Added one-click auto-fixes for WP_DEBUG, File Editor, Directory Listing, Executable Files in Uploads, and XML-RPC; dangerous PHP functions remain host-level guidance * Fixed deprecated current_time(’timestamp’) in cron scheduler * Removed class collision risk from stale admin class file * Added /bolt and /bolt-pro landing pages ## Metatiedot * Version **0.6.9** * Last updated **5 kuukautta sitten** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **6.9.10** * PHP version ** 8.0 or higher ** * Language * [English (US)](https://wordpress.org/plugins/blueternal-bolt-security-toolkit/) * Tags * [hardening](https://fi.wordpress.org/plugins/tags/hardening/)[monitoring](https://fi.wordpress.org/plugins/tags/monitoring/) [reports](https://fi.wordpress.org/plugins/tags/reports/)[scanner](https://fi.wordpress.org/plugins/tags/scanner/) [security](https://fi.wordpress.org/plugins/tags/security/) * [Edistynyt näkymä](https://fi.wordpress.org/plugins/blueternal-bolt-security-toolkit/advanced/) ## Arvosanat No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/blueternal-bolt-security-toolkit/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/blueternal-bolt-security-toolkit/reviews/) ## Avustajat * [ jfgamsby ](https://profiles.wordpress.org/jfgamsby/) ## Tuki Onko sinulla jotain sanottavaa? Tarvitsetko apua? [Tukifoorumi](https://wordpress.org/support/plugin/blueternal-bolt-security-toolkit/)