NyaxAgent by Cerynth · WordPress incident response
Every other plugin tells youthe site was hacked.This one gets you out of it.
A WordPress compromise is not a scan result — it is an hour of forensics across files, database, admin accounts, sessions, cron and traffic. NyaxAgent turns that into one explained, reversible, verified transaction: detect, explain, contain, clean, verify, keep watching.
- Runs fully offline — no account required
- Files never leave your server
- GPL-2.0-or-later
Verdict
Probable compromise
Based on 14,203 files, 62 options, 9 accounts and 31,884 requests. Server-level files not checked — no host agent connected.
- F1 Unauthenticated file handler in
/uploads/2026/04/ - F2 Administrator
adminncreated without a registration event - F3 Scheduled task calling a file no plugin owns
Containment plan
- YELLOWQuarantine file (encrypted)reversible
- YELLOWSuspend account, destroy sessionsreversible
- REDDeactivate plugin — 3 pages use itneeds approval
Illustration of the output format · every line carries its evidence
01The gap
The scanner found it. Now what?
Detection is the part the market has solved. What follows is the part nobody productised — and it is where the hours and the money go.
- 01
You get a list of infected files
No indication of how they got there, what else was touched, or what happens if you delete them.
- 02
You delete them. The site comes back anyway
Because the rogue administrator, the scheduled task and the autoloaded option are still there.
- 03
You cannot tell anyone what happened
No timeline, no evidence, nothing you could hand a client or an insurer.
- 04
You never learn whether it is actually over
A clean scan is not proof. The only real answer comes from watching for re-entry.
02How it works
Six stages. One transaction.
Not six features that happen to ship together — one sequence, where every stage is only allowed to proceed because the one before it produced evidence.
- 01
Detect
Across six surfaces at once
Files, database, accounts, sessions, scheduled tasks and request traffic — correlated into a single incident instead of six unrelated alerts. Core and plugins are checked against their official checksums, not against a guess.
- 02
Explain
In plain language, with the evidence attached
A deterministic timeline built from evidence timestamps: when the file appeared, when the administrator was created, when the first request hit it. Every statement carries the evidence id behind it.
- 03
Contain
A plan you approve step by step
Each step shows its risk, what it changes, what it might break, and whether it can be undone. Destructive steps are unchecked by default and need re-authentication.
- 04
Clean
As a transaction, not a delete key
Snapshot, execute, verify — per step. Files are quarantined encrypted, never deleted. If a step fails or the site breaks, it rolls back automatically. A crash mid-way is detected and unwound.
- 05
Verify
Against the real site, not a status code
Loopback checks assert actual content, detect off-host redirects and read the fatal-error log. An incident only moves to “verified” when the outcome is proven.
- 06
Watch
Because they come back
Re-entry watch tightens the cadence after an incident and steps down over days. If the same actor returns, the original incident reopens instead of a new alert appearing from nowhere.
03Coverage
A compromise is never only files.
Cleaning files while the rogue administrator, the scheduled task and the autoloaded option remain is why sites come back infected.
Files
Official checksums for core and repository plugins; content sniffing that ignores the extension; tokenizer features rather than regex alone.
- Web shell families
- PHP in uploads
- Unexpected package files
- Timestomping
- Stray wp-config copies
Database
Read raw and filtered, so a hijacked option filter cannot hide what it returns.
- Autoloaded payloads
- siteurl hijack
- Role manipulation
- Malicious posts
- Hidden plugins
Identity
An administrator that appeared without the hook that should have fired is a different fact than one that was created normally.
- Rogue administrators
- Display-name mimicry
- Application passwords
- Session anomalies
Persistence
The parts that bring the site back after you think you cleaned it.
- Cron with unowned hooks
- Drop-ins and mu-plugins
- auto_prepend_file
- .htaccess handlers
Traffic
Bounded and sampled, never bodies or cookies, with proxy handling that cannot be spoofed.
- REST abuse and enumeration
- Login bursts
- First hit on a planted file
Server
What WordPress cannot see. Optional, read-only, outbound-only — and when it is absent the page says so instead of implying coverage.
- Processes in temp
- Listening sockets
- crontab entries
- Direct PHP requests
04What stands out
The only WordPress security tool that tells you what it could not check.
Every other claim on this page is table stakes somewhere. This one is not: no competitor states its blind spots, because stating them looks like weakness until the day it matters.
- 01
Response as a transaction
Snapshot, execute, verify, and roll back on failure — for every step, including a crash halfway through. Competing “one-click clean” features are a delete with no record and no way back.
- 02
Coverage honesty
Every negative result names what was checked and what was not: “no web-shell signatures in 14,203 files — server-level files not checked.” No other WordPress security tool tells you where it is blind.
- 03
A tamper-evident journal
Hash-chained changes, anchored off-site. “What changed before the compromise?” is the first question a responder asks, and it is the one no mass-market product can answer.
- 04
Your files stay on your server
Analysis runs on features and hashes. Code excerpts are shared only if you switch it on. Cloud malware scanners upload your site to theirs.
- 05
Everything reversible
Quarantine is encrypted and restorable, options are snapshotted before they change, roles and users are captured before suspension. Nothing is deleted to make a number go down.
- 06
An incident report you can hand over
A self-contained file — assessment, coverage, blind spots, timeline, evidence hashes, every action with its risk and outcome, the journal chain head. No scripts, nothing that can execute.
05Honestly compared
Where the others are better, and where they stop.
Each of these is a good product. None of them does the part that starts after the alert.
Wordfence
Better atSignature breadth, firewall maturity, an excellent free tier.
Stops atCleanup is manual or a paid human service. No transactional remediation, no incident timeline across database and identity, no coverage statement.
Patchstack
Better atVirtual patching depth and disclosure speed — the best in the market.
Stops atNo malware scanning by design and no incident response. Their customers still need a responder once a site is already compromised.
MalCare
Better atGenuinely one-click cleanup, bundled backups and staging.
Stops atThe cleanup is a black box: your files are uploaded to their cloud, and you get no evidence, no timeline and no account of what was changed.
Sucuri
Better atA network WAF, which is stronger than anything a plugin can do.
Stops atCleanup is a support ticket measured in hours or days, and you receive little forensic detail.
Cloudflare
Better atEverything at the network edge that a plugin will never see.
Stops atZero visibility inside the site: it cannot see a rogue administrator, a cron entry or a modified option. Run it alongside — we integrate rather than pretend.
06Limits
What it does not do
A plugin runs at the same privilege as whatever compromised the site. Anyone who tells you otherwise is selling you something. These limits are stated in the product itself, not only here.
- It is not a network firewall. Requests that never reach PHP are invisible to it — run Cloudflare or a host WAF alongside.
- It cannot change PHP settings from inside WordPress. When the runtime configuration is dangerous, it says so and marks the finding as not reversible by the agent.
- On Nginx it cannot enforce upload rules itself. It gives you the exact configuration block and marks the control as not enforced.
- It never claims a site is clean. The strongest verdict is "no signs of compromise", always with the coverage that produced it.
- Against an attacker with root on the server, no WordPress plugin is authoritative. The optional host agent widens coverage; it does not change that fact.
07Pricing
Priced so the free tier is genuinely useful.
The whole deterministic engine runs locally at no cost and without an account. Paid plans add the cloud half: correlation, off-site evidence, notifications and fleet control.
NyaxAgent is in private testing at version 0.3.0. Prices below are the launch prices and are shown so you can plan — nothing is being charged yet. Early access participants get the first year at the price they sign up at.
Free
€0forever
Unlimited sites, local only
The full deterministic engine, running entirely on your server.
- All local detection layers
- Core and plugin integrity checks
- Change journal (7 days, local)
- Manual containment with approval
- Encrypted quarantine and restore
- Weekly vulnerability alerts
- Off-site evidence
- Incident correlation
- Virtual patches
- Notifications
- Recommended
Solo
€12per site / month · €99 per year
1–3 sites · €6 per additional site
For the owner who wants the response capability there before it is needed.
- Everything in Free
- Guided remediation transactions
- Off-site evidence mirror (90 days)
- Incident correlation and timeline
- External liveness probe
- Signed rule bundles and virtual patches
- Email and Slack notifications
- AI analyst — 100 credits per month
- Fleet dashboard
- Autopilot mode
- Host agent
Agency
€59per month · then €4 per site
From 10 sites · volume steps at 50 / 100 / 250
When the same incident repeats across a portfolio and has to be reported.
- Everything in Solo
- Fleet dashboard and bulk actions
- Fleet-wide policy
- Autopilot and lockdown modes
- Retention for one year
- Pooled AI credits (250 + 20 per site)
- Client-branded incident reports
- API access
- Host agent
- SSO
- SLA
Business
from €249per month · negotiated
Negotiated
Server-level coverage, contractual terms and named support.
- Everything in Agency
- Host agent (server visibility)
- Hosting and Cloudflare integrations
- SSO and role-based access
- Retention for two years
- Evidence escrow
- Dedicated rule requests
- 99.9 % control-plane SLA and DPA
08Questions
What people ask before installing it.
Does my site have to be compromised already?
No, and it is better if it is not. Installed beforehand, the change journal already holds the history that makes an incident explainable later. Installed during an incident it still works — that is the moment most people arrive.
Do my files get uploaded anywhere?
No. In local mode nothing leaves the site at all. Connected, the site sends findings, file hashes, component versions and a hashed summary of its journal. Code excerpts are shared only if you turn that on explicitly in the privacy settings.
What happens if it breaks my site?
Every step is snapshotted before it runs and verified after. If verification fails or the site stops responding correctly, the transaction rolls back on its own. If PHP crashes mid-way, the interrupted step is detected on the next run and unwound. Quarantined files are encrypted and restorable, never deleted.
Will it delete something I actually need?
Custom code, child themes, drop-ins, must-use plugins and wp-config are never acted on automatically, regardless of score. Plugins known to be business-critical escalate instead of being deactivated. Nothing destructive runs without re-authentication.
Do I still need Wordfence, Cloudflare or a host WAF?
A network WAF sees requests that never reach PHP, and NyaxAgent never will. We recommend running one, and integrate with Cloudflare rather than claiming to replace it. What a WAF cannot see is everything inside the site: accounts, cron, options, sessions. That is the half we cover.
Where does AI fit in?
Narrowly, and never in control. Findings are produced deterministically; a model may adjust confidence within a bounded band in the genuinely ambiguous range and write the explanation. It cannot invent evidence, propose actions or execute anything, and its output is validated twice before you see it. The product works with AI switched off.
What happens when a subscription ends?
Local scanning, integrity checks, the journal, quarantine and manual actions keep working. Cloud features stop gracefully. It is an entitlement model, not a licence key that bricks the plugin.
Which WordPress and PHP versions are supported?
WordPress 6.6 and newer, PHP 8.1 and newer. The plugin has no runtime Composer dependencies and is licensed GPL-2.0-or-later.
Most people find this pageon the worst possible day.
If that is today, write to us and say what you are seeing — we will tell you whether NyaxAgent helps and what to do in the meantime. If it is not today, that is the better time to install it.