메뉴
WordPress user and role security audit via SSH + MySQL. Detects rogue admins, suspicious usernames, disposable emails, and active sessions. Can delete users, demote roles, and kill all sessions.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | wp-user-audit |
| description | WordPress user and role security audit via SSH + MySQL. Detects rogue admins, suspicious usernames, disposable emails, and active sessions. Can delete users, demote roles, and kill all sessions. |
| triggers | ["user audit","check admin accounts","rogue admin","delete user","change user role","kill sessions","who is logged in","suspicious accounts"] |
Audits all WordPress user accounts for security issues and can perform corrective actions (delete, demote, session kill) in the same tool.
# Full user audit
python scripts/management/wp-user-audit.py --config config/config.yaml
# Flag users created after breach date
python scripts/management/wp-user-audit.py --config config/config.yaml --since 2026-01-01
# JSON output
python scripts/management/wp-user-audit.py --config config/config.yaml --json
| Check | What triggers an alert |
|---|---|
| Admin count | More than 2 admins |
| Username patterns | Known attacker toolkit names (archive_feed, wp_system_admin, etc.) |
| Email domains | Disposable/throwaway email services |
| New users | Accounts created after --since date with admin role |
| Active sessions | Who is currently logged in and from which IP |
# Delete a rogue user (always dry-run first)
python scripts/management/wp-user-audit.py --config config/config.yaml \
--delete-user rogue_admin --dry-run
python scripts/management/wp-user-audit.py --config config/config.yaml \
--delete-user rogue_admin
# Demote admin to subscriber
python scripts/management/wp-user-audit.py --config config/config.yaml \
--demote-user suspicious_account --role subscriber
# Kill all active sessions (forces re-login everywhere)
python scripts/management/wp-user-audit.py --config config/config.yaml \
--kill-sessions all
# Kill sessions for specific user
python scripts/management/wp-user-audit.py --config config/config.yaml \
--kill-sessions attacker_login
wp-forensics → wp-db-audit → wp-user-audit → wp-shell-nuke → ...
↑ audit users, kill sessions, delete rogue accounts
--kill-sessions all immediately to eject attacker--since BREACH_DATE)The script flags usernames matching these patterns as HIGH severity:
archive_feed — classic WPOC backdoor accountwp_system_admin — commonly planted by automated exploitsadmlnlx, admini variants — character-substitution obfuscationwordpress_admin[digits] — mass-exploitation botsadmin[4+ digits] — automated account creationDeploy a theme, plugin, or wp-content subset to a WordPress server from a CI/CD pipeline, with automatic pre-deploy backup, post-deploy health check, and automatic rollback on failure. Designed for GitHub Actions, GitLab CI, or any pipeline that can run Python.
Security and integrity audit for WooCommerce stores. Checks REST API key scope, payment gateway exposure, webhook HTTPS enforcement, suspicious $0 orders, exposed wc-logs (PII/payment data), and coupon abuse.
Scaffold and deploy a WordPress child theme via SSH. Generates style.css, functions.php (with correct parent style enqueueing), and index.php. Supports Kadence, Astra, GeneratePress, Hello Elementor, OceanWP, and any custom parent. Can activate the child theme immediately after creation.
Safely switch WordPress themes via SSH with automatic rollback if the site goes down. Records the previous theme for instant rollback. Verifies HTTP 200 before and after the switch.
Security audit of WordPress themes via SSH. Scans for PHP malware patterns, injected scripts, recently modified files, and unexpected file types. Also checks DB for customizer injections and Elementor postmeta payloads. Use after any attack or before going live with a new/inherited theme.
Comprehensive guide to building, maintaining, and recovering Elementor-based WordPress sites. Covers the CSS pipeline, global styles (Kit), common post-attack failures and fixes, Pro vs Free features, and integration with Kadence and Hello Elementor themes.