Deep WordPress support in FrontierStack: updates, integrity, and a check for break-ins

Published 2026-11-03

Most WordPress sites that get broken into weren't beaten by anything clever. A plugin had a published hole, the fix sat unapplied for weeks, and afterwards a backdoor stayed in place because nobody was looking. FrontierStack runs WordPress the way it runs the rest of your infrastructure: one pane for every site on every server, the updates that matter, and alerts when something is wrong. Version 2.15 adds the part that was missing, a check for whether a site has already been compromised.

One pane, every site, nothing to install on the site

Open the WordPress pane, pick a host (this Mac or any server FrontierStack manages over SSH) and choose Scan for sites. It finds every wp-config.php under the usual web roots and lists each site with its WordPress, PHP and database versions. Everything runs through WP-CLI, WordPress's official command line. If a server doesn't have it, the pane installs a pinned release after checking its signature.

There's no FrontierStack plugin inside your site, on purpose. A plugin can be switched off, edited or lied to by whoever has broken in. A check run from outside, over SSH, can't be.

Staying current without breaking the site

Each site shows its pending core, plugin and theme updates. Update all exports the database first, because a bad plugin update can take a site down and the export is your way back. You can also update one plugin at a time. Multisite networks list their subsites. Check integrity compares WordPress's core files against the checksums WordPress.org publishes, which is the quickest way to spot a defaced install.

New in 2.15: every installed version against every known hole

Add a free Wordfence Intelligence API key and FrontierStack downloads the whole WordPress vulnerability database once a day, then checks every site's WordPress core, plugins and themes against it on your Mac. That includes inactive plugins, whose files are still reachable. There's no per-site quota, and anything with no published fix is flagged, because updating can't solve those. The key is free for commercial use and is made under Integrations in a wordfence.com account. A WPScan token still works too, but its free tier allows 25 requests a day.

New in 2.15: has this site already been broken into?

Security check looks for the traces a break-in leaves. It changes nothing on the site:

• Every plugin checked against WordPress.org. An edited or added file in a plugin folder is where most backdoors hide.
• New administrators and must-use plugins. The first check records who the admins are and which must-use plugins exist. Later checks flag anything new. Must-use plugins load on every page and can't be switched off from wp-admin, which is why attackers like them.
• A changed site address. That's how a hijacked site sends its visitors somewhere else.
• PHP files in the uploads folder, which should only hold images and documents.
• Things anyone can download: a wp-config.php backup or SQL dump left in the web root, or a public debug.log.
• Plugins WordPress.org has closed for a security issue. No update will ever come for those.
• Open registration that hands out the administrator or editor role.

It also notes hardening gaps as warnings: the built-in file editor left on, PHP errors shown to visitors, and XML-RPC answering password guesses. The check runs WP-CLI with plugins and themes switched off, so a compromised plugin can't answer for itself. Once you've confirmed a new administrator is yours, Accept as normal updates the baseline.

Already using Wordfence? Its findings now appear here

If Wordfence is installed on a site, FrontierStack reads its scan results from the site's database: open issues by severity, whether the last scan finished, failed logins in the past 24 hours, and how many addresses it's blocking. Wordfence keeps protecting the site. FrontierStack makes sure you hear about it, next to everything else, instead of in an email that went to a mailbox nobody reads. Critical and high issues raise an alert.

Alerts that reach you

Choose Watch in Alerts for a site and FrontierStack tells you about pending updates, a failed integrity check, a known vulnerability or anything the security check finds. It tells you on the channels you already use for the rest of your servers. The security check runs at most hourly for watched sites.

The jobs that used to mean SSH

• Install a new site on any host: WordPress download, wp-config.php, database and admin account in one step.
• Users and password resets for a locked-out admin. The new password never appears on a command line or in a log.
• Search-replace for moving a site between domains, with a required dry run. WP-CLI rewrites serialized PHP correctly, where a raw SQL replace corrupts it.
• Clone to staging with its own database, rewritten URLs, and search engines discouraged. Production is never written to.
• Database export and optimise, and a curated set of plugins you can install in one click: booking, commerce, mail delivery, backups, caching and security.
• Moved off GoDaddy? The pane spots the GoDaddy-only files that cause white screens elsewhere and takes them out, keeping a copy.

What it doesn't do

The security check finds and reports; it doesn't clean a compromised site. That still means restoring from a known-good backup and changing every password. FrontierStack needs SSH and WP-CLI, so managed hosts that offer neither aren't covered. Premium plugins can't be checked against WordPress.org, and the pane lists them so you know. Reading Wordfence's tables depends on Wordfence's own format, so if a future Wordfence release changes it, that part shows nothing rather than a false all-clear.

Getting started

Update to FrontierStack 2.15, open WordPress, choose Scan for sites, and run Security check on each site. Then add a Wordfence Intelligence key for the vulnerability feed, and choose Watch in Alerts on the sites you care about. More about running WordPress on FrontierStack is on the WordPress page.

Vulnerability data from Wordfence Intelligence, © Defiant Inc. Includes CVE® data © The MITRE Corporation.