v0.2.0 - lessons from server-side work

• GitHub updater repair: Handles the source-directory normalization for both individual and bulk WordPress plugin updates, with validation of the plugin's main file.
• Malware detection: Recognizes the rawheaderdecodes redirect-loader indicator discovered during our server investigations.
• Cookie-based redirect detection: Identifies space_active when accompanied by relevant redirect or decoding behavior.
• Full-site scanning: Ensures these specific indicators aren't discarded by the existing filter for ordinary theme and plugin PHP files.
• Severity improvements: Classifies the observed redirect loader as critical and the suspicious cookie/redirect combination as high.
• Release documentation: Includes a changelog and deployment/testing notes.

v0.1.9 — Harden scan completion handling, improve JPEG PHP detection, and retain native auto-update support

Asenka Guard v0.1.9

This release improves JPEG malware triage, scan reliability, and compatibility with WordPress's native Automatic Updates column.

Improved JPEG analysis

• Inspect JPEG APP/COM metadata, compressed image data and post-image trailing bytes separately.
• Ignore isolated <? and <?= sequences inside compressed image data when no executable payload evidence is present.
• Flag recognizable PHP inside JPEG metadata for review.
• Flag PHP appended after a JPEG's end marker as high-priority review.
• Continue detecting disguised images and compressed payload/file-header mismatches.
• Avoid marking partially read large JPEGs as structurally invalid just because the scanner has not read the end marker.

Scan reliability

• Preserve previous findings if a scan reaches its file-count limit, an upload/site root cannot be read, or a file read fails.
• Clearly label recorded incomplete scans in the admin UI and mark them as incomplete in scan history.
• WP-CLI scan commands return an error for incomplete scans rather than reporting success.
• Scheduled monitoring records partial scans without treating partial discoveries as new findings; configured alerts warn about incomplete scans.

WordPress auto-updates

• Include the v0.1.8 hotfix that allows WordPress to display its native automatic-updates toggle even if GitHub metadata is temporarily unavailable.
• Preserve genuine newer GitHub update records without fabricating update availability.

Compatibility and cautions

• WordPress 6.0+, PHP 7.4+.
• Keeps the historical asenka-yootheme-image-guard plugin directory, stored findings, quarantine records and existing WP-CLI command.
• No automatic quarantine or deletion of JPEG files.
• A structurally valid JPEG is not necessarily safe; detection remains heuristic.
• Scanning is still synchronous and can be interrupted by server timeouts; the plugin cannot reliably record a completion status when PHP is killed abruptly.
• GitHub update installation, legacy quarantine restoration, and full WordPress/GridPane behavior still require live staging tests.

Installation

Upload the ZIP through Plugins → Add New Plugin → Upload Plugin and select Replace current with uploaded when prompted. Run a fresh Uploads scan to reclassify previous JPEG findings. Before enabling auto-updates broadly, test installation of a subsequent GitHub Release on staging.

Developed by Asenka Interactive — https://asenka.com
Repository: https://github.com/Asenka-Dev-Team/Asenka-Guard

v0.1.8 — Improve trusted-file verification, CSV metadata, evidence downloads and native auto-updates

Asenka Guard v0.1.8

This release improves malware investigation accuracy, file evidence management, CSV reporting, and native WordPress update support.

Improved Malware Scanning

• Added official checksum verification for supported WordPress core and WordPress.org plugin files.
• Reduced false-positive findings from legitimate WordPress functionality.
• Excluded empty and recognized harmless index.php placeholders.
• Preserved investigation of modified, unknown, and unverified files.
• Commercial plugins and BlogVault connectors are not automatically trusted.

Secure File Downloads

• Added a Download action to Scan Uploads, Scan Site, and Quarantine.
• Downloads suspicious files without executing their contents.
• Added administrator permission checks, security nonces, and SHA-256 integrity verification.
• Downloads use .bin filenames and an 8 MiB file-size limit.
• Quarantined files can be downloaded without restoring them.

Improved CSV & Evidence Exports

• Added report-style CSV exports identifying the source website.
• Included WordPress, active theme, YOOtheme, and Asenka Guard version information.
• Retained findings-only CSV exports for Google Sheets and automated processing.
• Improved evidence ZIP filenames with website, scan scope, and timestamp.
• Expanded evidence manifests with site metadata and file hashes.

WordPress Integration

• Improved compatibility with WordPress's native Automatic Updates column.
• Removed the redundant custom auto-update action.
• Preserved GitHub Releases integration.

Compatibility & Security

• WordPress 6.0+
• PHP 7.4+
• Existing Asenka Guard installations
• Existing scan history, quarantine records, and settings are retained.

Important: Malware findings remain heuristic and require review. Downloaded evidence may contain malicious code and should never be executed. Official checksum verification depends on supported releases and connectivity to WordPress.org.

Installation

1. Download the plugin ZIP from this release.
2. Navigate to Plugins → Add New → Upload Plugin.
3. Upload the ZIP and replace the existing version if prompted.
4. Open Asenka Guard and run new Uploads and Site scans.

---

Developed by [Asenka Interactive](https://asenka.com).

[GitHub Repository](https://github.com/Asenka-Dev-Team/Asenka-Guard)

v0.1.7 — Add YOOtheme integrity monitoring, scheduled scans, security dashboard, and Shift+click selection

Asenka Guard v0.1.7

This release introduces YOOtheme file integrity monitoring, scheduled security scans, and an expanded security dashboard, alongside workflow and WordPress integration improvements.

What's New

Security Dashboard

• Added a dedicated Dashboard tab with an overview of active findings, high-priority threats, quarantined files, and detected YOOtheme components.
• Added recent Uploads and Site scan information.
• Added scheduled monitoring status and upcoming scan details.

YOOtheme File Integrity Monitoring

• Added SHA-256 file integrity baselines for selected YOOtheme PHP, JavaScript, and template files.
• Detects added, modified, and removed files compared to a previously captured baseline.
• Added a dedicated YOOtheme Integrity tab for reviewing changes.

Important: Integrity baselines are generated locally and should only be captured after verifying the installation is clean. They are not official YOOtheme release checksums.

Scheduled Scanning & Alerts

• Added optional daily and weekly security scans using WP-Cron.
• Added configurable scanning scope: Uploads or Site.
• Added notification email settings for new or changed suspicious findings.
• Added monitoring status, last execution results, and next scheduled run information.
• Scheduled monitoring is disabled by default.

Scan Results Improvements

• Added Shift+click checkbox selection for selecting or deselecting multiple consecutive findings.
• Maintained selected-row highlighting and bulk-action controls.
• Preserved existing filename filtering, scan comparisons, and evidence exports.

WordPress Integration

• Added native Enable/Disable Auto-updates controls to the Plugins page.
• Removed the redundant Asenka action link.
• Updated the standard "By Asenka Interactive" author link to point to the Asenka website.
• Preserved GitHub Releases update integration.

Existing Features

Asenka Guard continues to provide:

• Manual uploads and site-wide malware scanning.
• Suspicious PHP and disguised image payload detection.
• YOOtheme Pro version checks.
• Read-only file previews and detection details.
• File quarantine, restoration, and permanent deletion.
• Hash-aware ignored-file management.
• CSV and evidence ZIP exports.
• Scan history and change tracking.
• WP-CLI integration.

Important Operational Notes

• Scheduled scans currently use synchronous PHP execution and may be limited by server execution timeouts.
• WP-Cron depends on site activity or an external cron trigger.
• Automatic updates remain optional.
• Malware detection is heuristic and findings should be reviewed before remediation.
• YOOtheme integrity comparisons detect local changes but do not establish whether a baseline is malware-free.
• Backups are recommended before quarantine, restoration, or deletion.

Installation & Updating

1. Download the ZIP from this release.
2. In WordPress, navigate to Plugins → Add New → Upload Plugin.
3. Upload the ZIP and replace the existing version if prompted.
4. Open Asenka Guard and review the new Dashboard, YOOtheme Integrity, and Monitoring tabs.
5. Configure scheduled monitoring only after verifying successful scans on your hosting environment.

Existing plugin settings, quarantine records, and scan data are intended to remain intact.

Compatibility

• WordPress 6.0+
• PHP 7.4+
• Existing Asenka Guard installations

---

Developed by [Asenka Interactive](https://asenka.com).

[GitHub Repository](https://github.com/Asenka-Dev-Team/Asenka-Guard)

v0.1.6.1 — Improve scan UI, reduce image false positives, and add scan change modals

Asenka Guard v0.1.6.1

This maintenance release improves the scan results interface, reduces false-positive detections in legitimate image files, and makes scan changes easier to investigate.

Improvements

Scan Results UI

• Optimized table column widths to provide more room for file paths and action buttons.
• Reduced unnecessary spacing in Type, Severity, Confidence, Signals, and Status columns.
• Improved usability on smaller screens.

Scanning Experience

• Prevented background page scrolling while the scanning overlay is active.
• Preserved the existing scanning animation and loading indicators.

Image Detection & False Positives

• Improved JPEG/PNG detection to avoid treating incidental PHP-like byte sequences inside normal image data as executable PHP.
• Reduced false positives caused by short PHP opening tags such as <?= occurring in compressed JPEG data.
• Retained detection of suspicious appended PHP payloads, file-type mismatches, and compressed content disguised as images.
• Preserved review-first handling for potentially malicious image files.

Scan Changes & Investigation

• Added clickable New and Changed counts in the scan summary.
• Added modal windows listing newly detected and changed files from the latest scan.
• Included file paths, severity, confidence, and read-only file-viewing links.
• Added scrollable modal lists, Escape-key dismissal, and click-outside closing.

Security Notes

• File detections remain heuristic and require review before remediation.
• Legitimate images should no longer be flagged solely because of incidental short PHP tags in compressed image data.
• Quarantine, restoration, deletion, evidence exports, and ignored-file management remain available.
• No automatic malware deletion is performed.

Installation & Updating

1. Download the plugin ZIP from this release.
2. In WordPress, navigate to Plugins → Add New → Upload Plugin.
3. Upload the ZIP and replace the installed version if prompted.
4. Open Asenka Guard and run fresh Uploads and Site scans.

Existing quarantine records and plugin data are intended to remain intact.

Compatibility

• WordPress 6.0+
• PHP 7.4+
• Existing Asenka Guard installations

---

Developed by [Asenka Interactive](https://asenka.com).

[GitHub Repository](https://github.com/Asenka-Dev-Team/Asenka-Guard)

v0.1.6 — Improve malware triage, image payload inspection, evidence exports and scan results UI

Asenka Guard v0.1.6

Scanning intelligence

• Validate common image file headers; flag declared JPG/PNG/GIF/WEBP signatures that don't match actual bytes.
• Add bounded bzip2, gzip and zlib decompression inspection. This is read-only; suspicious samples are never executed. PHP bzip2 is required to inspect bzip2 contents.
• Recognize meaningful embedded PHP markers and request-driven PHP/shell execution patterns.
• Add a targeted Scan Site signal for unexpected wp-blog.php root files, without claiming to reproduce Sucuri's proprietary detection signature.
• Reduce false positives from isolated code-like strings inside ordinary images.

Investigation and workflows

• Highlight selected findings; compact horizontal CRUD actions; differentiate confidence badges with stronger color-coding and reduce signal label width.
• Add file-type and new/changed/previously-detected filters; record last 30 scan summaries by scope.
• Add bulk Ignore and downloadable evidence ZIP with SHA-256 manifest; individual file limit 2 MiB, aggregate 12 MiB, maximum 50 included. Requires PHP ZipArchive.
• Keep hash-aware ignore, shared quarantine, file previews, YOOtheme checks, WP-CLI and GitHub updater.

Security limits

• Site-scope findings are review-only and cannot be quarantined by this plugin.
• Scan jobs remain synchronous and can hit PHP timeout limits; chunked AJAX scanning is not in this release.
• Compressed decoding is limited; an 'uninspected' signal is not a clean verdict.
• Detection is heuristic; mismatched file extensions are not definitive malware proof.
• Test on staging and back up the site and separate quarantine directory before production use.

Repository: https://github.com/Asenka-Dev-Team/Asenka-Guard
Developed by Asenka Interactive.

v0.1.5 — Harden quarantine and restore operations, add confidence and security diagnostics

Asenka Guard v0.1.5

Tag: v0.1.5

This release hardens quarantine and file operations, improves scan interpretation, and expands investigation workflows.

Added

• Numbered findings in scan-result tables, including responsive layouts.
• Ignore File action to suppress individually reviewed findings; changes to the file's SHA-256 automatically invalidate the ignore.
• Ignored Files tab to view rules and stop ignoring a file.
• Separate Scan Uploads and Scan Site tabs, with specific scan buttons, scan timestamps, and result lists.
• Scan Site read-only heuristics for suspicious code and embedded PHP outside uploads (skips symlinks, uploads, common dependencies and caches). Findings are heuristic and require verification.
• Shared quarantine tab for all scan scopes.
• WP-CLI scope flag: wp ayig scan --scope=site (or --scope=uploads); ignore and unignore commands.
• Confidence classifications, quarantine diagnostics, permission checks, and file integrity evidence.

Improved

• Safer quarantine/restoration and integrity verification.
• Responsive scan results and visual severity indicators.
• GitHub repository updater configuration and Asenka Guard branding.

Security limitations

• Scan Site is synchronous and may time out on large sites. A clean scan is not a guarantee of no compromise.
• WordPress core/root findings are review-only and cannot be quarantined by Image Guard; verify these against trusted originals.
• Suspicious PHP patterns also occur in legitimate themes and plugins. Do not bulk quarantine unverified code.
• Scanning does not itself restrict PHP execution; validate your server configuration separately.
• Back up the site and test remediation on staging before deploying broadly.

Installation
Download the release ZIP, then use Plugins > Add New > Upload Plugin > Replace current with uploaded, if applicable.

v0.1.4 — Fix native GitHub updates, improve file previews and PHP detection, add filename bulk selection

Asenka YOOtheme Image Guard v0.1.4

This release improves WordPress-native GitHub updates and suspicious-file investigation.

Added

• Filename-based bulk selection with optional full-path matching.
• Copy Path action, file-type column, and improved read-only previews.
• Second bulk actions toolbar below the results table, synchronized with the top toolbar.
• More nuanced severity triage: harmless directory placeholders LOW; unverified PHP-in-uploads and image PHP markers REVIEW; recognized tmp PHP incident patterns and stronger code indicators HIGH; combinations of request-driven execution and other malicious indicators CRITICAL.

Fixed

• Native WordPress GitHub updater hook and update diagnostics.
• Empty source-code previews and image rendering behavior.
• WordPress admin notices can no longer be injected into the dark dashboard heading; action feedback appears above the hero.
• Selection counts and top/bottom bulk action synchronization.

Security

• Severity labels are heuristic, not proof of malware or YOOtheme exploitation.
• Existing saved findings need a new scan to recalculate severity; quarantined files are not rescanned.
• No automatic deletion. Back up sites and validate quarantine storage before remediation.
• Scanner coverage remains focused on wp-content/uploads.

Developed by Asenka Interactive | https://asenka.com
Repository: https://github.com/Asenka-Dev-Team/Asenka-YOOtheme-Image-Guard

v0.1.3 — Add last-scan summary and finalize admin UI fixes

Asenka YOOtheme Image Guard v0.1.3

This maintenance release improves scan visibility and includes the latest WordPress admin UI fixes.

Added

• Last-scan summary displaying scan date/time, files examined, and active findings.
• Clear "Not yet scanned" message for new installations.
• Warning when the scan reaches its file-count limit.

Fixed

• Corrected CSS/JavaScript loading for both WordPress admin entry points.
• Removed duplicate security shield icon.
• Corrected results table markup and navigation.
• Maintained consistent gunmetal UI styling.

Notes

• Manual scanning and CSV exports remain available.
• Quarantine, restore, deletion, and WP-CLI functionality are retained.
• Scanning is limited to upload directories; findings require review before remediation.
• Backups and a private quarantine directory are recommended before using file-management actions.

Developed by [Asenka Interactive](https://asenka.com).

v0.1.2 — Enhanced scan results UI, quarantine management, file previews, and GitHub updates

Asenka YOOtheme Image Guard v0.1.2

This release focuses on improving the WordPress admin interface, making suspicious files easier to review, and providing better quarantine management.

What's New

• Redesigned Dashboard: New gunmetal/security-themed interface with dedicated Scan Results, Quarantine, YOOtheme Versions, and Updates tabs.
• Improved Scan Results: Select-all checkboxes, clickable selection cells, color-coded severity levels, file modification dates, and bulk actions.
• Malware Highlighting: Optional highlighting of highly suspicious PHP files within WordPress uploads directories.
• File Previews: Read-only file viewer for inspecting suspicious files without executing their contents.
• Code Snippets: Expandable details showing potentially malicious code snippets for easier investigation.
• Signal Information: Clickable detection signals with descriptions and links to additional information.
• Quarantine Management: Dedicated interface to review, restore, or permanently delete quarantined files.
• Scan Animation: Loading indicator displayed while scans are running.
• Asenka Integration: Custom admin footer, plugin management links, and GitHub repository integration.
• Updates Tab: Dedicated page for checking GitHub Releases and plugin update status.
• Documentation: Updated README, installation instructions, release workflow, and security limitations.

Security and Compatibility

• Maintains detection of suspicious PHP files in upload directories.
• Includes YOOtheme Pro version auditing for the image-handler vulnerability (CVE-2026-102785).
• Preserves quarantine and restore functionality.
• Supports WP-CLI and CSV exports.
• Requires PHP 7.4 or newer.

Installation

1. Download the plugin ZIP from this release.
2. In WordPress, navigate to Plugins → Add New → Upload Plugin.
3. Upload the ZIP and activate the plugin.
4. Navigate to Tools → Asenka YOOtheme Image Guard.
5. Run a manual scan to review findings.

Important Notes

Scanning is read-only by default. Quarantine, restoration, and permanent deletion require explicit administrator actions.

This plugin is an investigation and cleanup utility, not a replacement for comprehensive malware scanning, backups, or server-level security.

Recommendation: Test file management operations on a staging installation before using them on production websites.

---

Developed by [Asenka Interactive](https://asenka.com).