Home/Products/WordPress Plugins/GB Sentinel Trace
You cleaned the hack. It came back on Tuesday.
We built this during a real incident — seven WordPress sites across four hosting accounts, malware that restored itself from the database after every file deletion, and rogue administrators inserted through forged login events. Sentinel Trace watches for exactly that: not malware, but the ways an attacker stays after you think they're gone.
Reinfection isn't bad luck. It's a backdoor you missed.
When a site gets hacked twice, the second event usually isn't a second break-in. The attacker never lost access — and the three places they keep it are the three places a cleanup routinely overlooks.
An account that looks legitimate
An extra administrator named something plausible, or an existing user quietly escalated. Delete the malicious files all you like; the login still works.
Code that reinstalls itself
A loader in mu-plugins runs on every page load and rewrites the payload you just deleted. The site looks clean for a day, then doesn't.
Logins that fake being you
We watched an attacker create administrators through spoofed login events, so the security plugin logged the intrusion as a normal successful login by the site owner.
What it watches
Every check here is a state comparison — what the site looks like now against what it looked like before. No malware signatures, no threat feed, nothing that goes stale the week after you install it.
Administrator roster
Alerts the moment a new admin appears or an existing user is escalated. On a compromised WordPress site this is the single highest-signal event there is.
Forged login detection
Catches administrator accounts created through spoofed wp_login events — the technique that makes an intrusion look like you signing in normally.
Hourly baseline diffing
Fingerprints mu-plugins, plugin folders, loose PHP in wp-content and theme functions.php, then compares hourly. Changes outside a genuine update get flagged.
mu-plugins surveillance
Must-use plugins load automatically and can't be deactivated from the admin, which makes them the favourite parking spot for loaders — and a permanent focus here.
Reserved-domain email detection
Flags accounts registered against throwaway or reserved domains, a common tell on automatically created administrator accounts.
Alerts you'll actually read
No daily digest of noise. It emails when something structurally significant changes, which on a healthy site is almost never.
Baseline, watch, alert
Install it on a site you believe is clean and it defends that state. Install it on a compromised one and the first check tells you.
Take the baseline
On activation it fingerprints every mu-plugin, plugin folder and theme file, and records the current administrator roster.
Watch continuously
Hourly checks compare the live site against that baseline. Legitimate updates are recognised and re-baselined.
Act on the alert
You get told what changed, where, and when — enough to decide in a minute whether it was you, an update, or somebody else.
It's free
No tiers, no licence, no upgrade prompts. It exists because we needed it, and a monitor that only warns half the people who need warning isn't worth building. If it ever fires on your site, that's the day to talk to us — and that conversation is where we make our money, not this.
If it does fire, we clean it.
Sentinel Trace tells you something is wrong. Getting a compromised WordPress site genuinely clean — rather than clean for a week — is a different job, and one we've now done end to end across seven sites in a single campaign.
Database as well as files
We found a quarter-megabyte payload sitting in wp_options, able to rebuild the entire infection after every file had been deleted. Any cleanup that only touches files leaves that behind.
The whole hosting account
Reinfection usually comes from a neighbouring site on the same account, not the one you cleaned. We work the account, not the domain.
Hardened afterwards
Registration locked at the option level, credentials rotated, monitoring left in place — so the second cleanup never gets booked.
Questions
Does this replace Wordfence or Sucuri?
No, and don't let it. Those are firewalls with malware scanners, built to stop the break-in and match known bad files, maintained by full-time threat teams. Sentinel Trace does one narrow thing they don't: it watches for persistence. Run both.
Is it a malware scanner?
No. It never tries to decide whether a file is malicious — it only reports that something changed when nothing should have. That's deliberate: signature matching goes out of date and produces false alarms, while a changed file in mu-plugins is worth knowing about either way.
Can it clean an infection?
No, and be sceptical of anything that claims to. It tells you precisely what changed and where, which is what makes a cleanup fast and complete instead of a guess that leaves the backdoor in place.
What happens when I update a plugin legitimately?
Genuine updates are recognised and the baseline is refreshed automatically. You get alerted about changes that happen outside the update process, which is the pattern worth knowing about.
Will it slow my site down?
No. Checks run on a schedule in the background, not on page loads. Visitors never wait on a scan.
My site was hacked last month and seems fine now. Is it?
Install it and take a baseline — the first check will tell you whether anything unexpected is already there. Reinfection weeks later is the normal pattern, not the exception.
Looking after client sites on a maintenance retainer?
Install it across the portfolio. It costs nothing, and finding a rogue administrator an hour after it appears is the difference between an email and a weekend.
