RootNet Sentinel

Security, Health & Diagnostics for WordPress — developed by RootNet and provided free under GPL-2.0-or-later.

Product principles

• Local-first: no telemetry, tracking, SaaS connection, or external account.
• Explainable: every scored check contains evidence and a recommended action.
• Safe by default: diagnostics do not mutate production configuration or content.
• Efficient: scans are cached for six hours and scheduled once daily; assets load only on Sentinel pages.
• Privacy-aware: events are minimized, IP addresses are one-way hashed, retention is configurable, and reports are redacted.

Requirements

• WordPress 6.5 or newer
• PHP 7.4 or newer
• A single-site installation; the architecture detects multisite but network-wide administration is not claimed in 1.0.0

Architecture

• rootnet-sentinel.php: bootstrap and release metadata
• includes/class-rns-plugin.php: lifecycle and hooks
• includes/class-rns-scanner.php: local checks, scoring, cache, environment inventory
• includes/class-rns-events.php: event hooks and privacy eraser
• includes/class-rns-database.php: event storage and retention
• includes/class-rns-reports.php: redacted snapshots
• admin/class-rns-admin.php: capability-protected admin UI and actions
• assets/: scoped admin assets
• uninstall.php: administrator-controlled removal

Scoring model

Scores begin at 100. Only findings in the relevant category subtract points. Base penalties are Critical 25, High 15, Medium 8, Low 3, Informational 0, and Passed 0. Each check has a documented weight, and its deduction is capped at 30. The overall score evaluates all scored categories. This model is deterministic; the evidence shown beside each result explains every deduction.

Scores are prioritization aids, not a guarantee that a site is secure. Checks deliberately label uncertain context as informational and avoid remote probing in V1.

Data model

{prefix}_rns_events stores: numeric ID, event type, severity, WordPress user ID, site-specific HMAC of source IP, short object label, redacted JSON details, and UTC timestamp. The table is indexed by event type and timestamp. Cleanup runs daily.

Settings are stored in rns_settings. Scan results use a six-hour transient. No secrets are stored by the plugin.

Security model

• All pages and actions require manage_options.
• State-changing actions require WordPress nonces.
• Input is sanitized and constrained; output is escaped at render time.
• Database writes use $wpdb->insert, $wpdb->update, or prepared values.
• Report downloads use authorization, a nonce, no-cache headers, fixed filenames, and content-type hardening.
• Snapshot construction uses an allowlist and recursive redaction.
• No public AJAX, REST endpoint, filesystem write, arbitrary file selection, code execution, or unsafe unserialization exists.

Development and testing

Run PHP syntax checks against all PHP files and test activation, scanning, event collection, exports, retention, privacy erasure, and uninstall on a disposable WordPress installation. Before WordPress.org submission, run Plugin Check and WordPress Coding Standards with the current official rules.

Limitations in V1

Loopback, HTTP security headers, certificate expiry, public debug-log exposure, REST user enumeration, and external directory exposure cannot always be assessed reliably without making HTTP requests. V1 avoids those remote/self-HTTP probes to honor its local-only, low-load contract. File permission results are shown only for files that are locally detectable. WP-Cron disabled status is informational because a system cron may correctly replace it.

License

GPL-2.0-or-later. See LICENSE.