Skip to content
Security connector · PrestaShop and WordPress

A look inside, without your passwords.

A module for PrestaShop and a plugin for WordPress that let me check your site from the inside without FTP access. It can only read, it only answers signed requests and you uninstall it when we are done.

In short

Yes, a website can be checked from the inside without FTP access or passwords: the WebIntacta connector is a module for PrestaShop (1.6 to 9) and a plugin for WordPress that can only read. It lists the versions of the core, modules or plugins and themes, compares every file with the original, looks for suspicious code and reviews the settings, without reading customers, orders, payments or passwords, and it only answers requests signed from the WebIntacta panel. Joomla, Drupal and Magento have their own read-only connector. It installs in about five minutes from the site's admin and uninstalls like any other module.

Last updated:

What it does and what it doesn't

Two lists, no small print.

What it does

Lists versions
Core, modules or plugins and themes, active and disabled, with their exact version.
Compares files
It computes the fingerprint of every file and compares it with the original of your version. Anything that does not match is flagged.
Checks suspicious files
PHP in image or upload folders, obfuscated code, remote loads. For those files it sends an excerpt (beginning and end) to analyze it.
Checks the database
It looks for scripts injected into settings and content. It does not read customer or order tables.
Checks the configuration
Debug mode, permissions, admin accounts and security settings, evaluated on your server.
Looks for traces in the logs
When I ask it to, it searches the server logs for known attack patterns and returns a summary (which paths and from which networks), not the full logs.

What it never does

Change anything
Neither files nor the database. The only thing it writes is its own control files, in a private folder.
Read customer data
No customers, orders, payments or user passwords.
Send your secrets
It never sends files with secrets (wp-config.php, parameters.php, .env…). What only has to be compared, such as the configured payout account, travels as an encrypted fingerprint that cannot be reversed.
Answer anyone
It only answers requests signed from my panel with your installation's key. To anything else it responds as if it did not exist.
Run on page views
It does not load on your store's pages, so it does not slow it down.
Stay forever
You uninstall it like any module or plugin. With maintenance it stays installed, because it is what monitors integrity.

How to install it

About five minutes, from your site's admin.

  1. 01

    I send you the ZIP

    Generated for your site, with a unique key that only your installation and my panel know.

  2. 02

    You upload it from the admin

    PrestaShop: Modules → Upload a module. WordPress: Plugins → Add New → Upload Plugin.

  3. 03

    You activate it

    Its screen shows the last time it was used and what it did.

  4. 04

    When we are done, you uninstall it

    Like any other module or plugin. If you hire maintenance, it stays to keep watch.

More questions

The connector is used in the security report and in maintenance.

Can my website's security be checked without giving FTP access?

Yes. The connector installs from your site's admin like any module or plugin and can only read: I do not need FTP, the hosting password or your admin password.

Why a connector and not FTP?

With FTP you can do anything, including delete. With the connector you can only read, and what is read is limited by the code itself. A review does not need more.

Which versions does it support?

PrestaShop 1.6, 1.7, 8 and 9, and WordPress (with or without WooCommerce). It works from PHP 5.6 to 8.3, so it also runs on old hosting.

What if my site is not PrestaShop or WordPress?

Joomla (3.10 to 6), Drupal (9 to 11) and Magento 2.4 have their own, simpler read-only connector: it sends versions, file fingerprints and the content of the files I ask it to review, and it does not read the database or files with secrets. On Shopify, the store creates a read-only app. For everything else (custom PHP, Drupal 7, sites without admin access) I use a temporary agent: a file that only works with its launch key, expires after 72 hours, deletes itself once the scan is delivered and does not read files with secrets either. More on Joomla security, Drupal security and Magento security.

Can I see the code?

Yes. It is plain, non-obfuscated PHP: you can open the ZIP and read it, or ask your developer to.

Where is the data stored?

In my panel, only to prepare your report and, if you hire maintenance, to compare with previous scans. The details are in the privacy policy.

Is your website intact? Check it now.

Free external scan. No sign-up and nothing to install.

Get the PDF result and 30-day alerts (optional)

Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.

  • No FTP access
  • Read-only
  • No customer data

Cookie preferences