# The WebIntacta read-only connector > Security connector for PrestaShop and WordPress: read-only, signed requests, no FTP or passwords. What it sends, what it never touches and how to remove it. URL: https://webintacta.com/en/read-only-connector Language: English (Spanish version: see the hreflang alternate of the HTML page) Last updated: 2026-10-24 **In short:** Yes, a website can be checked from the inside without FTP access or passwords: the WebIntacta connector is a module for PrestaShop (1.6 to 9) and a plugin for WordPress that can only read. It lists the versions of the core, modules or plugins and themes, compares every file with the original, looks for suspicious code and reviews the settings, without reading customers, orders, payments or passwords, and it only answers requests signed from the WebIntacta panel. Joomla, Drupal and Magento have their own read-only connector. It installs in about five minutes from the site's admin and uninstalls like any other module. ## What it does - **Lists versions.** Core, modules or plugins and themes, active and disabled, with their exact version. - **Compares files.** It computes the fingerprint of every file and compares it with the original of your version. Anything that does not match is flagged. - **Checks suspicious files.** PHP in image or upload folders, obfuscated code, remote loads. For those files it sends an excerpt (beginning and end) to analyze it. - **Checks the database.** It looks for scripts injected into settings and content. It does not read customer or order tables. - **Checks the configuration.** Debug mode, permissions, admin accounts and security settings, evaluated on your server. - **Looks for traces in the logs.** When I ask it to, it searches the server logs for known attack patterns and returns a summary (which paths and from which networks), not the full logs. ## What it never does - **Change anything.** Neither files nor the database. The only thing it writes is its own control files, in a private folder. - **Read customer data.** No customers, orders, payments or user passwords. - **Send your secrets.** It never sends files with secrets (wp-config.php, parameters.php, .env…). What only has to be compared, such as the configured payout account, travels as an encrypted fingerprint that cannot be reversed. - **Answer anyone.** It only answers requests signed from my panel with your installation's key. To anything else it responds as if it did not exist. - **Run on page views.** It does not load on your store's pages, so it does not slow it down. - **Stay forever.** You uninstall it like any module or plugin. With maintenance it stays installed, because it is what monitors integrity. ## How to install it 1. **I send you the ZIP.** Generated for your site, with a unique key that only your installation and my panel know. 2. **You upload it from the admin.** PrestaShop: Modules → Upload a module. WordPress: Plugins → Add New → Upload Plugin. 3. **You activate it.** Its screen shows the last time it was used and what it did. 4. **When we are done, you uninstall it.** Like any other module or plugin. If you hire maintenance, it stays to keep watch. It is used in the [security report](https://webintacta.com/en/website-security-audit) and in [maintenance](https://webintacta.com/en/pricing#mantenimiento). ## Frequently asked questions ### Can my website's security be checked without giving FTP access? Yes. The connector installs from your site's admin like any module or plugin and can only read: I do not need FTP, the hosting password or your admin password. ### Why a connector and not FTP? With FTP you can do anything, including delete. With the connector you can only read, and what is read is limited by the code itself. A review does not need more. ### Which versions does it support? PrestaShop 1.6, 1.7, 8 and 9, and WordPress (with or without WooCommerce). It works from PHP 5.6 to 8.3, so it also runs on old hosting. ### What if my site is not PrestaShop or WordPress? Joomla (3.10 to 6), Drupal (9 to 11) and Magento 2.4 have their own, simpler read-only connector: it sends versions, file fingerprints and the content of the files I ask it to review, and it does not read the database or files with secrets. On Shopify, the store creates a read-only app. For everything else (custom PHP, Drupal 7, sites without admin access) I use a temporary agent: a file that only works with its launch key, expires after 72 hours, deletes itself once the scan is delivered and does not read files with secrets either. More on [Joomla security](https://webintacta.com/en/joomla-security), [Drupal security](https://webintacta.com/en/drupal-security) and [Magento security](https://webintacta.com/en/magento-security). ### Can I see the code? Yes. It is plain, non-obfuscated PHP: you can open the ZIP and read it, or ask your developer to. ### Where is the data stored? In my panel, only to prepare your report and, if you hire maintenance, to compare with previous scans. The details are in the [privacy policy](https://webintacta.com/en/privacy).