WordPress security that
scans your database.
A lightweight agent for hosting providers that finds rogue admins, wp_options injections, and SEO spam that Imunify360 and Wordfence can't see — because they don't scan the database. CleanShift does.
Born from a real CVE-2024-28000 incident — built to find what file scanners miss.
Works with
cPanel / WHM
Root or user-level
Plesk
Admin extension
WordPress
optional mu-plugin Guard — no root needed
Any Linux VPS
CentOS · Alma · Ubuntu · CloudLinux
The scanning agent requires root SSH access. The WordPress Guard plugin works on any hosting — no root needed.
What makes us different
Security that sees what others can't.
Database-Level Scanning
The industry scans files. We scan the database. Rogue admin accounts, wp_options injection payloads, SEO spam markers, persistence backdoors — we find what Imunify360 and Wordfence physically cannot detect.
Agent footprint.
Competitor average: 80MB.
Real-Time Guard
An optional PHP mu-plugin (manual deploy — not included in zero-touch agent install) can block REST API abuse, unauthorized admin creation, and cron hijacking before changes hit disk.
Cross-Site Correlation
If one site is compromised, CleanShift instantly checks every other site on the server for the same IOCs. No manual work.
CVE Playbooks
Operator-approved remediation playbooks for each vulnerability. Not generic quarantine — surgical cleanup with backup before change, verify after, and auto-rollback if the site becomes unhealthy (leftover detections fail closed with backup retained).
Deploy to 1,000 servers in minutes.
Your DevOps team will love the CLI. Your CFO will love the risk mitigation. And you'll finally sleep through the night.
New in v1.4
Detection capabilities that learn and evolve.
SEO Spam Detection
Detects gambling, pharma, and casino keyword injection in your WordPress database. Catches author burst attacks (50+ spam posts per day) and hidden redirect chains.
Dropper & Artifact Detection
Finds zero-byte PHP dropper stubs, compressed backdoor payloads (.gz/.zip in web dirs), and misleading extensions like .php.bak or .jpg.php.
Verification Scanning
Post-remediation mode re-scans only previously-flagged locations. Confirms cleanup in seconds, not minutes. 10x faster than a full scan.
Community Intelligence
Crowd-sourced threat hashes from every CleanShift agent feed into your scanner. New malware patterns detected anywhere protect you everywhere.
IoC Contribution
Every scan automatically contributes discovered indicators back to the collective intelligence — making the entire network smarter.
Self-serve path
Connect, protect, then scan — from the console.
Connect with a console install token
Sign up, open Add Server, and run the curl …/i/{token} | bash one-liner on the host. The agent is ~600KB with no heavy runtime deps.
Protect WordPress sites under Sites
Connect already inventories WordPress installs. Protect the ones in scope under Sites — re-queue Discover only if inventory is empty. Scans and schedules run on protected sites.
Scan, review findings, approve cleanup
Queue a scan from the dashboard, understand findings, then approve backup → remediate → verify. Optional Guard (manual mu-plugin) helps harden afterward.
How we compare
The competition doesn't scan the database.
| Feature | CleanShift | Imunify360 | Wordfence |
|---|---|---|---|
| Database scanning | |||
| Approved remediation with backup + rollback | |||
| Cross-site correlation | |||
| CVE-specific playbooks | |||
| SEO spam detection | |||
| Email security scanner | Beta | ||
| Plugin auto-updater | Soon | ||
| Server-level view | |||
| WordPress depth | Deep | Shallow | Deep |
| Resource footprint | 600KB | Heavy | Heavy |
| Real-time guards | |||
| Starting price | ₹0 | $12/mo | $149/yr |
What's Inside
WordPress security that sees the database.
Detect persistence and malware inside WordPress — then review, back up, remediate, and verify with rollback.
File + Database Scanner
Scans both the filesystem and the WordPress database — catching rogue admins, wp_options injections, SEO spam, and persistence kits that file-only scanners miss.
Approved Remediation + Rollback
Review findings, approve cleanup, then CleanShift backs up, remediates, and verifies. Auto-rollback if the site becomes unhealthy after cleanup; leftover detections fail closed with backup retained.
Realtime Guard
Optional WordPress mu-plugin that blocks suspicious admin creation, malicious uploads, and common persistence tricks. Not installed by zero-touch agent setup — deploy via deploy/deploy.sh or manual copy.
Cross-Site Correlation
When one site on a shared server is infected, CleanShift checks the rest for the same backdoors, rogue admins, and kit fingerprints.
CVE & Kit Playbooks
Remediation playbooks for known WordPress CVEs and reinfection kits — including persistence kits that recreate malware after incomplete cleanups.
Scheduled Scans
Keep protected sites on a recurring Quick or Deep scan schedule so reinfections are caught early.
SSL Monitor
Collect certificate expiry across discovered WordPress domains via agent Scan now / cleanshift ssl --submit. Alerts for lapse still depend on agent connectivity.
AI Threat Analysis
Optional LLM-assisted explanations when configured. Confidence scores on detections come from heuristics and intelligence — not marketed as neural magic.
Joomla & Drupal
Shallow filesystem coverage exists today. Full database-depth parity with WordPress is not part of Release 1.
Email Security Scanner
Agent-side SPF/DKIM/DMARC checks exist; the full SaaS surface is still maturing.
Plugin Auto-Updater
Not in Release 1.0 — API/agent orchestration returns HTTP 501. Use your host panel or WP-CLI until the control-plane path ships.
Migration Security Scan
Pre/post migration security clearance — not a WHM account-transfer orchestrator.
Pricing
Pay per site. No server tax.
One price per WordPress site — not per server. A server with 50 sites costs what 50 sites cost. Volume discounts kick in automatically as you grow.
Free
Signup starts a 14-day Pro trial. Afterward: 1 site, quick scan only (remediation is trial/paid).
- Quick scan (detect threats)
- Vulnerability scanning
- Scan history in console (~30-day free-tier retention)
- In-app Activity (Telegram is optional agent-local CLI)
- 1 protected site — no approve/remediate on Free
Starter
1–10 sites. Freelancers & solo devs.
- Everything in Free
- Manual-approval remediation + rollback
- CVE & kit playbooks
- Scheduled scans
- Cross-site correlation
- Realtime Guard (mu-plugin; manual deploy)
Agency
11–50 sites. For agencies & consultants.
- Everything in Starter
- 30% volume discount
- Multi-client fleet view
- Priority support
- Email security (Beta)
- White-label reports (Coming Soon)
Reseller
51–200 sites. Hosting resellers & MSPs.
↓ ₹29/site for 201+ sites (Provider).
- Everything in Agency
- 50% volume discount
- WHMCS module (ops-assisted Beta)
- Migration security scans (CLI / Coming Soon in console)
- Custom playbooks (Coming Soon)
- Dedicated onboarding
The maths: 30 sites × ₹69 = ₹2,070/month. One hacked site costs ₹5,000–50,000 in lost revenue & cleanup. CleanShift pays for itself on the first prevention.
FAQ
Common questions
Is CleanShift only for WordPress?
CleanShift is designed primarily for WordPress on shared hosting (cPanel/WHM, Plesk). The agent discovers WordPress installations on the server. Joomla and Drupal deep scanning is Coming Soon — not a Release 1 claim.
Does CleanShift remove malware or just detect it?
Detection is always available. Remediation in Release 1 requires manual approval in the dashboard: the agent backs up, remediates, then verifies — not silent auto-cleanup.
Why does the agent need root access?
Server-level scanning requires access to all user home directories and database credentials. The agent only reads during scanning — write operations happen only during explicit remediation. All source code is open source and auditable.
Will it slow down my server?
The agent uses ~1.2MB of RAM and scans run as low-priority background processes. No inbound ports are opened. There is zero impact on website load times.
How does per-site pricing work?
You pay per protected WordPress site, not per server. One server with 50 protected sites counts as 50. Volume brackets apply automatically.
What happens when a threat is detected?
You get a detailed finding with evidence and a recommended next step. You can approve Back Up & Remediate from the dashboard; the agent then verifies. If the site becomes unhealthy after cleanup, it auto-rolls back. Leftover detections fail closed and the backup is retained for restore.
Built by people who manage real servers.
CleanShift is built by Kamyab Infotech — a team that runs hosting infrastructure, cleans malware from production servers, and manages WordPress at scale. This tool exists because we needed it ourselves.
Request Early Access
Not ready to deploy yet? Join the waitlist to get exclusive updates and priority access to new enterprise features.