TeraServer Clinic Scan & Repair Kit

TeraServer Clinic is the on-site agent for the TeraServer Clinic service (wpclinic.ai). It connects your WordPress installation to a TeraServer Clinic account and, depending on your plan, scans for malicious code, keeps WordPress core/plugins/themes updated, backs up your files, and applies AI-assisted cleanup when a threat is found.

The free scan works standalone with just a connection token — no payment required. Paid plans add faster/scheduled autoscan, automatic updates, off-site backups, AI-assisted repair of infected files, and monitoring across more sites.

Features

• Malware scan: walks wp-content (uploads first) looking for PHP dropped in the uploads folder, double file extensions, known webshell/backdoor signatures, obfuscated eval() calls, and cryptomining scripts. Also checks the database for recently created administrator accounts and posts/options containing injected/obfuscated code.
• Security hardening: one-click, reversible fixes for common misconfigurations (missing security headers, XML-RPC exposure, user enumeration, exposed readme/info files, file editor access, directory listing) plus a built-in login-URL cloak.
• Automatic updates (paid plans): keeps plugins, themes and WordPress core current, each update guarded by an automatic backup, a post-update health check, and a rollback if anything breaks. A manual scan/update can also be triggered from the dashboard.
• Autoscan: periodic scanning (daily or weekly depending on plan) via WordPress cron.
• Backups (paid plans): a small «repair set» backup before any automated fix, an on-demand full-site backup, and an opt-in weekly full backup — all stored off-site on TeraServer Clinic’s backup storage, not on your own hosting.
• PHP compatibility report: analyzes the plugins and themes actually in use to recommend the highest PHP version your site can safely run.
• AI-assisted cleanup (paid plans): when malware is found, a proposed fix is generated off-site and applied through the plugin’s own audited code — never as a remote shell — always preceded by a backup and followed by a health check with automatic rollback if anything breaks.

This WordPress.org edition receives its own updates exclusively through the WordPress.org plugin directory, like any other listed plugin — it does not use a custom update mechanism for itself.

External services

This plugin is a thin client: on its own, without a connection, it does nothing. To do anything useful it must be connected — via a one-time connection token generated in your TeraServer Clinic account — to the TeraServer Clinic service, using an API key issued to your site. No data described below is sent anywhere until you complete that connection step, which itself shows this same disclosure and links to the Terms and Privacy Policy before you submit a token.

Once connected, this plugin communicates with the TeraServer Clinic backend for the following, each described with what is sent and when:

• Connecting/licensing. When you paste a connection token, the plugin sends your site’s home URL and the plugin version to exchange that token for a per-site API key and your plan’s entitlements. This happens once at connection time, and again if you move the site to a different TeraServer Clinic account.
• Periodic sync. Roughly twice daily (WordPress cron) and right after connecting, the plugin sends your site URL, WordPress version, PHP version, plugin version, the current login URL, and a full inventory of installed plugins/themes (name, version, active/inactive, available updates) so the service can tell you what needs attention and, on plans that include it, apply updates.
• Scan reports. After every scan (free tier included), the plugin sends the list of findings — file paths/locations, finding type, and severity/detail text, not full file contents — so they show up in your TeraServer Clinic dashboard and can trigger email alerts.
• Malware-signature confirmation. During any scan (free tier included), if a small, bounded set of files (at most 25 files, 1 MB each) already matches a local suspicious-pattern check, the plugin sends the full contents of just those flagged files to the TeraServer Clinic service for a second, server-side confirmation pass. Files that don’t match a local pattern first are never sent this way.
• Off-site backups (paid plans). Manual and scheduled full-site backups, and the small «repair set» backup taken automatically before any destructive action (delete, repair, update), are uploaded as a zip to TeraServer Clinic’s backup storage, kept for a limited retention window so a site can be restored.
• AI-assisted repair (paid plans). When you request a fix for detected malware, the full contents of the specific flagged file(s) (never your whole site) are sent to the TeraServer Clinic service, which returns a proposed cleaned version. That content is used only to produce the fix and is not retained afterwards. The plugin applies the returned patch itself, using its own code — the fix is never executed as a remote script — and always backs up first and rolls back automatically if a post-fix health check fails.
• Admin email breach check. On a connected site, the plugin sends your WordPress admin email address to the TeraServer Clinic service, which checks it against known public data breaches and returns whether/how many breaches matched (not the breach data itself).
• Plugin/theme alternative & compatibility suggestions. The plugin sends the slugs and versions of installed plugins/themes so the service can suggest actively-maintained alternatives or flag PHP/WordPress compatibility issues — no file contents are sent for this.

Separately, and independent of the TeraServer Clinic connection above:

• Cloudflare Turnstile (opt-in, your own keys). If you choose to turn on the optional captcha/bot-protection feature on the Security tab, you paste your own free Cloudflare Turnstile sitekey and secret key (obtained directly from Cloudflare, not from TeraServer Clinic). From then on, the login/comment/registration pages you enabled it for load Cloudflare’s Turnstile script (challenges.cloudflare.com), and each submission’s response token is sent to Cloudflare’s siteverify endpoint for validation. No data goes to TeraServer Clinic for this feature — only to Cloudflare, using your own account. See Cloudflare’s Privacy Policy (https://www.cloudflare.com/privacypolicy/) for their handling of this data. If left off (the default), no data is ever sent to Cloudflare.

All of the above only happens after you connect the plugin with a valid API key; a disconnected/inactive install sends nothing. See the TeraServer Clinic Terms of Service (https://wpclinic.ai/legal/terminos) and Privacy Policy (https://wpclinic.ai/legal/privacidad) for the full data-handling and retention terms.