A few hours ago, I shared that security scanning was coming to Smart MCP. It's out now in Smart MCP Pro 1.0.3 and the free Smart MCP 1.0.7. Update both plugins from your WordPress dashboard. Your settings and data stay as they are.

New: the Security page (Pro)

Go to Smart MCP > Security in wp-admin. You get a clear overview, findings sorted by category, and one-click fixes. You can also just ask the AI, for example, "Is my website infected with malware?"

It finds:

• WordPress and plugin files that differ from the official WordPress.org copies

• Backdoors, hidden code, injected scripts, card skimmers, and crypto miners

• Scripts and spam injected into posts and settings

• Plugins and themes with known security holes, matched to your installed version, with the version that fixes each one

• Files anyone can download, like old config backups, database dumps, and debug logs

• Suspicious administrator accounts, and plugins removed from WordPress.org

It fixes:

• Restores changed files from the official copy, checked before it is written

• Removes only the injected code from a post or setting, with one-click undo

• Moves suspicious files to a quarantine where they can't run, with restore if you need it

It hardens your site with on/off switches:

• Turn off the file editor, block PHP in uploads, and block backup and log files

• Hide usernames from visitors, block XML-RPC, limit REST API use by bots, and add security headers

It keeps watch:

• Daily or weekly scans in the background, with an email when serious problems appear

• An optional weekly summary, so you know it ran even when all is well

• Spots files that changed since the last scan

As promised, Smart MCP explains what it found, suggests what to do, and asks before changing anything. Every fix can be undone. No scanner catches everything, so keep regular backups too.

Also in this release

• A simpler Connect page. Pick your app, and for Claude Desktop, the ChatGPT desktop (Codex) app, Claude Code, or Cursor, paste one ready-made message into the app. Each app gets its own key, and the page shows when it has connected.

• A redesigned Chat page, laid out like the Claude and ChatGPT desktop apps.

• Works with more of your plugins (Pro). It uses the actions other plugins offer and can look up where a plugin keeps its settings. Squirrly SEO is now supported.

• Divi (Pro). Build Divi components, choose which fields each page can change, and find icons by name.

• A friendlier Getting Started page with example requests you can try in one click.

Full list of changes: https://wpsmarto.com/smart-mcp/changelog

Thank you for your feedback so far. Many of these changes came straight from your questions and reviews. If something doesn't work the way you expect, reply here or reach out through the chat on wpsmarto.com.

We're working on a new capability for Smart MCP: AI-powered WordPress security scanning.

Soon, you'll be able to ask questions like "Is my website infected with malware?" and let Smart MCP investigate your WordPress installation.

The upcoming update will help you:

• Detect suspicious PHP code and potentially malicious files.

• Identify unauthorized changes to WordPress core files.

• Find injected scripts in posts and pages.

• Detect exposed debug logs and unexpected files.

• Identify outdated plugins and themes.

• Review suspicious files and recommend appropriate actions.

Smart MCP won't just report potential problems. It will explain its findings, suggest solutions, and request your approval before performing sensitive actions.

Our goal is to make WordPress security investigation easier, directly through natural language.

This feature is currently in development and is planned for our next release.

More updates coming soon!