Scanners give you a verdict, not a location
A signature match tells you something matched. It rarely tells you what the code does, whether it is a false positive, or what else it touched.
You think your site has been hacked.
Find out in minutes, with evidence.
A hacked WordPress site is mostly an information problem. You know something is wrong — redirects, unfamiliar admin users, mail landing in spam — but not which of 40,000 files is responsible. Talos reads the source directly, reports findings with file and line evidence, and captures every change it makes so a bad cleanup can be undone.
WNorthstar Studio+ New
Howdy, Alex
Why compromises are hard to pin down
Injected code hides in plain sight
Obfuscated eval blocks, base64 payloads and unserialize calls sit inside otherwise legitimate plugin files, often thousands of lines down.
Cleanup breaks working sites
Deleting the wrong file takes the site down. Without before-and-after snapshots, an aggressive cleanup is a second outage.
What actually happens.
Establish what changed
Talos reads Site Health, the error log tail and cron events to find the symptoms: new scheduled hooks, PHP warnings from unexpected paths, failing loopbacks.
Search the source for real patterns
Regex search across sandboxed plugin and theme source for eval, base64_decode, unserialize on input, remote requests and file writes — then read the surrounding lines to judge each hit in context.
Get findings with evidence attached
Every finding arrives as a structured report card citing the file, the line number and the snippet, so you can verify the call yourself rather than trusting a score.
Clean up reversibly
Removals and edits are captured in a change set with checksums. If the cleanup was too aggressive, roll it back — and Talos refuses to overwrite anything that has since drifted.
The exact tools it uses.
Talos does not improvise. Each of these is a defined tool with validated inputs, a declared risk level and its own policy setting.
Source access is read-only and sandboxed to plugin and theme directories. Talos reads at most 200 lines per call, so it reasons about specific code rather than guessing.
See the full tool cataloggrep_plugin_files
ReadRegex-search sandboxed plugin source code.
read_plugin_file
ReadRead numbered line ranges from a plugin file, capped at 200 lines per call.
read_error_logs
ReadBounded, redacted log tail with search, a time window and error grouping.
inspect_cron
ReadWP-Cron events, overdue items, schedules and unusually frequent hooks.
inspect_site_health
ReadRuns bounded WordPress Site Health direct tests and returns structured findings.
manage_users
WriteUsers and roles. Passwords are never accepted or returned.
create_report
ReadInline structured report cards for security, SEO, health and other audits, with file and line evidence.
rollback_change_set
WriteRoll back an approved change set in reverse order. Refuses resources that have drifted.
Or set it once and forget it.
Any of this can become a workflow. You write the prompt, choose the trigger, and lock the permissions before it ever runs.
How workflows workWeekly integrity scan
WorkflowTrigger
Weekly · Sundays at 02:00 · site timezone
Prompt
“Search plugin and theme source for eval, base64_decode, unserialize on request data, and unexpected remote requests. Check for admin users created in the last 7 days and new cron hooks. Report anything new since the last scan with file and line evidence.”
Pre-authorized scopes
- site:read
- plugins:read
- email:send
Delivery
Emailed weekly. Read-only, so no approval gate is needed.
The outcome.
Findings you can verify, with file, line and snippet
Suspicious cron hooks and recent admin users surfaced together
Cleanup captured in a reversible change set with checksums
A weekly scan that tells you when something is new
Guardian continuously matches installed software against vulnerability advisories between scans
Before you rely on it.
Is Talos a replacement for a security plugin?
Talos now includes Guardian, a built-in security module with a request firewall, resumable scanning with official checksum verification, and AI-powered vulnerability patching. The agent inspects source and reports findings with evidence; Guardian adds the always-on protection layer. Together they cover both investigation and prevention — no separate security plugin required for most sites.
Can Talos read core WordPress files?
Source search is sandboxed to plugin and theme directories. For core integrity, Site Health checks report on core file modifications, which Talos reads as part of its diagnostics.
What if Talos deletes something the site needs?
Tracked write operations are captured in change sets with before-and-after snapshots and checksums. You can preview the rollback order, verify resources against the recorded checksums, and roll the change set back. Rollback refuses resources that have drifted since, so it will not overwrite newer legitimate edits.
Should I let it clean up automatically?
For an active compromise, use Plan mode. Talos proposes a structured plan, you approve it, and only then does it act. Deletions and plugin lifecycle actions carry their own confirmation gates on top of that.
Keep reading
Feature
Guardian
Firewall, live request logging, scanning, 2FA, vulnerability intel and AI-assisted patching — always on.
Read moreUse case
Debug a broken site
White screen, 500 error, failing checkout or emails that never send. Talos reads your error logs, cron and HTTP responses to find the cause with evidence.
Read moreUse case
Fix a slow site
Talos reads Site Health, cache pressure, database metrics and cron in one pass, then compares snapshots so you can see what changed rather than guessing.
Read morePut an agent to work in WordPress.
Spend less time clicking through admin and more time moving your site forward.