Custonis – Security Exposure Scanner

Custonis detects publicly exposed files that should never be accessible on the internet.

Many WordPress websites unintentionally expose sensitive files such as:

• database backups (.sql, .zip)
• exported user or customer data
• configuration files (.env, wp-config backups)
• debug logs and error logs
• development leftovers

These files are actively targeted by bots and attackers because they may expose:

• database credentials
• API keys
• user data
• internal system information

Why Custonis?

Most security plugins focus on firewalls, malware or login protection.

Custonis focuses on a different but critical attack surface:

👉 Public file exposure

It helps you identify risks that are often overlooked and complements traditional security plugins.

Features

✔ Detect exposed backup files (.zip, .sql, .gz)
✔ Detect debug logs and error logs
✔ Detect configuration backups and sensitive files
✔ Detect exposed Git repositories
✔ Detect directory listing vulnerabilities
✔ Database health checks (large tables, autoload size, transients, revisions)
✔ Severity classification (Critical / Elevated / Low)
✔ Security score calculation
✔ Risk level indicator
✔ Exposure age tracking (when issues first appeared)
✔ Detailed findings dashboard with explanations and fixes
✔ Scan history chart
✔ Fast and lightweight scanning
✔ 100% local scanning (no external API calls)

How it works

1. Install and activate the plugin
2. Open the Custonis dashboard
3. Run a security scan
4. Review detected exposures and fix issues

Custonis performs read-only scans and does not modify your website.

1.1.7

= Fixed =
* Fixed missing “first detected” timestamps for findings
* Fixed finding lifecycle persistence across repeated scans
* Fixed overly aggressive severity classification for transient cache findings

Improved

• Improved finding history tracking and exposure timeline accuracy
• Improved database health severity evaluation
• Improved consistency of finding status handling (new / existing)
• More reliable exposure age tracking between scans

UX

• Clearer exposure timeline information
• More accurate risk presentation for database-related findings

1.1.6

= Fixed =
* Fixed detection regression for publicly exposed debug.log files
* Fixed exposure validation issues on hosting environments returning soft-404 responses
* Fixed multiple false positives for non-existing backup and environment files

Improved

• Improved HTTP exposure verification logic
• Improved detection accuracy for publicly accessible files
• Better filtering of invalid HTML fallback responses
• More reliable validation of exposed backup archives and configuration files
• Improved compatibility with modern hosting and caching setups

Security

• Improved exposure validation for debug logs and backup files
• Reduced risk of incorrect exposure reporting

UX

• Cleaner and more trustworthy scan results
• Reduced false positives and invalid findings

1.1.5

= Improved =
* Significantly improved exposure detection accuracy
* Reduced false positives for backup and environment file detection
* Improved validation of publicly accessible files and directories
* Better handling of soft-404 and fallback responses on modern hosting environments
* More reliable exposure verification logic

Security

• Improved detection quality for exposed backup archives
• Improved ENV file validation using content-based verification
• Improved filtering of invalid exposure results

UX

• Cleaner and more trustworthy scan results
• Reduced noise from invalid findings

1.1.4

= Improved =
* Fixed exposure timeline (first detected now tracked correctly)
* Improved consistency of finding history across scans
* Enhanced score accuracy for repeated findings

Added

• Score breakdown (critical / elevated issues) directly in dashboard
• More transparent risk evaluation for users

UX

• Improved clarity of exposure age and status
• Cleaner and more understandable dashboard feedback

1.1.3

• Optimized false positives

1.1.2

• Fixed version inconsistency in trunk

1.1.1

• Fixed dashboard live stats not updating after scan
• Improved scan result persistence

1.1

= Improved =
* Significantly improved scan stability and execution flow
* Optimized background scanning process
* More accurate live scan progress tracking
* Improved performance for large websites
* Enhanced scan result storage and reliability
* Refined dashboard UI and scan experience

Added

• Improved filesystem scanning coverage
• Enhanced database analysis
• More precise detection of exposed files and risks
• Better scan step handling and progress visualization

Internal

• Codebase cleanup and structural improvements
• Optimized AJAX handling and data flow

1.0.1

= Fixed =
* Removed all Pro / license / cron related functionality for full compliance with WordPress.org guidelines
* Replaced external CDN (Chart.js) with local asset
* Fixed nonce handling (sanitization and validation)
* Improved escaping for all output
* Improved file path handling using WordPress functions

1.0.0

= Initial release =
* Exposure scanner
* Severity detection (Critical / Elevated)
* Security score calculation
* Exposure age detection
* Findings dashboard
* Scan history chart