The web's biggest target deserves a proper guard.
WordPress runs a huge share of the web, which makes it the thing automated attacks look for first. Kepteo scans your site every night, and every change it makes passes through locks it cannot switch off.
Files scanned
14,208
Found
3
Fixes drafted
3
- 2Two plugins with known vulnerabilitiesUpdate drafted for each · waiting for youfound
- 1XML-RPC open to brute forceGuard drafted · waiting for youfound
- Core files match the official releaseNothing modifiedclear
Five gates between a sentence and your live site.
No step can be skipped, and none of them is a setting. This is the only road a change can take.
Your site is saved before anything is touched.
restore pointEvery instruction is created unpublished.
publish: falseYour approval is signed by our server.
ed25519The plugin rejects anything unsigned or replayed.
signature + nonceContent is sanitised before it's written.
ksesThings Kepteo is built to be unable to do.
Promises can be broken. These are enforced in code, and some have tests that fail the build if they ever change.
Publish without you
There is no path where a change goes live on its own. Drafts wait for your tap.
Write files on your server
Kepteo edits content through WordPress. It has no handle for writing files at all.
Read your secrets
wp-config, .env and password files are blocked by name before anything can open them.
Run code on your host
No arbitrary code execution. No AI calls from inside your WordPress.
Change without a way back
No snapshot, no change. Every edit has a restore point, with no exceptions.
Report work it didn't do
Claims are checked against your live site before you're told a change happened.
Checked every day. Explained in English.
Six scanners and five guards run inside WordPress. When something needs a decision, you get a plain-English note and a drafted fix, never a change made behind your back.
It finds the problem, then drafts the fix.
Watching tools email you that your site went down. Kepteo checks it every day, explains what it found in English, and leaves the fix waiting under the same approve-first rule.
Good morning. Your site is safe, but two things need a decision.
The Contact Form 7 plugin has a known flaw fixed in the latest version. I've drafted the update and taken a snapshot.
Someone tried 1,204 password guesses through XML-RPC since yesterday. I've drafted a guard that blocks it. Your contact form keeps working.
What's actually inside the plugin.
- 10page-builder adaptersGutenberg, Classic, Elementor, Divi, WPBakery, Beaver Builder, Bricks, Oxygen, Avada and SiteOrigin
- 11site health checksThe things that quietly break a site before anyone notices
- 6security scannersMalware, core file integrity, known vulnerabilities, users, login posture, headers
- 5always-on guardsLogin attempts, XML-RPC, user enumeration, security headers, comment spam
- 2minbetween instruction checksYour site asks for signed work. Nothing can push into it.
Counted from the Kepteo WordPress plugin source, version 0.7.4.
What people ask before they connect.
It can read your site's content and settings through WordPress, and apply changes you've approved. It cannot write files, cannot run arbitrary code, and cannot open configuration or password files.
Every instruction is signed with an Ed25519 key held by our server. The plugin on your site checks the signature, the timestamp and a one-time nonce, and refuses anything that doesn't match.
Yes. Deactivate the plugin and Kepteo can no longer reach your site. Your site keeps every change you approved.
Sleep easier about your website.
The first daily scan is scheduled about 20 minutes after you activate the plugin.