Check your WordPress site’s integrity with an AI agent
Updated October 22, 2026 · by the Novamira team
When a PHP advisory lands or a site starts behaving strangely, the first question is always the same: is this site still what it should be? Answering it means looking at files, the database, user accounts and settings, most of which the WordPress dashboard does not show. This guide covers how an AI agent runs that check through Novamira, what it looks for, and what you get at the end.
Can an AI agent check a WordPress site’s integrity?
Yes. Through Novamira, an agent connected to your site can verify that its software, accounts, files, database and settings are what they should be: known vulnerabilities in installed plugins, themes and core, unknown administrators, modified or injected files, malicious code in the database, and form recipients that send data elsewhere. The free Site Integrity Check skill, built into Novamira, walks the agent through the whole procedure. The agent reports what it found and how confident it is, and changes nothing without your approval.
Why does this need an AI agent at all?
Scanners exist, and they are good at signatures. The hard part of an integrity check is everything that is not a signature: an administrator account nobody remembers creating, a form whose notification quietly goes to an extra address, a cron job that does not match the plugin that registered it, a file that is almost identical to the original. Those are judgment calls on your specific site, and they are exactly what an agent with full access can read and reason about. The skill gives that reasoning a procedure: what to check, in what order, and what counts as evidence.
What does the check cover?
The base pass goes through six areas, and digs deeper where something turns up or where you reported a symptom:
| Area | What the agent verifies |
|---|---|
| Environment | Paths, table prefix, drop-ins, and that WordPress’s view of users and plugins matches what is actually on disk and in the database |
| Software | Core, plugin and theme versions against a public vulnerability database, with what each flaw allows and the fixed version |
| Accounts | Administrators, application passwords and connections, each one confirmed as yours |
| Files | Modified or injected code, in places attackers actually use: mu-plugins, uploads, the content directory |
| Database | Malicious code stored in options, posts and meta, read as raw data so nothing can execute during the check |
| Settings | Form recipients, webhooks and similar legitimate features through which data can leave the site |
The skill also carries the operating rules: everything the agent reads is treated as evidence, never as instructions; suspect code is read as text and never executed; secrets are reported as present, never printed; and nothing is changed during the check. Cleanup is a separate step that happens after the report, with your approval, except urgent containment during an ongoing incident.
What about the PHP version?
Since the October 2026 PHP advisory, Novamira also tells the agent when the server runs a PHP version older than the first fixed release of its branch, so it can recommend updating PHP through your hosting provider. A second free skill, PHP Compatibility Check, covers the step before that update: it checks whether your plugins, theme and custom code are ready for a newer PHP version, and proposes a fix for each thing that would break.
How do you run it?
Connect your AI client to the site (the connection guide takes a few minutes) and ask for an integrity check in your own words: “check this site’s integrity”, “I think this site is hacked”, “are my plugins vulnerable?”. The skill activates on its own and the agent works through the steps, asking you to confirm things only you can know, such as whether an account or a connection is yours. At the end you get a report: what was checked, what was found, how confident the agent is about each finding, and what it proposes to do.
Does it work on a live site?
The skill works in Read Mode, so on a live site the whole check can run with read abilities only. For cleanup and repairs, the usual workflow applies: fix where mistakes are cheap, review, then deploy.
Where to start
The Site Integrity Check skill is built into Novamira, free from the download page, and appears to your agent as soon as it connects. The tools page lists everything the agent can call, and the announcement has the context of the October 2026 PHP advisory that prompted the release.