Creating custom signatures

How do you implement those “custom modifications”? I hope as a WP plugin? If so, you can upload a plugin ZIP archive on the scan results page.

They are not a plugin. All of the code resides outside of the WP directories but within the public HTML directory (below it in a separate directory).

The wording of “custom signature” implies that I should be able to create one from a known source of the files I have put on the site and have the scanner compare the site to the “custom signature” to make sure nothing has been altered yet there is no documentation that I can find that explains how to create a signature.

In that context, it makes sense just to monitor the specified directory for changes. No custom signatures are needed because they are created internally during the first scan of the directory. Signatures are usually being used if you distribute a piece of software and you need to verify the integrity of it.

OK thanks Gioni. If what you say is true then what is the Custom signatures field used for on the Scanner settings page?

Having custom signatures seems to imply that I can create one for my custom code so the scanner will know what and where it is and flag it if it changes without its signature being updated.

No, the Custom signatures field has nothing to do with code signatures. I mean the plugin will scan and compare file hashes between scans. No custom signatures are needed whatsoever. If the detected changes are not made by you, you have to restore your original code because it means it was altered somehow. The results of the first scan will be used as a reference value, meaning you can’t see changes after the first scan. Only after further scans.

Thanks again for responding Gioni. If the custom signatures field has nothing to do with code signatures why does it say Specify custom PHP code signatures. One item per line. below the input field?

Perhaps the better question is, what is that field actually for? There is virtually no documentation about it that I can find.

It’s a completely different story. The plugin will be scanning files for those signatures and add them to the list of suspicious files. I agree with you, the plugin documentation should and will be improved.