What it solves

Los ataques de inyección de enlaces maliciosos son silenciosos y destructivos. Un atacante obtiene acceso, inyecta enlaces ocultos en tu contenido, opciones y tareas programadas, y luego desaparece. Tu sitio sigue funcionando aparentemente normal, pero los motores de búsqueda lo penalizan, los visitantes son redirigidos a sitios de spam, y tu reputación se desmorona lentamente. [B] Footer Injection Shield detiene este daño antes de que se propague.

Este plugin protege tu WordPress escaneando profundamente todas las capas de persistencia donde los atacantes ocultan código malicioso: opciones, posts, páginas, archivos MU-plugins, drop-ins y archivos de tema activo. Detecta patrones de inyección de alta confianza asociados con la familia de infecciones <code>wordpress_global_licence</code> y otras variantes conocidas. Cuando encuentra una amenaza, la pone en cuarentena inmediatamente, la registra en un historial local protegido y la bloquea en el front-end como red de seguridad final. Todo sin enviar datos a servicios externos, sin comprometer la privacidad y sin ralentizar tu sitio.

Ya sea que gestiones un blog personal, un sitio de empresa pequeña o una agencia con múltiples clientes, este plugin se integra silenciosamente en tu flujo de seguridad. Los administradores ejecutan escaneos manuales bajo demanda o permiten que el plugin escanee automáticamente cada 15 minutos. Si se detectan inyecciones, puedes limpiarlas con un clic, restaurar contenido desde el historial de incidentes si es necesario, y ver exactamente qué se modificó y cuándo. El registro de seguridad local mantiene el historial completo sin registrar direcciones IP de visitantes ni parámetros de consulta, respetando la privacidad mientras documenta cada amenaza detectada.

La compatibilidad es sólida: funciona con WordPress 6.0 o posterior, requiere PHP 8.1 (un estándar moderno que la mayoría de hosts ya proporciona), y se ha probado hasta WordPress 6.8. El plugin incluye traducciones completas en inglés, portugués, español y gallego, lo que lo hace accesible para equipos en toda la región. La interfaz de administración sigue los estándares de accesibilidad de WordPress, garantizando que todos los miembros del equipo puedan navegar las configuraciones y revisar los incidentes sin barreras.

Después de la limpieza, la verdadera seguridad requiere un análisis más amplio. [B] Footer Injection Shield elimina las inyecciones detectadas, pero la reinfección casi siempre indica una cuenta de administrador comprometida, un plugin o tema vulnerable, credenciales filtradas o un archivo de servidor modificado. El plugin proporciona una línea de defensa crítica mientras completas la auditoría de seguridad más amplia: rotación de credenciales, parches de WordPress y complementos, revisión de cuentas de administrador e inspección de registros de acceso del servidor. Juntos, estos pasos cierran el agujero y evitan que el atacante regrese.

El soporte incluye documentación completa, preguntas frecuentes detalladas y actualizaciones automáticas a través de la tienda Baqueiro. Si encuentras un problema o tienes una pregunta, el equipo de Baqueiro está disponible para ayudarte. Con [B] Footer Injection Shield en su lugar, duermes tranquilo sabiendo que tu WordPress está protegido contra una de las amenazas más comunes y difíciles de detectar del panorama de seguridad actual.

Features

Deep Detection With No External Contact

Scans every WordPress persistence layer for malicious injections. No external APIs, no data sent anywhere, no third-party dependencies. Your security stays completely under your control.

Reversible Clean-up With a Complete History

Every detection is backed up before the clean-up. Restore content from the incident history if needed. You know exactly what was modified, when it was detected and what action was taken.

Automatic Protection With No Maintenance

Scans automatically every 15 minutes or on demand. Blocks injections in real time on the front end. Works quietly in the background without slowing your site down or requiring complex setup.

Global Access With Local Privacy

Complete translations into English, Portuguese, Spanish and Galician. A local security log that leaves out visitor IP addresses and query parameters. Meets privacy requirements while documenting every threat.

Dedicated Support and Automatic Updates

License activation built in with the Baqueiro store. Access to complete documentation, support by email and chat during office hours. Receive automatic updates with new detections and security improvements.

Everything it includes

Deep scan of options, posts, pages, MU-plugins, drop-ins and theme files
Detection of high-confidence malicious patterns: hidden links, link blocks in absolutely positioned containers, malicious marquee variants
Blocking of writes to options and network options known to be malicious
Automatic removal of scheduled tasks related to infections
Reversible quarantine of malicious MU-plugins and drop-ins
Reversible clean-up of links injected into stored content
Filtering of malicious fragments in the front-end HTML before caching
Integration with the Seraphinite Accelerator page cache for automatic purging
Incident history with full details of detection, clean-up and restore
Local security log without visitor data or query parameters
Support for blocked domains defined by the administrator
Complete translations into English, Portuguese, Spanish and Galician
Automatic updates through the Baqueiro store and a built-in license manager
Compatible with WordPress Multisite

Who it is for

WooCommerce Stores

Protect your online store against injections that redirect customers to spam sites or inject malicious code into product descriptions. Keep customer trust with automatic detection and clean-up.

Blogs and Content Sites

Detect hidden injections in posts and pages that damage SEO or compromise the reader experience. Clean them reversibly without losing your original content.

Corporate and SME Sites

Protect your company's online reputation against injections that affect search engine rankings and visitor trust. Meet security requirements without technical complexity.

Agencies and Multisite Managers

Manage the security of several client sites from a single dashboard. Scan automatically, record incidents and provide security reports without contacting external services.

Sites with Compliance Requirements

Comply with GDPR, CCPA and other privacy standards with local security logs that leave out visitor data. Detect and document threats without compromising user privacy.

How it works

Install and activate the plugin

Upload the b-footer-injection-shield folder to /wp-content/plugins/ or install the ZIP file through Plugins > Add New > Upload Plugin. Activate [B] Footer Injection Shield from your Plugins screen.
Run a manual security scan

Go to Settings > [B] Injection Shield. Click Run scan now to analyse every persistence layer. Review the incidents table to see what was detected and where.
Activate your license for automatic updates

Open Tools > License ([B] Footer Injection Shield). Enter your license key from the Baqueiro store. You will receive automatic updates and access to priority support.
Set up automatic protection and review regularly

Protection is turned on by default, with scans every 15 minutes. Review the incident history weekly. If injections are detected, clean them with one click and complete a broader security audit to prevent reinfection.

Why choose [B] Footer Injection Shield?

Comparison with common security alternatives

Aspect	Footer Injection Shield	Other solutions
Detection of injections in options, posts and files	Deep scan of every persistence layer	Generic plugins only scan visible content
Contact with external services	None: detection and logging are completely local	Most plugins require an external API or the cloud
Reversible quarantine with history	Full restore from the incidents table	Permanent deletion or no restore option
Real-time blocking on the front end	A final safety net that filters the HTML output	Only passive detection without active filtering
Page cache compatibility	Native integration with Seraphinite Accelerator	No specific integration with cache plugins
Privacy in the security logs	Leaves out visitor IPs and query parameters	Records the complete request data
Support and automatic updates	Built-in license manager + direct support	Dependence on the WordPress plugin repository

Before installing

PHP: 8.1+
WordPress: 6.0+
Tested up to: WordPress 6.8
Current version: 1.0.5

Documentation See the demo

Questions before you start

Does this replace a complete malware investigation?

No. [B] Footer Injection Shield blocks and fixes the link injection behaviours it can identify with high confidence. You must patch WordPress, plugins and themes; rotate hosting, database, WordPress, SFTP and SSH credentials; review administrator accounts; and inspect the server access logs. This plugin is a critical line of defence, not a substitute for a complete security audit.

Can cleaned content be restored?

Yes. Changes to posts and options are backed up in the incidents table before the clean-up. Administrators can restore supported records from the plugin settings page. Restoring a record may reintroduce the malicious fragment, so use it only after carefully reviewing the incident.

Does the plugin send data anywhere?

No. Detection, logging and quarantine are local. The logs deliberately leave out visitor IP addresses and query strings. The plugin does not contact external services, does not send personal data to third parties and does not depend on online definition updates.

Why are findings in theme files reported instead of removed automatically?

Editing an active theme automatically can break a site or destroy legitimate custom code. The plugin reports these findings for manual review while the front-end safety net blocks the output recognised as malicious. This gives you full control with no risk of accidental damage.

What happens when the plugin is deactivated?

The recurring scans stop immediately. The incident history and the settings remain. Since a standard plugin can be deactivated, use appropriate file system permissions and administrator account security alongside it as part of your layered security strategy.

Does it work with WordPress Multisite?

Yes, fully compatible. The plugin scans site and network options, MU-plugins, drop-ins and the files of the active theme on every site of the network. Each site keeps its own incident history and settings.

Which versions of WordPress and PHP are compatible?

[B] Footer Injection Shield requires WordPress 6.0 or later and PHP 8.1 or later. It has been tested up to WordPress 6.8. Most modern hosts offer PHP 8.1 or higher; if your host still provides earlier versions, contact their support for an upgrade.

How often do the automatic scans run?

By default, the plugin scans automatically every 15 minutes if protection is turned on. You can also run manual scans on demand from the plugin settings page. The interval can be configured in code if you need to adjust it.

How do I receive updates?

[B] Footer Injection Shield includes the built-in Baqueiro License Manager SDK. Activate your license in Tools > License ([B] Footer Injection Shield) to receive automatic updates and direct support from the Baqueiro store.

Does the plugin slow my site down?

No. The automatic scans run in the background at 15-minute intervals and are optimised to minimise their impact. The front-end filtering is very light and runs only on page responses. Sites with thousands of posts and options experience no noticeable slowdown.

Updates and versions

1.0.5 September 10, 2026

1.0.4 September 8, 2026

1.0.3 September 1, 2026

[B] Footer Injection Shield