WordPress · EC-CUBE
Everything is updated.
Nobody has checked
the custom code.
Updates reach WordPress and the plugins from WordPress.org. They do not reach the theme a contractor built for you or the plugin written only for your site. This service uses AI to read that code, reports what an outsider could see or change, and repairs small weaknesses after you approve each change.
What it checks
- 1The extension= custom code built for this site
No vendor inspects this part. Update notices and version scanners do not cover it. The inspection reads it and looks for pages and handlers that skip a login check or an ownership check. When it finds one, it shows you the change and waits for your approval.
- 2PHP(foundation)
Checks whether the PHP version is still supported. Replacing PHP is the hosting company's job.
- 3Core and plugins(building)
If an official fix is out, it is installed after you approve.
- 4Bundled libraries(fittings)
Third-party libraries that ship with the core. Replaced after you approve, when a fix is out.
- 5Signs of tampering(footprints)
Looks for files that should not be there.
- 6Exposed information(windows)
Closes files that should not open from outside.
- 7Weak settings(locks)
Checks settings that amount to an unlocked door.
From finding to fixing
- FindThe AI reads the custom code.
- ShowYou see the change, before and after.
- ApproveYou press the button. Until then, nothing changes.
- Fix and verifyIt takes a backup, applies the change and opens the site. If the site does not open, it restores the backup.
Platforms
WordPress
For sites with a theme built by a contractor, plugins written only for that site, or plugins that no longer receive updates.
- Free plugin, "Umiushi Lab – Find Code That Updates Don't Reach" (in review at WordPress.org): finds the themes and plugins that updates do not reach, and counts the pages and handlers that can be called from outside. It runs inside your site and sends no code or site data anywhere.
- Paid plugin, "AI Security Check & Fix for WP": reads the code of themes and plugins, including plugins closed on WordPress.org, and repairs weaknesses with your approval. Its screens are in Japanese for now.
- Compares WordPress core and plugins with the official packages and with published vulnerability records.
Both open in the admin screen of the demo site. The login is written on the page that opens.
EC-CUBE
EC-CUBE is an open-source store system used in Japan. Versions 4.2 and 4.3 are supported with a plugin.
- Free quick check: compares the store with official information and lists what is out of date
- Paid inspection and repair: reads the custom code and fixes it with the owner's approval
The EC-CUBE service and its support are in Japanese. Japanese page
What it can and cannot do
It can
- Confirm whether PHP, the core and the plugins are at a version that includes the official fixes
- Read custom code and look for pages and handlers that skip a login check or an ownership check
- Fix or block what it finds, after you approve
- Report how many pages and handlers it read, what it checked and what it did not look at
It cannot
- Say that custom code has no weakness. A human reviewer cannot say that either.
- Prevent weaknesses that nobody knows about yet
- Update PHP on the server, or rewrite large parts of custom code
The service uses AI to inspect and to propose changes, and AI makes mistakes. That is why it shows each change first and waits for your approval.
FAQ
Does the free WordPress plugin send my code anywhere?
No. It reads files on your server and stores the counts in your database. The only outside request is optional: when an administrator presses a button, it asks api.wordpress.org whether the installed WordPress.org plugins were closed or abandoned, sending only their slugs.
Does the free plugin install the paid service?
No. The free plugin works by itself and downloads nothing. The paid service will be a separate product.
The map marks a page. Is it vulnerable?
Not necessarily. The map marks pages and handlers that take outside input where no login or permission check is visible in the same file. The check may be in another file. Someone has to read the code to know.
Who runs this service?
Umiushi Lab LLC, a small software company in Tokyo. Legal notice (Japanese)
Want to hear
when it opens?
Send an email and we will write to you when orders open.