About SiftWP

Who runs SiftWP

Why we built this

Most WordPress security plugins run inside WordPress, using the site's own PHP, database connection and attack surface. That is convenient, but it also means one more piece of code on every page load that has to be kept updated. SiftWP connects over SSH instead and does its work from the server, so there is nothing to install in WordPress and nothing running on page views.

The other half of the frustration is what happens after a scan. Most tools stop at a report, a list for you to research and fix yourself. SiftWP sends an AI agent to investigate each finding and apply a fix when it is safe and reversible. It stops and asks you when something needs a judgment call.

What access SiftWP needs, and what it can do

• An SSH key, never your WordPress password. You import a key SiftWP generates into your hosting account. SiftWP never asks for your WordPress admin login.
• The key gives shell access to that hosting account. The agent runs commands there to read files, query the database through WP-CLI and move files. It is not limited to read-only access.
• You can end access at any time. Delete the key from your hosting panel and SiftWP can no longer connect.
• Guardrails. The agent is instructed never to delete files permanently. It quarantines them instead, and it is blocked from common destructive commands. It asks for your approval before risky changes such as deactivating a plugin or resetting an admin account, and it logs every action so you can review it.
• Server problems get a ready message. If a fix needs your host, such as an SSL or Apache issue, SiftWP drafts the exact request to send.

How your data is handled

SiftWP does not keep a copy of your site. During a scan the AI agent reads the files and database rows it needs to judge a finding, and those excerpts are processed by an AI provider to produce the analysis. The provider is Anthropic. Read our privacy policy for details.

What SiftWP does not do

• It is not a firewall and does not block traffic.
• It does not replace backups.
• It cannot promise a clean result. A scan reduces risk, and some problems need a human specialist.

Who it is for

Solo site owners who do not want to think about security every week, and agencies that manage WordPress sites for clients and want a scan-and-fix layer that adds no plugin to each site.