NUDAYOSH — How it works under the hood (technical layer)

Architecture

Three observation points, not one.

Almost every plugin lives inside WordPress. If an attacker truly gets in, the first thing they do is switch the plugin off — it goes blind right when it's needed. And the worst damage rarely happens inside WordPress; it happens underneath, on the system. We watch all three layers at once and correlate them.

Layer 1 · External

External monitor (from outside, no agent)

What anyone sees from the internet: TLS certificate and encryption, security headers, spam/malware blocklists, availability and visible changes to the home page.

// others cover this too, partially

Layer 2 · WordPress

Plugin (inside WP)

WAF, two-factor, lockout on failed attempts, integrity of WordPress's own files, anti-enumeration. Where every security plugin looks.

// the common ground of Wordfence, Sucuri, MalCare…

Layer 3 · Server / OS

Server agent (underneath WordPress)

New FTP/SSH accounts created in secret, keys in authorized_keys, hidden cron jobs, suspicious processes and modified system files. The layer where persistence really hides.

// only NUDAYOSH watches here

Active controls

What's deployed today, layer by layer.

This isn't a roadmap. It's what's already running in production.

WordPress

Plugin

›WAF — filters malicious requests before they reach PHP.
›2FA (TOTP) — standard second factor, works with any authenticator app.
›Captcha and brute-force lockout — stops credential stuffing automatically.
›Geo / IP blocking — by country or range.
›Anti-enumeration + Smart 404 — blocks probing of users and paths.
›FIM with malware scoring — file integrity with a risk score, not just "changed/not changed".

Server

Agent

›OS-level FIM — file integrity beyond WordPress's reach.
›FTP / SSH accounts — detects new accounts and credential changes on the server.
›Cron monitoring — new or hidden scheduled tasks.
›authorized_keys — SSH keys added for persistence.
›Suspicious processes — anomalous execution on the machine.
›Maintenance-file healing — restores known-good states.

External

Monitor

›TLS and encryption — expiry, weak suites, old protocols.
›Security headers — HSTS, CSP, X-Frame and friends.
›Blocklists — domain/IP reputation on known blocklists.
›Credential breaches — whether the domain's credentials are already circulating in leaks.
›Email spoofing — SPF/DKIM/DMARC review for the domain.

SaaS

Deep analysis

›Deep Scan with AI audit — deep scan with AI-assisted interpretation.
›Blocked-activity card — what the protection has stopped, in plain language.
›Correlation across the three layers — a single signal from WP + server + external.
›Bilingual panel (ES/EN) — same product, two languages.

Integrity and supply chain

A failed update never takes your site down.

The supply chain is where most of the damage happens today. That's why we sign every version and design updates so that, in the worst case, you stay on the version you already had. Never offline.

Releases signed with Ed25519

Every version of the plugin and the agent is signed. The client verifies the signature before applying anything. No valid signature, no install.

ed25519: meLpEZaLzmqk4YpkHXyb1IwVpznnj1Pd5OzwIyN01VU=

Signed auto-update channel

Updates arrive over a dedicated channel with signature verification and SHA-256 integrity, not over some arbitrary URL.

Safe degradation

If an update fails, the site stays on its current, working version. The failure never leaves the site out of service.

Technical comparison

Where each one looks. That's the real difference.

Forget language and invoicing for a moment. Technically, what sets NUDAYOSH apart is visibility underneath WordPress.

Capability	NUDAYOSHWP + agent + external	WordfenceWP plugin	Sucuriplugin + CDN	Imunify360server level
WAF at the WordPress layer	Yes	Yes	Yes	Yes
2FA / brute force / anti-enumeration	Yes	Yes	Partial	No
FIM with malware scoring	Yes	Yes	Yes	Yes
FTP/SSH accounts and authorized_keys	Yes	No	No	Partial
OS-level crons and processes	Yes	No	No	Partial
Works even if the plugin is disabled	Yes	No	Partial	Yes
Ed25519-signed releases	Yes	n/a	n/a	n/a
External monitor (TLS, headers, blocklists)	Yes	Partial	Yes	No
WP + server correlation in one panel	Yes	No	No	No

Indicative comparison from each product's public information as of June 2026. "Partial" means limited coverage, plan-dependent or only in the server edition. Third-party capabilities may vary by edition.

In development

Toward a complete security suite.

We keep extending coverage on the same three-layer architecture, without touching the core promise: explain it to you clearly and never leave you stranded.

Virtual patching Off-site scanning Edge / CDN coverage Uptime monitoring More cross-layer correlation

How NUDAYOSH works under the hood.