[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBMK-QVtmreSi7Ug37-AIAJBRtlVfhM1OGxhFfB5kAuY":3},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":25,"download_link":26,"security_score":27,"vuln_count":28,"unpatched_count":29,"last_vuln_date":30,"fetched_at":31,"vulnerabilities":32,"developer":49,"crawl_stats":38,"alternatives":53,"analysis":153,"fingerprints":603},"bitfire","BitFire Security – Firewall, WAF, Bot\u002FSpam Blocker, Login Security","4.8.2","Cory Marsh","https:\u002F\u002Fprofiles.wordpress.org\u002Fbitslip6\u002F","\u003Ch3>Real-Time Security for WordPress\u003C\u002Fh3>\n\u003Cp>BitFire protects your website from bots, hackers, malware, and critical vulnerabilities – before they can cause damage.\u003C\u002Fp>\n\u003Cp>This plugin brings advanced security technology used by large enterprises to your WordPress site, now available in a free version. Whether you manage a business website, blog, or WooCommerce store, BitFire gives you powerful protection and visibility into your traffic.\u003C\u002Fp>\n\u003Ch3>Smarter Protection with AI\u003C\u002Fh3>\n\u003Cp>Most security plugins wait for updates to detect new threats. BitFire takes a different approach: it uses artificial intelligence and real-time request analysis to \u003Cstrong>stop zero-day attacks\u003C\u002Fstrong>, bots, and malicious users \u003Cstrong>before\u003C\u002Fstrong> they get access to your site.\u003C\u002Fp>\n\u003Cp>Our AI learns what normal traffic looks like for your site and blocks anything suspicious – without you needing to configure endless rules.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>“Unlike traditional firewalls that allow everything by default and react to known threats, BitFire only allows verified traffic – stopping new and unknown attacks instantly.”\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>Key Features\u003C\u002Fh3>\n\u003Ch4>🔐 Security Highlights (Free & Pro)\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\u003Cstrong>Stop Bots Automatically\u003C\u002Fstrong> – Block fake users, spam bots, and scanners (no captchas needed).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Malware Scanner\u003C\u002Fstrong> – Scan your site for infected or unknown files using a fast hash-based scanner.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Real-Time Traffic Monitor\u003C\u002Fstrong> – See who’s visiting your site, including IP, city, browser, request rate, and referrer.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Login Protection\u003C\u002Fstrong> – Block bots from abusing your login page, detect phishing attacks, and stop brute-force attempts.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Human \u002F Bot Detection\u003C\u002Fstrong> – BitFire can tell the difference between real users and fake browsers with 99.7% accuracy.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IP Reputation\u003C\u002Fstrong> – Block over 300,000 known malicious IPs with real-time threat intelligence.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>🚀 Built for Speed\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>BitFire logs traffic in \u003Cstrong>under 2ms per request\u003C\u002Fstrong>, thanks to a high-performance binary logging engine.\u003C\u002Fli>\n\u003Cli>Unlike bulky WAFs that rely on large rule sets, BitFire looks at the \u003Cstrong>intent\u003C\u002Fstrong> behind every request – giving you \u003Cstrong>faster speeds\u003C\u002Fstrong> and fewer false positives.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>🔍 Live Traffic Monitoring\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Track every visitor request in real time  \u003C\u002Fli>\n\u003Cli>Remove blind spots and gain confidence in your site security\u003C\u002Fli>\n\u003Cli>Filter traffic by IP, URL, response code, or user-agent  \u003C\u002Fli>\n\u003Cli>View bot fingerprints from over 3,000 known bots and 180 real browsers  \u003C\u002Fli>\n\u003Cli>See what was blocked and why\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>🛡 Runtime Protection (PRO)\u003C\u002Fh4>\n\u003Cp>BitFire includes WordPress’s first Runtime Application Self Protection (RASP) firewall.\u003C\u002Fp>\n\u003Cp>This means BitFire watches what your plugins and code are doing in real time and blocks anything suspicious – including:\u003Cbr \u002F>\n– Unauthorized file modifications (File RASP)\u003Cbr \u002F>\n– Suspicious database queries (Database RASP)\u003Cbr \u002F>\n– Unauthorized account creation or privilege escalation (Authentication RASP)\u003Cbr \u002F>\n– Dangerous outbound network requests (Network RASP)\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>“It’s like a bodyguard inside your WordPress server – watching every move and stopping threats before they execute.”\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>What’s Included in the Free Version?\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Traffic logger (current day only)\u003C\u002Fli>\n\u003Cli>Real-time bot and malware detection\u003C\u002Fli>\n\u003Cli>File scanner with fast hash matching\u003C\u002Fli>\n\u003Cli>Block plugin and theme enumeration tools\u003C\u002Fli>\n\u003Cli>Live IP and user-agent request viewer\u003C\u002Fli>\n\u003Cli>Block hacking tools like WPScan, Nmap, Nikto, etc.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>What’s in BitFire Pro?\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Web Firewall rated A+ by cloudbric with real-time updates\u003C\u002Fli>\n\u003Cli>Full Runtime Self Protection engine (File, Database, Account, and Network protection)\u003C\u002Fli>\n\u003Cli>Advanced login protection and phishing detection\u003C\u002Fli>\n\u003Cli>Malware scanner with 14 million+ clean file hashes\u003C\u002Fli>\n\u003Cli>Automatic browser fingerprinting and allowlists\u003C\u002Fli>\n\u003Cli>Auto-configured CSP and security headers (A+ rating)\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Increased traffic logging and historical view to 30 days\u003C\u002Fp>\n\u003Cp>** Independent WAF testing by Cloudbric https:\u002F\u002Flabs.cloudbric.com\u002Fwafer **\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>BitFire [PRO] – 🇦  (94%)\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>MalCare [PRO] – 🇫  (34%)\u003C\u002Fli>\n\u003Cli>WordFence [PRO] – 🇩  (41%)\u003C\u002Fli>\n\u003Cli>iThemes Security – 🇫  (2%)\u003C\u002Fli>\n\u003Cli>Ninja Firewall [PRO] – 🇩  (67%)\u003C\u002Fli>\n\u003Cli>Site Ground Security – 🇫  (2%)\u003C\u002Fli>\n\u003Cli>Shield Security [PRO] – 🇫  (2%)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Trusted by Enterprises, Now Available to You\u003C\u002Fh3>\n\u003Cp>BitFire is used by major organizations on our managed enterprise platform and developed by a veteran security architect with over 20 years of experience defending Fortune 500s and critical infrastructure.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>This free release brings our best bot detection and traffic logging features to the WordPress community – at no cost.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>Learn More\u003C\u002Fh3>\n\u003Cp>Visit \u003Ca href=\"https:\u002F\u002Fbitfire.co\" rel=\"nofollow ugc\">https:\u002F\u002Fbitfire.co\u003C\u002Fa> for:\u003Cbr \u002F>\n– Full product comparison\u003Cbr \u002F>\n– Malware removal services\u003Cbr \u002F>\n– Pro pricing\u003Cbr \u002F>\n– Support\u003C\u002Fp>\n\u003Ch3>Privacy \u002F Monitoring \u002F Data Collection\u003C\u002Fh3>\n\u003Col>\n\u003Cli>\n\u003Cp>Privacy.  We take privacy very seriously. BitFire inspects all traffic going to the webserver and takes care to filter out any potentially sensitive information by replacing it with \u003Cstrong>\u003Cem>redacted\u003C\u002Fem>\u003C\u002Fstrong>. The config.ini file includes a list of common sensitive field names under the “filtered_logging” section. You can add additional fields to filter in the config file by adding a line “filtered_logging[field_name] = true” and replacing “field_name” with the name of the desired parameter to filter.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>BitFire includes an error handler which monitors it’s operation. In the event an error is detected in the BitFire software; including during install, an alert can be sent to BitFire’s developer team. The development team monitors these errors in real time and includes fixes for any detected errors in each new release.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Malware scanner. BitFire sends tiny 64bit hashes (signatures, or fingerprints) of every file to our hash database. For instance, index.php may hash to the number: 812612388126487. The database is many gigabytes and centrally located on our servers. BitFire uses that information to determine if a file has been modified or is a known good file and sends the results back to your site. Client hashes are never stored off your server.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Log data and configuration data is stored locally on the filesystem in the wp-content\u002Fuploads\u002Fbitfire_RANDOM directory. This directory is unique and hidden from the Internet and protected by an .htaccess file. Web servers that are configured to allow directory listings will want to ensure that the file wp-content\u002Fuploads\u002Findex.php is present to prevent directory listings. The random directory name is 12 characters long and is generated on install. The directory is not accessible from the Internet and is protected by a .htaccess file.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Fol>\n","Real-time firewall that stops bots, malware, and hackers with real AI, file protection, and traffic analytics without slowing down your site",300,13786,100,7,"2025-09-21T22:57:00.000Z","6.8.5","6.1","7.4",[20,21,22,23,24],"activity-log","firewall","malware-scanner","security","waf","https:\u002F\u002Fbitfire.co\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbitfire.4.8.2.zip",99,1,0,"2025-08-01 00:00:00","2026-03-15T15:16:48.613Z",[33],{"id":34,"url_slug":35,"title":36,"description":37,"plugin_slug":4,"theme_slug":38,"affected_versions":39,"patched_in_version":40,"severity":41,"cvss_score":42,"cvss_vector":43,"vuln_type":44,"published_date":30,"updated_date":45,"references":46,"days_to_patch":48},"CVE-2025-6722","bitfire-unauthenticated-information-exposure","BitFire \u003C= 4.5 - Unauthenticated Information Exposure","The BitFire Security – Firewall, WAF, Bot\u002FSpam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_* directory that automatically gets created and stores potentially sensitive files without any access restrictions. This makes it possible for unauthenticated attackers to extract sensitive data from various files like config.ini, debug.log, and more when directory listing is enabled on the server and the ~\u002Fwp-content\u002Fplugins\u002Findex.php file is missing or ignored.",null,"\u003C=4.5","4.6","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2025-08-25 14:05:07",[47],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F72320980-733d-4fe6-9a13-39c476b77298?source=api-prod",25,{"slug":50,"display_name":7,"profile_url":8,"plugin_count":28,"total_installs":11,"avg_security_score":27,"avg_patch_time_days":48,"trust_score":51,"computed_at":52},"bitslip6",93,"2026-04-03T18:51:34.988Z",[54,70,93,112,133],{"slug":55,"name":56,"version":57,"author":58,"author_profile":59,"description":60,"short_description":61,"active_installs":29,"downloaded":62,"rating":29,"num_ratings":29,"last_updated":63,"tested_up_to":64,"requires_at_least":65,"requires_php":18,"tags":66,"homepage":68,"download_link":69,"security_score":13,"vuln_count":29,"unpatched_count":29,"last_vuln_date":38,"fetched_at":31},"atomic-edge-security","Atomic Edge Security","2.5.1","shift8","https:\u002F\u002Fprofiles.wordpress.org\u002Fshift8\u002F","\u003Cp>Atomic Edge Security connects your WordPress site to the Atomic Edge WAF\u002FCDN service, providing enterprise-grade security protection without the complexity.\u003C\u002Fp>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FHP_EiWLtuZE?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Ch4>Features\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\u003Cstrong>Two-Factor Authentication (2FA)\u003C\u002Fstrong> – Protect WordPress logins with TOTP authenticator apps (Google Authenticator, Authy, etc.)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>2FA Enforcement Policies\u003C\u002Fstrong> – Require 2FA for specific user roles with configurable grace periods\u003C\u002Fli>\n\u003Cli>\u003Cstrong>2FA Audit Logging\u003C\u002Fstrong> – Complete security audit trail for all 2FA events\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Adaptive Defense\u003C\u002Fstrong> – AI-powered threat detection that automatically identifies and blocks malicious actors\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Web Application Firewall (WAF)\u003C\u002Fstrong> – Block SQL injection, XSS, and other attacks with OWASP Core Rules\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Content Delivery Network (CDN)\u003C\u002Fstrong> – Serve static assets from global edge servers for faster page loads\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Real-time Analytics\u003C\u002Fstrong> – Monitor traffic, blocked threats, and security events in real-time\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IP Access Control\u003C\u002Fstrong> – Easily whitelist or blacklist IP addresses and CIDR ranges\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Geographic Blocking\u003C\u002Fstrong> – Block or allow access based on visitor country\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Malware Scanner\u003C\u002Fstrong> – Scan WordPress files for modifications and suspicious code patterns\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Vulnerability Scanner\u003C\u002Fstrong> – Check WordPress core, plugins, and themes for known vulnerabilities (requires Atomic Edge connection)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WAF Log Viewer\u003C\u002Fstrong> – See exactly what threats are being blocked\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WP-CLI Integration\u003C\u002Fstrong> – Run security scans from the command line\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>How It Works\u003C\u002Fh4>\n\u003Col>\n\u003Cli>Sign up for an Atomic Edge account at \u003Ca href=\"https:\u002F\u002Fatomicedge.io\" rel=\"nofollow ugc\">atomicedge.io\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Add your site to Atomic Edge and get your API key\u003C\u002Fli>\n\u003Cli>Install this plugin and enter your API key\u003C\u002Fli>\n\u003Cli>Manage your security settings directly from WordPress\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Vulnerability scanning is available when connected and uses Atomic Edge’s vulnerability data feed.\u003C\u002Fp>\n\u003Ch4>Requirements\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>PHP 7.4 or higher\u003C\u002Fli>\n\u003Cli>WordPress 5.8 or higher\u003C\u002Fli>\n\u003Cli>An Atomic Edge account (free tier available)\u003C\u002Fli>\n\u003Cli>OpenSSL PHP extension\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>External Services\u003C\u002Fh3>\n\u003Cp>This plugin connects to external services provided by Atomic Edge to deliver WAF, CDN, and security features. Below is a detailed explanation of each service, what data is transmitted, and when.\u003C\u002Fp>\n\u003Ch4>Atomic Edge API\u003C\u002Fh4>\n\u003Cp>The primary external service this plugin connects to is the Atomic Edge API at \u003Ccode>https:\u002F\u002Fdashboard.atomicedge.io\u002Fapi\u002Fv1\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>What it does:\u003C\u002Fstrong>\u003Cbr \u002F>\n* Manages your site’s Web Application Firewall (WAF) settings\u003Cbr \u002F>\n* Retrieves real-time analytics and traffic data\u003Cbr \u002F>\n* Fetches WAF security logs showing blocked threats\u003Cbr \u002F>\n* Manages IP whitelist\u002Fblacklist and geographic access controls\u003Cbr \u002F>\n* Retrieves CDN configuration and status\u003Cbr \u002F>\n* Provides vulnerability scanning data for WordPress core, plugins, and themes\u003Cbr \u002F>\n* Powers the Adaptive Defense AI-powered threat detection system\u003C\u002Fp>\n\u003Cp>\u003Cstrong>What data is sent:\u003C\u002Fstrong>\u003Cbr \u002F>\n* Your site’s API key (for authentication)\u003Cbr \u002F>\n* IP addresses you add to whitelist\u002Fblacklist\u003Cbr \u002F>\n* Country codes for geographic blocking rules\u003Cbr \u002F>\n* CDN optimization settings (asset types, minification preferences)\u003Cbr \u002F>\n* Site URL and domain information\u003Cbr \u002F>\n* Adaptive Defense settings and blocked IP information\u003C\u002Fp>\n\u003Cp>\u003Cstrong>When data is sent:\u003C\u002Fstrong>\u003Cbr \u002F>\n* When you save settings in the plugin admin pages\u003Cbr \u002F>\n* When you view analytics or WAF logs (to fetch data)\u003Cbr \u002F>\n* When you run a vulnerability scan\u003Cbr \u002F>\n* When you manage IP access control rules\u003Cbr \u002F>\n* When Adaptive Defense checks or updates threat status\u003Cbr \u002F>\n* Background sync of CDN settings (when CDN is enabled)\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Service links:\u003C\u002Fstrong>\u003Cbr \u002F>\n* Service website: \u003Ca href=\"https:\u002F\u002Fatomicedge.io\" rel=\"nofollow ugc\">https:\u002F\u002Fatomicedge.io\u003C\u002Fa>\u003Cbr \u002F>\n* Terms of Service: \u003Ca href=\"https:\u002F\u002Fatomicedge.io\u002Fterms-of-service\" rel=\"nofollow ugc\">https:\u002F\u002Fatomicedge.io\u002Fterms-of-service\u003C\u002Fa>\u003Cbr \u002F>\n* Privacy Policy: \u003Ca href=\"https:\u002F\u002Fatomicedge.io\u002Fprivacy-policy\" rel=\"nofollow ugc\">https:\u002F\u002Fatomicedge.io\u002Fprivacy-policy\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch4>Malware Signature API\u003C\u002Fh4>\n\u003Cp>The malware scanner fetches signature patterns from a public API endpoint.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>What it does:\u003C\u002Fstrong>\u003Cbr \u002F>\n* Provides up-to-date malware detection signatures\u003Cbr \u002F>\n* Allows scanning without requiring an API key\u003C\u002Fp>\n\u003Cp>\u003Cstrong>What data is sent:\u003C\u002Fstrong>\u003Cbr \u002F>\n* No personal or site-specific data is sent\u003Cbr \u002F>\n* Only a GET request to retrieve signature patterns\u003C\u002Fp>\n\u003Cp>\u003Cstrong>When data is sent:\u003C\u002Fstrong>\u003Cbr \u002F>\n* When you initiate a malware scan (if cached signatures have expired)\u003Cbr \u002F>\n* Signatures are cached locally for 24 hours\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Service links:\u003C\u002Fstrong>\u003Cbr \u002F>\n* This service is provided by Atomic Edge (same terms and privacy policy as above)\u003C\u002Fp>\n\u003Ch4>Data Storage\u003C\u002Fh4>\n\u003Cp>All API responses are cached locally using WordPress transients to minimize external requests. Malware signature data is cached for 24 hours. Analytics data is fetched fresh on each page load but displayed quickly via JavaScript pagination.\u003C\u002Fp>\n","Connect your WordPress site to Atomic Edge for enterprise-grade WAF protection, real-time analytics, and advanced security tools.",634,"2026-03-14T01:31:00.000Z","6.9.4","5.8",[67,21,22,23,24],"2fa","https:\u002F\u002Fatomicedge.io\u002Fwordpress","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fatomic-edge-security.2.5.1.zip",{"slug":71,"name":72,"version":73,"author":74,"author_profile":75,"description":76,"short_description":77,"active_installs":78,"downloaded":79,"rating":80,"num_ratings":81,"last_updated":82,"tested_up_to":64,"requires_at_least":83,"requires_php":84,"tags":85,"homepage":88,"download_link":89,"security_score":90,"vuln_count":91,"unpatched_count":29,"last_vuln_date":92,"fetched_at":31},"sg-security","Security Optimizer – The All-In-One Protection Plugin","1.5.9","SiteGround","https:\u002F\u002Fprofiles.wordpress.org\u002Fsiteground\u002F","\u003Cp>\u003Cstrong>Bulletproof your website security in a few clicks against a range of security breaches, including brute-force attacks, malware threats and bots, with our free WordPress security plugin – Security Optimizer.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Proactively monitor your site’s security to detect any suspicious activity and take immediate actions to protect your site and prevent further damage with these essential features:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Enable \u003Cstrong>2FA (Two-Factor Authentication)\u003C\u002Fstrong> for an extra layer of website security\u003C\u002Fli>\n\u003Cli>Set \u003Cstrong>Limit Login Attempts\u003C\u002Fstrong> to deter malicious login attempts and brute-force attacks\u003C\u002Fli>\n\u003Cli>Change your default login URL to \u003Cstrong>Custom Login URL\u003C\u002Fstrong> to avoid attacks\u003C\u002Fli>\n\u003Cli>Activate \u003Cstrong>Advanced XSS Protection\u003C\u002Fstrong> to fortify your website against malicious attacks\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Lock and Protect System Folders\u003C\u002Fstrong> to ensure no unauthorized or malicious scripts can be executed in your system folders\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Disable Themes & Plugins Editor\u003C\u002Fstrong> to safeguard your website from unauthorized access via the WordPress editor\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Hide WordPress Version\u003C\u002Fstrong> effortlessly, keeping it hidden from prying eyes\u003C\u002Fli>\n\u003Cli>Use \u003Cstrong>Activity Log\u003C\u002Fstrong> to monitor your site and quickly prevent malicious actions\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Post-Hack Actions\u003C\u002Fstrong> to take immediate actions and prevent further damages\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Developed by the website security experts at \u003Ca href=\"https:\u002F\u002Fwww.siteground.com\u002Fwordpress-plugins\u002Fsiteground-security\" rel=\"nofollow ugc\">SiteGround\u003C\u002Fa> and trusted by over 900,000 webmasters for its robust security shield and ease of use to safeguard WordPress applications from possible attacks on any hosting platform.\u003C\u002Fp>\n\u003Ch4>AWARDS:\u003C\u002Fh4>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.templatemonster.com\u002Fawards\u002Fwinners-2022\u002F\" rel=\"nofollow ugc\">Monster Awards 2022\u003C\u002Fa>: Best WordPress Security Plugin 🥇\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwww.templatemonster.com\u002Fawards\u002Fwinners-2021\u002F\" rel=\"nofollow ugc\">Monster Awards 2021\u003C\u002Fa>: Best WordPress Security Plugin 🥇\u003C\u002Fp>\n\u003Ch4>Plugin Video\u003C\u002Fh4>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FFOheCz7sm9A?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Ch4>Plugin Tutorial\u003C\u002Fh4>\n\u003Cp>Unveil the vast array of features and unleash the full potential of our security plugin in our \u003Ca href=\"https:\u002F\u002Fwww.siteground.com\u002Ftutorials\u002Fwordpress\u002Fsg-security\u002F\" rel=\"nofollow ugc\">Security Optimizer Tutorial\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>SITE PROTECTION FEATURES\u003C\u002Fh3>\n\u003Cp>Safeguard your WordPress application using our powerful site security toolset. Our comprehensive features are specifically designed to strengthen your website’s defenses against malware, exploits, and various malicious activities. With these tools at your disposal, you can ensure the utmost bot, malware and brute force protection for your website:\u003C\u002Fp>\n\u003Ch4>Lock and Protect System Folders\u003C\u002Fh4>\n\u003Cp>Ensure the maximum security for your application’s system folders by preventing the execution of any unauthorized or malicious scripts. The Lock and Protect System Folders feature acts as a powerful shield against potential threats.\u003C\u002Fp>\n\u003Ch4>Hide WordPress Version\u003C\u002Fh4>\n\u003Cp>Protect your website from mass attacks by hiding the WordPress version, which helps to mitigate version-specific vulnerabilities.\u003C\u002Fp>\n\u003Ch4>Disable Themes & Plugins Editor\u003C\u002Fh4>\n\u003Cp>Enhance the security of your WordPress admin area by disabling the Themes & Plugins Editor, preventing potential coding errors and unauthorized access through the editor.\u003C\u002Fp>\n\u003Ch4>Disable XML-RPC\u003C\u002Fh4>\n\u003Cp>Mitigate potential security risks by disabling the XML-RPC protocol, which has been exploited in various attacks. Please note that disabling XML-RPC will restrict WordPress from communicating with third-party systems. We recommend enabling this feature unless you have a specific need for it.\u003C\u002Fp>\n\u003Ch4>Disable RSS and ATOM Feeds\u003C\u002Fh4>\n\u003Cp>Prevent content scraping and specific attacks on your site by disabling RSS and ATOM feeds. Unless you have readers accessing your site via RSS readers, it is recommended to keep this feature enabled.\u003C\u002Fp>\n\u003Ch4>Advanced XSS Protection\u003C\u002Fh4>\n\u003Cp>Add an extra layer of website security against cross-site scripting (XSS) attacks by enabling Advanced XSS Protection, bolstering the overall security of your website.\u003C\u002Fp>\n\u003Ch4>Delete Default Readme.html\u003C\u002Fh4>\n\u003Cp>Eliminate potential vulnerabilities by deleting the default readme.txt file, which contains information about your website. By removing this file, you reduce the risk of your site being listed in vulnerable sites targeted by hackers.\u003C\u002Fp>\n\u003Ch3>Login Security\u003C\u002Fh3>\n\u003Ch4>Custom Login Url\u003C\u002Fh4>\n\u003Cp>Personalize your login URL to thwart potential attacks and create a strong entry point. Bid farewell to the default login URL and embrace a bespoke path of your choosing. Additionally, you have the freedom to modify the default sign-up URL as well.\u003C\u002Fp>\n\u003Ch4>Login Access\u003C\u002Fh4>\n\u003Cp>Restrict login page access to specific IP addresses or IP ranges, effectively thwarting malicious login attempts and deterring brute force attacks.\u003C\u002Fp>\n\u003Ch4>2FA (Two-Factor Authentication)\u003C\u002Fh4>\n\u003Cp>Immerse your website in an impenetrable shield of security with 2FA. This formidable feature demands that all admin users furnish a unique token, generated exclusively through the Google Authentication application, during the login process.\u003C\u002Fp>\n\u003Ch4>Disable Common Usernames\u003C\u002Fh4>\n\u003Cp>Don’t fall victim to predictable security breaches! The use of common usernames, such as ‘admin,’ poses a significant threat to the integrity of your website. Activate this option to disable the creation of common usernames. If any weak usernames already exist, we’ll prompt you to provide new, stronger alternatives.\u003C\u002Fp>\n\u003Ch4>Limit Login Attempts\u003C\u002Fh4>\n\u003Cp>Maintain control over unauthorized access attempts with Limit Login Attempts. Set a specific threshold for the number of login failures users can endure before consequences arise. After reaching the limit, the IP address associated with the unsuccessful login attempts will be blocked for one hour. Persistent failures will result in longer restrictions, starting with 24 hours and escalating to a week.\u003C\u002Fp>\n\u003Ch3>ACTIVITY MONITORING\u003C\u002Fh3>\n\u003Cp>Monitor your website and login page for unauthorized visitors and brute force attempts to prevent malicious actions\u003C\u002Fp>\n\u003Ch4>Activity Log\u003C\u002Fh4>\n\u003Cp>The Activity Log page provides you with a comprehensive view of the activities performed by registered, unknown, and blocked visitors. It allows you to closely monitor any suspicious behavior and take appropriate actions in case of a compromised user, plugin, or hacking attempt. You can leverage the quick tools available to swiftly block future attempts.\u003C\u002Fp>\n\u003Ch4>Weekly Security Reports\u003C\u002Fh4>\n\u003Cp>Receive a weekly traffic summary for your website directly to your inbox. This \u003Cstrong>Weekly Security Report\u003C\u002Fstrong> compiles data on both bot and human traffic, along with details about blocked login and visit attempts to proactively monitor traffic and promptly identify suspicious activity.\u003C\u002Fp>\n\u003Ch3>POST-HACK ACTIONS\u003C\u002Fh3>\n\u003Cp>Take immediate measures to protect your website if you suspect a compromise and prevent further damage. Here, you’ll find convenient solutions to address the situation effectively:\u003C\u002Fp>\n\u003Ch4>Reinstall All Free Plugins\u003C\u002Fh4>\n\u003Cp>In the event of a hack, utilizing the Reinstall All Free Plugins feature can help mitigate potential harm. This action reinstalls all of your free plugins, reducing the likelihood of additional exploits or the reuse of malicious code.\u003C\u002Fp>\n\u003Ch4>Log Out All Users\u003C\u002Fh4>\n\u003Cp>To prevent any further unauthorized activities by users or attackers, you can choose to log out all users instantly using the Log Out All Users feature.\u003C\u002Fp>\n\u003Ch4>Force Password Reset\u003C\u002Fh4>\n\u003Cp>By enforcing a password reset, you can ensure that all users are prompted to change their passwords during their next login. This not only strengthens the security of their accounts but also immediately logs out all currently logged-in users.\u003C\u002Fp>\n\u003Ch3>Requirements\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>WordPress 4.7\u003C\u002Fli>\n\u003Cli>PHP 7.0\u003C\u002Fli>\n\u003Cli>Working .htaccess file\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Data Collection\u003C\u002Fh3>\n\u003Cp>Collection of technical data is optional and is \u003Ca href=\"https:\u002F\u002Fwww.siteground.com\u002Fkb\u002Fwhat-information-wp-plugins-collect\" rel=\"nofollow ugc\">listed here\u003C\u002Fa>. This data is collected only for technical analysis, improvements and the possibility to contact the plugin user in case urgent issues need to be fixed (for example a critical security release that needs to be communicated to site owners). The plugin user can manage their preferences within the WP admin to control the collection of technical data. We advise opting in for this data collection, as it can enhance the plugin’s performance. You may find more information on data collection in our \u003Ca href=\"https:\u002F\u002Fwww.siteground.com\u002Fviewtos\u002Fsiteground_plugins_privacy_notice\" rel=\"nofollow ugc\">Plugins Privacy Notice\u003C\u002Fa>.\u003C\u002Fp>\n","Secure your WordPress site from brute-force attacks, threats, malware, and bots. Free to use and easy to set up.",1000000,31890492,90,153,"2026-01-15T09:21:00.000Z","4.7","7.0",[21,86,22,23,87],"login","web-application-firewall","https:\u002F\u002Fsiteground.com","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsg-security.1.5.9.zip",86,5,"2025-11-30 00:00:00",{"slug":94,"name":95,"version":96,"author":97,"author_profile":98,"description":99,"short_description":100,"active_installs":101,"downloaded":102,"rating":90,"num_ratings":103,"last_updated":104,"tested_up_to":64,"requires_at_least":105,"requires_php":84,"tags":106,"homepage":110,"download_link":111,"security_score":13,"vuln_count":29,"unpatched_count":29,"last_vuln_date":38,"fetched_at":31},"malcare-security","MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall","6.36","malcare","https:\u002F\u002Fprofiles.wordpress.org\u002Fmalcare\u002F","\u003Ch3>MALCARE SECURITY SERVICES\u003C\u002Fh3>\n\u003Cp>Security Plugin For WordPress Websites\u003Cbr \u002F>\n★★★★★\u003C\u002Fp>\n\u003Cp>A WordPress security plugin ensures that your website remains completely safe and secure, always. We created \u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002F\" rel=\"nofollow ugc\">MalCare Security Plugin\u003C\u002Fa> to help website owners worry less about their site security, achieve peace of mind and focus all their energies on growing their business or website.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Why you need MalCare Security?\u003C\u002Fstrong>\u003Cbr \u002F>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002Fj3h0JF0we4o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Difference Between MalCare Free vs Premium\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002F4ja5ix9WDCo?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Cp>\u003Cstrong>Why MalCare is best WordPress security plugin?\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002Fvt-0TrMV-TQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Cp>\u003Cstrong>MalCare in 1 Minute – Overview\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FH1XRntW_FeE?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\u003Cbr \u002F>\n\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Important Links: \u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Ffeatures\u002F\" rel=\"nofollow ugc\">Security Features\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002F\" rel=\"nofollow ugc\">Why Choose MalCare?\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Ftop-wordpress-security-plugins-compared\u002F\" rel=\"nofollow ugc\">Comparisons\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fmalcare-free-premium\u002F\" rel=\"nofollow ugc\">Free vs Paid\u003C\u002Fa>\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>MalCare is the \u003Cstrong>fastest\u003C\u002Fstrong> malware detection and removal plugin loved by thousands of developers and agencies. With an industry-first \u003Cstrong>automatic one-click malware removal\u003C\u002Fstrong>, your WordPress website is clean before Google blacklists it or your web host takes it down. MalCare has been developed from the ground up after \u003Cstrong>analyzing over 240,000 websites over 2.5+ years\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>Its \u003Cstrong>intelligent scanning methodology\u003C\u002Fstrong> will \u003Cstrong>never slow down your WordPress site\u003C\u002Fstrong> and \u003Cstrong>accurately identifies\u003C\u002Fstrong> the most complex malware that typically goes undetected in other popular WordPress security plugins.\u003C\u002Fp>\n\u003Cp>The \u003Cstrong>one-click malware cleaner\u003C\u002Fstrong> offers unlimited automated cleanups while the inbuilt \u003Cstrong>powerful cloud-based firewall\u003C\u002Fstrong> ensures round-the-clock website protection against spam attacks. Moreover, you can \u003Cstrong>block countries\u003C\u002Fstrong> to mitigate hack attacks.\u003C\u002Fp>\n\u003Cp>MalCare comes integrated with a \u003Cstrong>complete website management\u003C\u002Fstrong> module that ensures better WP security and site management to your websites from a single dashboard.\u003C\u002Fp>\n\u003Cp>The WP security plugin \u003Cstrong>notifies you if the WordPress site goes down\u003C\u002Fstrong> so that you can handle the situation before you start losing visitors. Performance Check enables WordPress users to keep an eye on their \u003Cstrong>loading speed\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>MalCare offers a premium \u003Cstrong>White-Label\u003C\u002Fstrong> solution that lets agencies provide better website security to their clients without risking their business. And enables users to \u003Cstrong>generate beautiful reports\u003C\u002Fstrong> for their clients.\u003C\u002Fp>\n\u003Ch3>Why Choose MalCare WordPress Security Plugin?\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\n\u003Ch4>WordPress Malware Scanner\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Cloud Based Deep malware scanner\u003C\u002Fli>\n\u003Cli>Doesn’t Slow down your WordPress site\u003C\u002Fli>\n\u003Cli>Detects malware BEFORE it’s too late\u003C\u002Fli>\n\u003Cli>NO impact on your website\u003C\u002Fli>\n\u003Cli>Finds ALL types of malware, even new & complex ones\u003C\u002Fli>\n\u003Cli>Get Alerts about Security Risks with our WordPress Vulnerability Scanner\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>WordPress Malware Removal\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>View hacked file details\u003C\u002Fli>\n\u003Cli>Cleans your site INSTANTLY, in less than 60 Secs\u003C\u002Fli>\n\u003Cli>Removes ALL traces of malware\u003C\u002Fli>\n\u003Cli>UNLIMITED hack cleanups\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>WordPress Website Protection\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Blocks hacker BOTS from attacking login page\u003C\u002Fli>\n\u003Cli>Identifies & blocks MALICIOUS traffic\u003C\u002Fli>\n\u003Cli>Enables users to HARDEN their WordPress sites\u003C\u002Fli>\n\u003Cli>Enables users to block ENTIRE countries\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Easy to Use\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Set up an account in 60 secs\u003C\u002Fli>\n\u003Cli>Configure security once & never look at it again\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Support\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Agile & responsive customer support\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Why Is MalCare Such a Game-Changer?\u003C\u002Fh3>\n\u003Cp>MalCare offers unparalleled security services. Some services are free and others are paid.\u003C\u002Fp>\n\u003Ch4>MalCare’s FREE Services –\u003C\u002Fh4>\n\u003Col>\n\u003Cli>\n\u003Ch4>Cloud-Based Malware Scanning (Free)\u003C\u002Fh4>\n\u003Cp>MalCare’s Cloud-based Scanning ensures no impact on your website ever. Moreover, it detects Complex Malware missed by other popular security plugins for WordPress.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Web-Application WordPress Firewall (Free)\u003C\u002Fh4>\n\u003Cp>Get Real-Time Protection for your WordPress website against the latest security threats with MalCare’s Smart Firewall. Block hackers & bots before they harm your site.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>CAPTCHA-Based Login Page Protection (Free)\u003C\u002Fh4>\n\u003Cp>Automatically prevent brute force attacks with MalCare’s Smart Captcha-Based Login Page Protection. Round-the-clock protection against malicious traffic.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch4>MalCare’s PAID Services –\u003C\u002Fh4>\n\u003Col>\n\u003Cli>\n\u003Ch4>Viewing Hacked Files (Paid)\u003C\u002Fh4>\n\u003Cp>View the infected files present on your WordPress website. Learn which themes or plugins or files or folders were infected by hackers.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Industry-First Instant Malware Removal (Paid)\u003C\u002Fh4>\n\u003Cp>Clean your hacked site instantly in less than 60 secs with MalCare’s 1-Click Cleaner. Clean your website before Google blacklists it or your web host takes it down.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>WordPress Recommended Website Hardening (Paid)\u003C\u002Fh4>\n\u003Cp>Easily configure WordPress recommended best security practices with just 1-Click from right within MalCare’s dashboard. No technical knowledge needed.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Geo-blocking (Paid)\u003C\u002Fh4>\n\u003Cp>Restrict access to users based on their geographical location. Easily block all visitors from certain countries to mitigate the risk of being hacked.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Uptime Monitoring (Paid)\u003C\u002Fh4>\n\u003Cp>With MalCare’s Uptime Monitoring keep a steady eye on your WordPress site. It ensures that you are not oblivious to website downtime.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch3>Common Hack Attacks Prevented By MalCare\u003C\u002Fh3>\n\u003Cp>MalCare protects websites against all common hack attacks which includes:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fwordpress-brute-force\u002F\" rel=\"nofollow ugc\">Brute force attacks\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fjapanese-keyword-hack\u002F\" rel=\"nofollow ugc\">Japanese keyword hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fwordpress-hacked-redirect\u002F\" rel=\"nofollow ugc\">WordPress redirect hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fwhat-is-pharma-hack-how-to-clean-it\u002F\" rel=\"nofollow ugc\">Pharma hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fseo-spam\u002F\" rel=\"nofollow ugc\">SEO spam hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fwordpress-theme-hacked\u002F\" rel=\"nofollow ugc\">WordPress theme hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fspam-link-injection-wordpress\u002F\" rel=\"nofollow ugc\">WordPress spam link injections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Frevslider-exploit\u002F\" rel=\"nofollow ugc\">Revslider hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fwordpress-timthumb\u002F\" rel=\"nofollow ugc\">TimThumb hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fadminer-php-hack\u002F\" rel=\"nofollow ugc\">Adminer.php hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fcross-site-scripting-xss-attacks-what-how-prevent-them\u002F\" rel=\"nofollow ugc\">XSS or cross-site scripting hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fhow-to-detect-and-remove-wp-vcd-malware-a-step-by-step-guide-and-a-bonus-plugin\u002F\" rel=\"nofollow ugc\">WP-VCD hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fpreventing-sql-injections\u002F\" rel=\"nofollow ugc\">SQL injection hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fwordpress-malvertising\u002F\" rel=\"nofollow ugc\">WordPress malvertising hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fremove-google-blacklist-warning\u002F\" rel=\"nofollow ugc\">Google Blacklist hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fgoogle-adwords-account-suspended\u002F\" rel=\"nofollow ugc\">Google Adwords hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fsession-hijacking-cookie-stealing\u002F\" rel=\"nofollow ugc\">Cookie stealing & session hijacking\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fhow-to-remove-phishing\u002F\" rel=\"nofollow ugc\">WordPress phishing hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Ffavicon-ico-virus-wordpress\u002F\" rel=\"nofollow ugc\">Favicon.ico virus hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fremoving-wp-feed-php-malware\u002F\" rel=\"nofollow ugc\">WP-Feed.php & WP-Tmp.php\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fhow-to-scan-malware-and-backdoors-of-your-wordpress-site\u002F\" rel=\"nofollow ugc\">Backdoor hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fcoinhive-malware-wordpress\u002F\" rel=\"nofollow ugc\">Coinhive hack\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Fblog\u002Fdeface-wordpress\u002F\" rel=\"nofollow ugc\">WordPress deface hack\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>MalCare Free vs. MalCare Premium\u003C\u002Fh3>\n\u003Col>\n\u003Cli>\n\u003Ch4>Cloud Based Malware Scanner (FREE)\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Cloud-Based Malware Scanning \u003Cstrong>(Free)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Deep Malware Scanning – Files & Database \u003Cstrong>(Free)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Website Firewall (FREE)\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Web Application Firewall \u003Cstrong>(Free)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Plugin Based Firewall \u003Cstrong>(Free)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Rules update every 7 days \u003Cstrong>(Free)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Login Page Protection \u003Cstrong>(Free)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Bot Protection \u003Cstrong>(Free)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Rules update every 5 mins \u003Cstrong>(Paid)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Geo-Blocking \u003Cstrong>(Paid)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Website Hardening \u003Cstrong>(Paid)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Instant Malware Removal (PAID)\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>View Malware Insights \u003Cstrong>(Paid)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Instant One-Click Clean Ups \u003Cstrong>(Paid)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Automatic Clean-Ups \u003Cstrong>(Paid)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Unlimited Clean-Ups \u003Cstrong>(Paid)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Personalized Customer Support (Paid)\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Support on WordPress forum \u003Cstrong>(Free)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Support via email and chat \u003Cstrong>(Paid)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch3>Who Can Benefit From MalCare?\u003C\u002Fh3>\n\u003Cp>MalCare is perfect for:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Any WordPress Websites\u003C\u002Fli>\n\u003Cli>Small Business Websites\u003C\u002Fli>\n\u003Cli>Developer Websites\u003C\u002Fli>\n\u003Cli>Web Designing Websites\u003C\u002Fli>\n\u003Cli>eCommerce Stores\u003C\u002Fli>\n\u003Cli>Niche Sites\u003C\u002Fli>\n\u003Cli>Artists & Photographers Sites\u003C\u002Fli>\n\u003Cli>Amateur & Professional Bloggers\u003C\u002Fli>\n\u003Cli>Local Business Sites\u003C\u002Fli>\n\u003Cli>Website for Startups\u003C\u002Fli>\n\u003Cli>Websites Selling Courses\u003C\u002Fli>\n\u003Cli>Influencer Sites\u003C\u002Fli>\n\u003Cli>Web Hosting Companies\u003C\u002Fli>\n\u003Cli>Website Maintenance Services or Agencies\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Detailed Setup Step-by-Step Tutorials\u003C\u002Fh3>\n\u003Cp>This WordPress security plugin works in tandem with the \u003Ca href=\"https:\u002F\u002Fwww.malcare.com\" rel=\"nofollow ugc\">MalCare\u003C\u002Fa> servers. MalCare servers do all the heavy processing and will alert you if your site has any security issues.\u003C\u002Fp>\n\u003Cp>Hence a MalCare account is needed to use the plugin. This account can also be used by our other products including \u003Ca href=\"https:\u002F\u002Fblogvault.net\" rel=\"nofollow ugc\">BlogVault\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fmalcare.freshdesk.com\u002Fsupport\u002Fsolutions\u002Farticles\u002F35000055512-how-do-i-set-up-a-malcare-account-\" rel=\"nofollow ugc\">How to Set Up a MalCare Account?\u003C\u002Fa> (Help Doc)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=v8L_DZllk7k&list=\" rel=\"nofollow ugc\">How to Set Up a MalCare Account?\u003C\u002Fa> (Video)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>MalCare Full Security Features List\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\n\u003Ch4>Cloud Based Malware Scanner\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Daily Scan Frequency\u003C\u002Fli>\n\u003Cli>On-demand Site Scans\u003C\u002Fli>\n\u003Cli>Scan Non-WP Files\u003C\u002Fli>\n\u003Cli>Does not slow down your website ever\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Instant Malware Removal\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>View Hacked Files details\u003C\u002Fli>\n\u003Cli>Instant Automatic Malware Removal\u003C\u002Fli>\n\u003Cli>Removal of Unknown & New Malware\u003C\u002Fli>\n\u003Cli>Unlimited Malware Removal\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Intelligent Malware Protection\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Web Application Firewall\u003C\u002Fli>\n\u003Cli>IP Whitelisting\u003C\u002Fli>\n\u003Cli>CAPTCHA-based Login Page Protection\u003C\u002Fli>\n\u003Cli>Traffic Logs\u003C\u002Fli>\n\u003Cli>Login Logs\u003C\u002Fli>\n\u003Cli>Geo-Blocking\u003C\u002Fli>\n\u003Cli>Alerts for Suspicious Logins\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Website Hardening\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Block PHP Execution in Untrusted Folders\u003C\u002Fli>\n\u003Cli>Disable Files Editor\u003C\u002Fli>\n\u003Cli>Block Plugin or Theme Installation\u003C\u002Fli>\n\u003Cli>Change Security Keys\u003C\u002Fli>\n\u003Cli>Reset All Passwords\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Complete Website Management\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Centralized Dashboard\u003C\u002Fli>\n\u003Cli>Plugins & Themes Management & Update\u003C\u002Fli>\n\u003Cli>User Management\u003C\u002Fli>\n\u003Cli>Team Management\u003C\u002Fli>\n\u003Cli>Client Management\u003C\u002Fli>\n\u003Cli>Generate & Schedule Reports\u003C\u002Fli>\n\u003Cli>White-Labeling Solution\u003C\u002Fli>\n\u003Cli>Uptime Monitoring\u003C\u002Fli>\n\u003Cli>Site Speed Monitoring\u003C\u002Fli>\n\u003Cli>Blacklist Alarm\u003C\u002Fli>\n\u003Cli>Slack Integration\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Ch4>Support\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Email\u003C\u002Fli>\n\u003Cli>Chat\u003C\u002Fli>\n\u003Cli>Social Media\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Fans Are Raving About Us\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fvisualcomposer.com\u002Fblog\u002Fmalcare-review\u002F\" rel=\"nofollow ugc\">MalCare Review on VisualComposer\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.elegantthemes.com\u002Fblog\u002Fresources\u002Fmalcare-security-and-firewall-the-right-security-plugin-for-your-site\" rel=\"nofollow ugc\">MalCare Review on ElegantThemes\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fblog.weglot.com\u002Fideal-security-solution-malcare-review\u002F\" rel=\"nofollow ugc\">MalCare Review on Weglot\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.wpwhitesecurity.com\u002Fmalcare-wordpress-site-security-service-reviewed\u002F\" rel=\"nofollow ugc\">MalCare Review on WPWhiteSecurity\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=2yNIb4Pc_ig\" rel=\"nofollow ugc\">MalCare Reviews by WordPress Influencer Adam Preiser (Plus Real Malware Removal Demo)\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Connect With Our Team of Security Experts\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.facebook.com\u002Fgroups\u002FWordPressForWebCreators\u002F\" rel=\"nofollow ugc\">Join MalCare’s Facebook Community\u003C\u002Fa> – The purpose of the group is to enable Web Creators to gain valuable insights and help from community members which will be valuable to their business. So, if you are a WordPress user & want to keep up with the latest industry news and get help for your business, \u003Ca href=\"https:\u002F\u002Fwww.facebook.com\u002Fgroups\u002FWordPressForWebCreators\u002F\" rel=\"nofollow ugc\">join us\u003C\u002Fa>!\u003C\u002Fp>\n\u003Ch3>Don’t Know Where to Getting Started? Start From Here –\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fmalcare.freshdesk.com\u002Fsupport\u002Fsolutions\u002Farticles\u002F35000055512-how-do-i-set-up-a-malcare-account-\" rel=\"nofollow ugc\">How to Setup MalCare Account?\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.facebook.com\u002Fgroups\u002FWordPressForWebCreators\u002F\" rel=\"nofollow ugc\">Join MalCare Facebook Group MalCare\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.youtube.com\u002Fchannel\u002FUC5oQAXXvndQJuyVrWgMRWqg\" rel=\"nofollow ugc\">MalCare Tutorial Videos\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fmalcare.freshdesk.com\u002Fsupport\u002Fhome\" rel=\"nofollow ugc\">User Help Documentations\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.malcare.com\u002Ffaq\u002F\" rel=\"nofollow ugc\">Frequently Asked Questions\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fmalcare.freshdesk.com\u002Fsupport\u002Ftickets\u002Fnew\" rel=\"nofollow ugc\">Support for MalCare Users\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>MalCare vs. Others\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.codeinwp.com\u002Fblog\u002Fsucuri-vs-wordfence-vs-malcare\u002F\" rel=\"nofollow ugc\">MalCare vs Sucuri vs Wordfence by CodeinWP\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmayor.com\u002Fmalcare-sucuri-wordfence-sitelock-ithemes-security-comparison\u002F\" rel=\"nofollow ugc\">MalCare vs Sucuri vs Wordfence vs SiteLock vs iThemes Security by WPMayor\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n","Get Bulletproof Security for your WordPress site. WordPress security plugin packed with comprehensive Firewall, malware scanner, cleaner & more.",200000,17387894,519,"2026-01-29T13:26:00.000Z","4.0",[21,107,22,108,109],"malware-removal","vulnerabilities","wordpress-security","https:\u002F\u002Fwww.malcare.com","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmalcare-security.6.36.zip",{"slug":113,"name":114,"version":115,"author":116,"author_profile":117,"description":118,"short_description":119,"active_installs":120,"downloaded":121,"rating":122,"num_ratings":123,"last_updated":124,"tested_up_to":64,"requires_at_least":125,"requires_php":126,"tags":127,"homepage":130,"download_link":131,"security_score":122,"vuln_count":14,"unpatched_count":29,"last_vuln_date":132,"fetched_at":31},"defender-security","Defender Security – Malware Scanner, Login Security & Firewall","5.10.0","WPMU DEV - Your All-in-One WordPress Platform","https:\u002F\u002Fprofiles.wordpress.org\u002Fwpmudev\u002F","\u003Cp>\u003Cstrong>Defender adds the best in WordPress plugin security to your website with just a few clicks, including malware scanner, firewall, password protection, and login security features. Stop brute force login attacks, weak password usage, SQL injections, cross-site scripting (XSS), and other WordPress security vulnerabilities and hacks with Defender’s malware scanner, providing antivirus scans, IP blocking, firewall, activity log, security log, and two-factor authentication (2FA) login security.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>No more complex security settings, Defender’s malware scanner, firewall, and login security features add all the hardening and security you need.\u003C\u002Fp>\n\u003Cp>Defender is brought to you by the WordPress speed specialists that created Smush image optimization, now active on more than +1 million websites.\u003C\u002Fp>\n\u003Cp>Plus, connect for free to WPMU DEV’s AntiBot Global Firewall to block harmful IPs with data from over 750,000 sites.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Enjoy complete site protection from malware, vulnerabilities, bot attacks, and session hijacking from the start with \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fproject\u002Fwp-defender\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro\" rel=\"nofollow ugc\">Defender Pro\u003C\u002Fa>.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Level up security immediately with exclusive Pro features like scheduled malware scanning, Safe Repair for suspicious files, and known WordPress vulnerability detection. \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fproject\u002Fwp-defender\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro\" rel=\"nofollow ugc\">Learn more about Pro\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>Security Recommendations\u003C\u002Fh3>\n\u003Cp>Defender’s one-click security hardening recommendations instantly adds layers of protection and security to your site.\u003C\u002Fp>\n\u003Ch3>Enhance Security and Block Hackers At Every Level:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Malware Scanner\u003C\u002Fstrong> – Scan WordPress core files for modifications and unexpected changes which may be caused by malware. Scan for malware and tighten up the security of your files.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Outdated & Removed Plugins\u003C\u002Fstrong> – Scans for plugins removed from WordPress.org or not updated in 2+ years.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>AntiBot Global Firewall\u003C\u002Fstrong> – Connect for free to WPMU DEV to block harmful IPs with data from over 750,000 sites.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WordPress Security Firewall\u003C\u002Fstrong> – Block or allowlist IPs, implement IP blocking, and Geo IP blocking, user agent banning and protect against brute force attacks.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Two-Factor Authentication (2FA)\u003C\u002Fstrong> – Easily set up better security with 2FA to prevent most login attacks such as brute force, App verification, backup codes, lost device email, WooCommerce 2FA, and Web Authentication.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Login Masking\u003C\u002Fstrong> – Change the location of WordPress’s default login area to improve login security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Login Lockout\u003C\u002Fstrong> – Failed login attempts lockout for even more security assurance.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User Agent Banning\u003C\u002Fstrong> – Fortify security by blocking bad bots and user agents from accessing your site.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Security Headers\u003C\u002Fstrong> – Add an extra layer of defense security and protect against common attacks like: XSS, code injection, and more.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>404 Detection Security\u003C\u002Fstrong> – Automated block of bot IPs.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Security Configs\u003C\u002Fstrong> – Create your ideal Defender security plugin settings and export \u002F import saved configs to any other site.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Geolocation IP Lockout Security\u003C\u002Fstrong> – Block users based on location and country (IP blocking).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Disable Trackbacks And Pingbacks\u003C\u002Fstrong> – Disable these notifications to enhance spam protection and site security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Core And Server Update Security Recommendations\u003C\u002Fstrong> – Stay on top of your system security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Antivirus Scan\u003C\u002Fstrong> – Scan for active security threats, viruses, and other malware.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Disable File Editor\u003C\u002Fstrong> – If they get in, they won’t get far.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Hide Error Reporting\u003C\u002Fstrong> – Hide code errors on the frontend so hackers can’t exploit site security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Update Security Keys\u003C\u002Fstrong> – Update old WordPress security keys to be more encrypted and provide better security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Prevent Information Disclosure\u003C\u002Fstrong> – Improve server security and protect sensitive files by locking down specific file types.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Prevent PHP Execution\u003C\u002Fstrong> – Defender bolsters security by automatically preventing any PHP code from being executed.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Bulk Apply Security Recommendations\u003C\u002Fstrong> – Apply multiple recommended security improvements at once for quicker site hardening.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Google reCAPTCHA Security\u003C\u002Fstrong> – Easy to add, stop fraud and abuse – including BuddyPress and WooCommerce.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Cloudflare Turnstile\u003C\u002Fstrong> – Captcha-free protection from spam and automated attacks, including BuddyPress and WooCommerce support.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Pwned Password Check\u003C\u002Fstrong> – Increase security by protecting against compromised passwords.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Force Password Reset\u003C\u002Fstrong> – Force users with selected roles to reset passwords.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Force Strong Passwords\u003C\u002Fstrong> – Ensure users create secure credentials by enforcing robust password requirements.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User Agent Blocklist Presets\u003C\u002Fstrong> – Easily block unwanted bots and scripts using curated user agent presets.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Known Vulnerability & Suspicious Code Scan (Pro Only)\u003C\u002Fstrong> – Scan WordPress core, themes, and plugins for vulnerabilities and harmful code.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Malicious Bot Detector (Pro Only)\u003C\u002Fstrong> – Block malicious bots with layered defenses, including traps for bots that ignore robots.txt and checks for fake crawlers posing as search engines.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Google Blocklist Monitoring (Pro Only)\u003C\u002Fstrong> – Get instant alerts if your site is flagged by Google.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Session Protection (Pro Only)\u003C\u002Fstrong> – Stop session hijacking and prevent unauthorized account access.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Safe Repair For Suspicious Files (Pro Only)\u003C\u002Fstrong> – Restore or replace compromised files safely with a single click.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Automated Reports (Pro Only)\u003C\u002Fstrong> – Receive scheduled security reports straight to your inbox.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Learn The Ropes With These Hands-On Defender Security Plugin Tutorials\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fblog\u002Fhow-to-get-the-most-out-of-defender-security\u002F\" rel=\"nofollow ugc\">How to Get the Most Out of Defender Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fblog\u002Fstop-hackers-with-defender-wordpress-security-plugin\u002F\" rel=\"nofollow ugc\">How to Stop Hackers in Their Tracks with Defender Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fblog\u002Fdelete-suspicious-code-defender\u002F\" rel=\"nofollow ugc\">Find Out if You’re Hacked: How to Find and Delete Suspicious Code with Defender Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fblog\u002Fdefender-ip-address-lockout-firewall\u002F\" rel=\"nofollow ugc\">How to Create a Powerful and Secure Customized Firewall with Defender Security\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>WordPress Security Scans\u003C\u002Fh3>\n\u003Cp>Defender’s malware scanner security checks for suspicious code and malware. It also compares your WordPress install with the WP directory master copy, and reports any changes so you can restore the original file with a click.\u003C\u002Fp>\n\u003Ch3>Two-Factor Authentication (2FA) Security\u003C\u002Fh3>\n\u003Cp>Easily add an extra layer of protection and security to your WordPress sites with Defender’s two-factor authentication (2FA) features. Including: mobile app verification (Google Authenticator, Microsoft Authenticator, Authy), backup code generation, lost device emails, WooCommerce 2FA, Biometric Authentication (fingerprint\u002Ffacial recognition), and Hardware Key Authentication (USB security keys). Easily prevent brute force attacks and login security vulnerabilities.\u003C\u002Fp>\n\u003Ch3>Login Protection\u003C\u002Fh3>\n\u003Cp>Brute force attacks are no match for Defender’s login security. Limit login attempts so hackers can’t guess passwords. Permanently ban IPs or trigger a timed lockout after a set number of failed login attempts. Use Geo IP blocking to ban users from specific countries or locations.\u003C\u002Fp>\n\u003Ch3>Firewall Security and IP Manager\u003C\u002Fh3>\n\u003Cp>Improve your website security with Defender’s IP manager and firewall. Manually block specific IPs, import a list of banned IPs, and set automated timed and permanent lockouts. Defender makes it easy to block and unblock specific locations quickly thanks to its advanced firewall security(WAF) offering Geographical IP blocking.\u003C\u002Fp>\n\u003Ch3>User Agent Banning\u003C\u002Fh3>\n\u003Cp>Add user agents to the block or allowlist and stop bad bots from spamming and scraping your site. All major search engines and special network bots are allow-listed out of the box. Easy to set up, Defender’s user agent banning tool now includes built-in bot and script presets to help you quickly block malicious traffic. It does all the security work for you—no editing of the .htaccess file required.\u003C\u002Fp>\n\u003Ch3>Google reCAPTCHA Integration\u003C\u002Fh3>\n\u003Cp>Add reCAPTCHA security to your login \u002F registration pages, lost password forms, and post comments in a couple of steps to up security and help protect from fraud and abuse. Select reCAPTCHA type, language, location, and style to suit. As well as Google, Defender also supports the following reCAPTCHA types:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>BuddyPress reCAPTCHA\u003C\u002Fli>\n\u003Cli>WooCommerce reCAPTCHA\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Login Screen Masking\u003C\u002Fh3>\n\u003Cp>Defender makes it easy to move your login screen to a custom URL. Not only does login screen masking improve security, but it also lets you white label your login user experience and improves branding.\u003C\u002Fp>\n\u003Ch3>Force Password Reset\u003C\u002Fh3>\n\u003Cp>Enhance site security by forcing all users with selected roles to reset their password at any time. Especially helpful if you suspect a possible data breach on your site.\u003C\u002Fp>\n\u003Ch3>Security Headers\u003C\u002Fh3>\n\u003Cp>Protect your site against common attacks, such as: XSS, code injection, cross site scripting, and more. Enable the following security headers:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>X-Frame-Options\u003C\u002Fli>\n\u003Cli>X-XSS-Protection\u003C\u002Fli>\n\u003Cli>X-Content-Type-Options\u003C\u002Fli>\n\u003Cli>Strict Transport\u003C\u002Fli>\n\u003Cli>Referrer Policy\u003C\u002Fli>\n\u003Cli>Permissions-Policy\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>404 Limiter\u003C\u002Fh3>\n\u003Cp>Detect when bots are being used to scan your site for security vulnerabilities and shut them down. The 404 limiter lets you stop the scan by detecting when a bot keeps visiting pages that do not exist, which can also save you from a giant strain on your site’s performance.\u003C\u002Fp>\n\u003Ch3>Security Notifications and Reports\u003C\u002Fh3>\n\u003Cp>Defender runs surveillance and sends security notifications with information that matters. All activity and notifications are recorded in the activity log to let you see at a glance the website security actions that have been taken by the Defender security plugin.\u003C\u002Fp>\n\u003Ch3>Reduce Security Setup Time With Saved Configs\u003C\u002Fh3>\n\u003Cp>Save your Defender security plugin configurations and reapply them to your other sites in just a few clicks. You can create and save an unlimited number of security configurations.\u003C\u002Fp>\n\u003Ch3>Pwned Password Check\u003C\u002Fh3>\n\u003Cp>Entered passwords are checked against public database breach records to further boost security. If a password is identified as compromised, the user will be asked to change it.\u003C\u002Fp>\n\u003Ch3>Custom IP Block\u002FAllowlist\u003C\u002Fh3>\n\u003Cp>Create your IP block\u002Fallow list once, then apply and automatically sync it to all your other sites with just a single click. Save hours by not having to manually add IPs to each individual site. *Note: a [free WPMU DEV account] (https:\u002F\u002Fwpmudev.com\u002Fregister) is required to access this feature.\u003C\u002Fp>\n\u003Ch3>What Do People Say About Defender?\u003C\u002Fh3>\n\u003Cp>★★★★★\u003Cbr \u002F>\n“I found other pro security plugins a bit too fiddly for my taste…I’m delighted with Defender” – \u003Ca href=\"https:\u002F\u002Fprofiles.wordpress.org\u002Fkeithadv\" rel=\"nofollow ugc\">KeithADV\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>★★★★★\u003Cbr \u002F>\n“Thank you for bringing back a free and easy to use 2-Factor Authentication after Clef! Defender helps keep me aware of my site’s security.” – \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fusers\u002Fawijasa\u002F\" rel=\"ugc\">awijasa\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>★★★★★\u003Cbr \u002F>\n“Defender’s interface is very intuitive with warnings that are very helpful” – \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fprofile\u002Fdjohns\" rel=\"nofollow ugc\">djohns\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>★★★★★\u003Cbr \u002F>\n“Defender Recently blocked over 3000 attacks in one week without any noticeable impact on the website. WPMUDEV knocking it out of the park on this one.” – \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fprofile\u002Fdavidoswald\u002F\" rel=\"nofollow ugc\">David Oswald\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>Secure Websites, More Trust, Better Profit\u003C\u002Fh3>\n\u003Cp>If you’re running a business website or eCommerce store, privacy, security, uptime and trust are essential.\u003C\u002Fp>\n\u003Cp>The Defender security plugin is here to help you: it’s a one of a kind WordPress security plugin that makes web security easy for anyone, for free!\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Malware scanner\u003C\u002Fli>\n\u003Cli>Google two-factor authentication (2FA)\u003C\u002Fli>\n\u003Cli>Web Authentication\u003C\u002Fli>\n\u003Cli>Firewall setup and configuration\u003C\u002Fli>\n\u003Cli>One-click site hardening and security tweaking\u003C\u002Fli>\n\u003Cli>WordPress core file scanning and repair\u003C\u002Fli>\n\u003Cli>Ongoing firewall security\u003C\u002Fli>\n\u003Cli>Google reCAPTCHA\u003C\u002Fli>\n\u003Cli>Security headers\u003C\u002Fli>\n\u003Cli>One-click security configs\u003C\u002Fli>\n\u003Cli>Login Screen Masking\u003C\u002Fli>\n\u003Cli>Pwned Password Check\u003C\u002Fli>\n\u003Cli>IP Blocklist manager and logging\u003C\u002Fli>\n\u003Cli>Geo IP blocking\u003C\u002Fli>\n\u003Cli>User agent banning\u003C\u002Fli>\n\u003Cli>Unlimited file scans\u003C\u002Fli>\n\u003Cli>Timed Lockout brute force login attack shield for login security\u003C\u002Fli>\n\u003Cli>404 limiter for blocking vulnerability scans\u003C\u002Fli>\n\u003Cli>IP lockout notifications and security reports\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>All the above is free and will enhance WordPress security for you. If you need extra security for your WordPress site, \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=you_should_get_wpmudev_membership#trial\" rel=\"nofollow ugc\">you should get a WPMU DEV Membership\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>Our Membership gives you access to Defender Pro – which security features include automated scanning, scheduled malware scans for Core, themes, plugins and other files, audit logs, firewall protection, Safe Repair, Blocklist monitoring – alongside Snapshot Pro cloud backups, the Hub with automated plugin, theme and core updates and safe-upgrade scans, all our premium WordPress plugins, 24\u002F7 WordPress support and if your sites already been hacked our team of security experts will clean it up at no additional cost.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=and_you_can_find_out_more_here#trial\" rel=\"nofollow ugc\">It’s an incredible deal, and you can find out more here\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>About Us\u003C\u002Fh3>\n\u003Cp>WPMU DEV is a premium supplier of quality WordPress plugins and themes. For premium support with any WordPress-related issues you can join us here:\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_link\" rel=\"nofollow ugc\">https:\u002F\u002Fwpmudev.com\u002F\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Don’t forget to stay up to date on everything WordPress from the Internet’s number one resource:\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_blog_link\" rel=\"nofollow ugc\">WPMU DEV Blog\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Hey, one more thing… we hope you \u003Ca href=\"https:\u002F\u002Fprofiles.wordpress.org\u002FWPMUDEV\u002F\" rel=\"nofollow ugc\">enjoy our free offerings\u003C\u002Fa> as much as we’ve loved making them for you!\u003C\u002Fp>\n","WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, firewall, 2FA, brute force login security, and more.",90000,4036012,96,329,"2026-03-03T11:21:00.000Z","6.4","8.0.0",[21,128,129,22,23],"login-security","malware","https:\u002F\u002Fwpmudev.com\u002Fproject\u002Fwp-defender\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdefender-security.5.10.0.zip","2024-06-28 00:00:00",{"slug":134,"name":135,"version":136,"author":137,"author_profile":138,"description":139,"short_description":140,"active_installs":141,"downloaded":142,"rating":122,"num_ratings":143,"last_updated":144,"tested_up_to":84,"requires_at_least":145,"requires_php":18,"tags":146,"homepage":148,"download_link":149,"security_score":150,"vuln_count":151,"unpatched_count":29,"last_vuln_date":152,"fetched_at":31},"wp-simple-firewall","Shield: Blocks Bots, Protects Users, and Prevents Security Breaches","21.2.6","Paul","https:\u002F\u002Fprofiles.wordpress.org\u002Fpaultgoodchild\u002F","\u003Cp>Shield stops bot attacks before they hack your site. Bots CAN be stopped. Shield stops them.\u003C\u002Fp>\n\u003Ch3>Key Security Features At A Glance\u003C\u002Fh3>\n\u003Ch3>[PRO-Only] Zero-Configuration, Fast & Reliable WordPress Backups Included\u003C\u002Fh3>\n\u003Cp>We’ve made WordPress backups faster than ever with our integrated WordPress Disaster Recovery Backups solution – \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fshieldbackups\" rel=\"nofollow ugc\">ShieldBACKUPS\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>No more risky Cloud Storage\u002FOAuth credentials exposed on your sites; Backups that work without relying on a temperamental WordPress cron.\u003C\u002Fp>\n\u003Cp>ShieldBACKUPS keeps your data off-site, encrypted, and far away from hackers.\u003C\u002Fp>\n\u003Ch3>\u003Cem>silent\u003C\u002Fem>CAPTCHA Bad Bot Protection\u003C\u002Fh3>\n\u003Cp>Bad bots are your #1 security threat. They account for nearly all WordPress security probes, attacks, injections, malware, and vulnerability exploitation.\u003C\u002Fp>\n\u003Cp>Google reCAPTCHA and CloudFlare Turnstile are considered the best way to detect bots, but these along with all other CAPTCHAs interrupt the user experience.\u003C\u002Fp>\n\u003Cp>Shield’s exclusive \u003Cem>silent\u003C\u002Fem>CAPTCHA detects bad bots and blocks them from taking any abusive actions on your site, such as brute-force user login attacks and WP Comments SPAM.\u003C\u002Fp>\n\u003Cp>Furthermore, privacy directives from legislation such as Europe’s GDPR restrict what data you may share of your visitors. All \u003Cem>silent\u003C\u002Fem>CAPTCHA data is kept on your WordPress site and ensures full compliance with GDPR regulations.\u003C\u002Fp>\n\u003Ch3>Comprehensive Activity Log\u003C\u002Fh3>\n\u003Cp>Shield’s has best-in-class logging that documents every WP action on your site.\u003C\u002Fp>\n\u003Cp>Unlike existing logging solutions, Shield detects changes to your WordPress sites that happen directly on your database. e.g. by hackers that have infiltrated your defenses via an exposed vulnerability.\u003C\u002Fp>\n\u003Cp>No other WordPress security plugin does this.\u003C\u002Fp>\n\u003Ch3>Limit Login Attempts and Block User Registration SPAM\u003C\u002Fh3>\n\u003Cp>\u003Cem>silent\u003C\u002Fem>CAPTCHA technology is invisible to your visitors and protects your WordPress login, registration and lost password forms from brute force attacks, and eliminates user registration SPAM from bots.\u003C\u002Fp>\n\u003Ch3>User Session Theft Protection\u003C\u002Fh3>\n\u003Cp>Shield can lock user session to browsers, or IP addresses. Combine with 2FA (below), you can protect your users from session theft and account theft.\u003C\u002Fp>\n\u003Ch3>Two-Factor Authentication (2FA) for all users\u003C\u002Fh3>\n\u003Cp>Two-Factor Authentication is a crucial part of WordPress user security. It protects against account theft, takeover, and sharing. Shield supports email-based login code, Google\u002FMicrosoft\u002FLastpass Authenticator, Yubikey One-Time Passwords and Passkeys (pro).\u003C\u002Fp>\n\u003Ch3>Exclusive Security Admin Protection\u003C\u002Fh3>\n\u003Cp>Not only does Shield Security protect your WordPress site, it also provides security against tampering of key WordPress options and the Shield Security plugin itself. With Shield’s exclusive Security Admin feature, you can lockdown the security plugin from other admins to prevent accidental or malicious changes that will impact your security.\u003C\u002Fp>\n\u003Ch3>CrowdSec Partnership\u003C\u002Fh3>\n\u003Cp>Shield is the only WordPress security plugin with strategic partnerships that bring powerful protection to your WordPress sites. With our CrowdSec integration, your WordPress sites benefit from crowd-sourced IP Block Lists so your site can block malicious bots before they can do any damage whatsoever.\u003C\u002Fp>\n\u003Ch3>All The Features You’ll Absolutely Love\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>[ShieldPRO] ShieldBACKUPS – Disaster-proof your WordPress site with fast, reliable, easy WordPress backups!\u003C\u002Fli>\n\u003Cli>Exclusive \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fju\" rel=\"nofollow ugc\">silentCAPTCHA Security\u003C\u002Fa> – WordPress-specific bot-detection alternative to Google reCAPTCHA and CloudFlare Turnstile.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fj0\" rel=\"nofollow ugc\">Automatic Bot & IP Blocking\u003C\u002Fa> – reputation-based security intelligence to block repeat offenders automatically.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Instant Bad Bot Blocking with \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fl5\" rel=\"nofollow ugc\">our exclusive CrowdSec Security integration\u003C\u002Fa>\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Easy To Understand Security Dashboard that highlights quick wins and areas to rapidly improve site security\u003C\u002Fli>\n\u003Cli>[ShieldPRO] \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Flf\" rel=\"nofollow ugc\">Artificial Intelligence based PHP Malware Detection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Security for your important user forms, by blocking Block Bots:\n\u003Cul>\n\u003Cli>Login Forms\u003C\u002Fli>\n\u003Cli>User Registration Forms\u003C\u002Fli>\n\u003Cli>Lost Password Reset Forms\u003C\u002Fli>\n\u003Cli>[ShieldPRO] WooCommerce & Easy Digital Downloads\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Contact Form SPAM Protection: Contact Form 7, NinjaForms, Elementor, WP Forms, and more!\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Memberpress, LearnPress, BuddyPress, WP Members, ProfileBuilder\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fiw\" rel=\"nofollow ugc\">Brute Force Security Protection, Limit Login Attempts + Login Cooldown\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Powerful Firewall Rules\u003C\u002Fli>\n\u003Cli>Restricted Security Admin Access\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fix\" rel=\"nofollow ugc\">Prevents Unauthorized Changes By Compromised Admins\u003C\u002Fa>.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>(MFA) \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fiy\" rel=\"nofollow ugc\">Two-Factor \u002F Multi-Factor Login Authentication\u003C\u002Fa>:\n\u003Cul>\n\u003Cli>Email\u003C\u002Fli>\n\u003Cli>Google Authenticator\u003C\u002Fli>\n\u003Cli>Yubikey\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Passkeys\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Backup Login Codes\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Multiple Yubikey per User\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Remember Me (reduces 2FA requests for users)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fiz\" rel=\"nofollow ugc\">Block XML-RPC\u003C\u002Fa> (\u003Cem>including\u003C\u002Fem> Pingbacks and Trackbacks)\u003C\u002Fli>\n\u003Cli>Security firewall for the REST API – block anonymous requests\u003C\u002Fli>\n\u003Cli>Powerful IP Addresses-based Security:\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fj0\" rel=\"nofollow ugc\">Automatic IP Address Blocking Using Points-Based System\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Block or Bypass individual IPs\u003C\u002Fli>\n\u003Cli>Block or Bypass IP Subnets\u003C\u002Fli>\n\u003Cli>Full IP Security Analysis in 1 place to review activity on your sites\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Comprehensive WordPress File Scanner for Intrusions and Hacks\n\u003Cul>\n\u003Cli>Detect File Changes – \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fj1\" rel=\"nofollow ugc\">Scan & Repair WordPress Core Files\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fj2\" rel=\"nofollow ugc\">Detect Unknown\u002FSuspicious PHP Files\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Detect Abandoned Plugins.\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Malware Scanner – detects known and unknown malware.\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Plugin and Theme Scanning – identify file changes in your plugins\u002Fthemes.\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Detect Plugins\u002FThemes With Known Security Vulnerabilities.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fj3\" rel=\"nofollow ugc\">Create a \u003Cstrong>Private Secure Login URL\u003C\u002Fstrong> by hiding wp-login.php\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Comment SPAM Blocking – Block \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fjf\" rel=\"nofollow ugc\">Comment SPAM from Bots and Humans\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Never Block Google\u003C\u002Fstrong>: Smart Security Automatically Detects Known Good Bots: GoogleBot, Bing and other Official Search Engines including:\n\u003Cul>\n\u003Cli>Google\u003C\u002Fli>\n\u003Cli>Bing,\u003C\u002Fli>\n\u003Cli>DuckDuckGo\u003C\u002Fli>\n\u003Cli>Yahoo!\u003C\u002Fli>\n\u003Cli>Baidu\u003C\u002Fli>\n\u003Cli>Apple\u003C\u002Fli>\n\u003Cli>Yandex\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Automatically Detects 3rd Party Services and Prevents Blocking Of:\n\u003Cul>\n\u003Cli>ManageWP \u002F iControlWP \u002F MainWP\u003C\u002Fli>\n\u003Cli>Pingdom, NodePing, Statuscake, UptimeRobot, GTMetrix\u003C\u002Fli>\n\u003Cli>Stripe, PayPal IPN\u003C\u002Fli>\n\u003Cli>CloudFlare, SEMRush\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Full Security Activity Log – \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fj5\" rel=\"nofollow ugc\">Monitor \u003Cstrong>All\u003C\u002Fstrong> Site Activity, including\u003C\u002Fa>:\n\u003Cul>\n\u003Cli>Activity log for all user login & registration attempts\u003C\u002Fli>\n\u003Cli>Plugin and Theme installation activity logs, including activation & deactivation etc.\u003C\u002Fli>\n\u003Cli>User creation activity log, including detection of administrator promotions\u003C\u002Fli>\n\u003Cli>Activity log for Page\u002FPost create, update, delete\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Advanced User Sessions Control\n\u003Cul>\n\u003Cli>Restrict Multiple User Login\u003C\u002Fli>\n\u003Cli>Restrict Users Session To IP\u003C\u002Fli>\n\u003Cli>Password Security – Block Pwned Passwords\u003C\u002Fli>\n\u003Cli>User Enumeration Blocking – Firewall blocks requests to \u003Ccode>?author=x\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Security for old and idle user account with manual and automatic User Suspend.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Full\u002FAutomatic Support for All IP Address Sources including Proxy Support\u003C\u002Fli>\n\u003Cli>HTTP Request\u002FTraffic Logging – \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fj7\" rel=\"nofollow ugc\">Full Traffic Logging and Request Monitoring\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>[ShieldPRO] Traffic Rate Limiting Security – prevent server overload from DoS Attacks\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fj6\" rel=\"nofollow ugc\">HTTP Security Headers & Content Security Policies (CSP)\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>\u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fshieldfeatures\" rel=\"nofollow ugc\">Full Shield Security Features List\u003C\u002Fa>\u003C\u002Fh4>\n\u003Cp>Shield is the only security plugin for WordPress that prioritises protection and intrusion prevention before repair. With Shield Security, your site will immediately to block visitors as they probe your site looking for vulnerabilities, and before they can do damage.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>No other standalone WordPress security plugin\u003C\u002Fstrong> (including \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fshieldvswordfence\" rel=\"nofollow ugc\">Wordfence\u003C\u002Fa>, WP Cerber, Ninja Firewall, All-In-One Security) approaches security in this way. The 1st step in any good security system is Intrusion Detection\u002FPrevention, the 2nd step is repair. Shield Security does both.\u003C\u002Fp>\n\u003Ch4>Get the highest rated 5* Security Plugin for WordPress\u003C\u002Fh4>\n\u003Cp>Per download, Shield Security \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fjl\" rel=\"nofollow ugc\">has the highest 5* rating\u003C\u002Fa> in the WordPress plugin repository.\u003C\u002Fp>\n\u003Ch3>Leave Behind the Security Marketing Hype and Scare Mongering\u003C\u002Fh3>\n\u003Cp>Our solution isn’t designed to scare you and make you feel unsafe.\u003C\u002Fp>\n\u003Ch3>2 Key WordPress Security Strategies\u003C\u002Fh3>\n\u003Cp>Shield Security uses 2 simple key strategies to protect your WordPress sites:\u003C\u002Fp>\n\u003Col>\n\u003Cli>Intrusion Prevention System – Detect Bots\u002FMalicious IPs that will try to hack and invade your WordPress sites.\u003C\u002Fli>\n\u003Cli>Block & Recover – Block Bad Bots and Repair Hacks\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch4>Key Security Strategy #1: Hacking Prevention\u003C\u002Fh4>\n\u003Cp>Bad Bots are the primary cause for nearly all our security troubles – they’re relentless, automatic and powerful.\u003C\u002Fp>\n\u003Cp>Shield Security is highly focused on their detection and eradication from your WordPress sites.\u003C\u002Fp>\n\u003Cp>Blocking malicious bots before they do damage through malware and exploitation of vulnerabilities is the #1 security strategy to protect and enhance security on a WordPress site.\u003C\u002Fp>\n\u003Cp>Shield detects these malicious visitors, then blocks their access to your site completely. This involves analysing different security bot-signals and combining them to identify a visitor as malicious.\u003C\u002Fp>\n\u003Cp>These security signals include:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>site probes that generate 404 errors\u003C\u002Fli>\n\u003Cli>failed logins\u003C\u002Fli>\n\u003Cli>logins with invalid usernames\u003C\u002Fli>\n\u003Cli>xml-rpc access\u003C\u002Fli>\n\u003Cli>fake search engine web crawlers\u003C\u002Fli>\n\u003Cli>invalid user agents\u003C\u002Fli>\n\u003Cli>excessive website requests and resource abuse\u003C\u002Fli>\n\u003Cli>and many more signals our security team have identified.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Early identification and blocking of malicious bots reduces your WordPress site’s vulnerability to any sort of attack.\u003C\u002Fp>\n\u003Ch4>Key Strategy #2: Hacking Recovery\u003C\u002Fh4>\n\u003Cp>Even with the best security efforts, a site can get hacked. This usually involves file modification: either a hack file is added, or a file is changed.\u003C\u002Fp>\n\u003Cp>There are 3 key WordPress assets whose files can be hacked:\u003C\u002Fp>\n\u003Col>\n\u003Cli>WordPress Core\u003C\u002Fli>\n\u003Cli>WordPress Plugins\u003C\u002Fli>\n\u003Cli>WordPress Themes\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Almost every security plugin can now do #1 – it’s easy because WordPress.org provides \u003Cem>checksums\u003C\u002Fem> for core files.\u003C\u002Fp>\n\u003Cp>But, there are no hashes available for plugins and themes, particularly premium plugins, so they can’t do it.\u003C\u002Fp>\n\u003Cp>Shield is \u003Cstrong>the only WordPress security plugin\u003C\u002Fstrong> that offers accurate detection of file modifications for all plugins and themes because we \u003Cstrong>build our own file fingerprints\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>Shield can compare the file contents of every plugin & theme in the WordPress.org repository, looking for changed or new files\u003C\u002Fp>\n\u003Cp>And, if you’re a ShieldPRO client, you can protect premium plugins\u002Fthemes too, including Yoast SEO and Advanced Custom Fields Pro.\u003C\u002Fp>\n\u003Cp>Where possible, Shield will repair any unrecognised\u002Fmodified files it detects.\u003C\u002Fp>\n\u003Ch4>Non-stop Security Notifications Are Not Okay.\u003C\u002Fh4>\n\u003Cp>Your security plugin must be smarter, and take responsibility for decisions, so you don’t have to.\u003C\u002Fp>\n\u003Cp>Shield handles many problems for you, making intelligent decisions without noisy email notifications.\u003C\u002Fp>\n\u003Ch3>Dedicated Premium Support When You Go PRO\u003C\u002Fh3>\n\u003Cp>The Shield Security team prioritises email technical support over the WordPress.org forums.\u003Cbr \u002F>\nIndividual, dedicated technical support is only available to customers who have \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fab\" rel=\"nofollow ugc\">purchased Shield Pro\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>Discover all the advantages of switching your WordPress security Pro at \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fab\" rel=\"nofollow ugc\">our Shield Security store\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>Partnerships & Integrations\u003C\u002Fh3>\n\u003Cp>We believe that \u003Ca href=\"https:\u002F\u002Fclk.shldscrty.com\u002Fol\" rel=\"nofollow ugc\">silentCAPTCHA\u003C\u002Fa> is one of the simplest and most powerful solutions available today for all WordPress site owners to block and eliminate automated bot spam.\u003C\u002Fp>\n\u003Cp>That’s why we’ve started a collaboration campaign with other WordPress plugin developers to adapt their plugins to natively support Shield’s silentCAPTCHA solution, alongside Google reCAPTCHA & Cloudflare Turnstile.\u003C\u002Fp>\n\u003Cp>When you use one of the products from any of our partners, you will be able to activate Shield’s silentCAPTCHA bot spam protection so that your forms are protected from automated spam. You won’t need any site\u002FAPI keys, custom integrations, or JavaScript that can breaks your forms. It all works automatically for you when you enable the feature.\u003C\u002Fp>\n\u003Cp>As of this release, we have partnered with the following WordPress form providers:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Feasy-form-builder\u002F\" rel=\"ugc\">Easy Form Builder\u003C\u002Fa> v4+\u003C\u002Fli>\n\u003C\u002Ful>\n","Shield stops bot attacks before they hack your site. Bots CAN be stopped. Shield stops them.",40000,12640449,1032,"2026-03-05T10:26:00.000Z","5.7",[67,20,147,21,23],"bots","https:\u002F\u002Fclk.shldscrty.com\u002F2f","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-simple-firewall.21.2.6.zip",83,11,"2026-02-18 16:19:04",{"attackSurface":154,"codeSignals":245,"taintFlows":478,"riskAssessment":588,"analyzedAt":602},{"hooks":155,"ajaxHandlers":239,"restRoutes":240,"shortcodes":241,"cronEvents":242,"entryPointCount":29,"unprotectedCount":29},[156,163,166,170,174,178,182,186,190,193,196,198,201,204,207,212,216,219,223,227,230,232,234,236],{"type":157,"name":158,"callback":159,"priority":160,"file":161,"line":162},"action","activated_plugin","\\BitFirePlugin\\update_plugin_list",10,"bitfire-admin.php",615,{"type":157,"name":164,"callback":159,"priority":160,"file":161,"line":165},"deleted_plugin",618,{"type":157,"name":167,"callback":168,"file":161,"line":169},"admin_menu","\\BitFirePlugin\\bitfire_add_menu",621,{"type":157,"name":171,"callback":172,"file":161,"line":173},"admin_notices","\\BitFirePlugin\\alerts",622,{"type":157,"name":175,"callback":176,"file":161,"line":177},"admin_enqueue_scripts","\\BitFirePlugin\\bitfire_styles",638,{"type":157,"name":179,"callback":180,"file":181,"line":81},"wp_enqueue_scripts","closure","bitfire-plugin.php",{"type":183,"name":184,"callback":180,"file":181,"line":185},"filter","cron_schedules",160,{"type":157,"name":187,"callback":188,"file":181,"line":189},"bitfire_scan_action","BitFirePlugin\\bitfire_scan_fn",171,{"type":157,"name":191,"callback":191,"priority":29,"file":181,"line":192},"shutdown",197,{"type":157,"name":194,"callback":180,"file":181,"line":195},"template_redirect",205,{"type":157,"name":194,"callback":180,"file":181,"line":197},207,{"type":157,"name":199,"callback":180,"file":181,"line":200},"login_header",229,{"type":157,"name":202,"callback":180,"priority":28,"file":181,"line":203},"admin_head",242,{"type":157,"name":205,"callback":180,"priority":28,"file":181,"line":206},"wp_head",246,{"type":157,"name":208,"callback":209,"priority":210,"file":181,"line":211},"auth_cookie_valid","BitFirePRO\\verify_user_id",9,521,{"type":183,"name":213,"callback":209,"priority":214,"file":181,"line":215},"determine_current_user",65535,522,{"type":157,"name":217,"callback":209,"priority":214,"file":181,"line":218},"application_password_did_authenticate",523,{"type":183,"name":220,"callback":180,"priority":221,"file":181,"line":222},"status_header",9999,544,{"type":183,"name":224,"callback":225,"file":181,"line":226},"wp_script_attributes","anonymous",596,{"type":183,"name":228,"callback":225,"file":181,"line":229},"wp_inline_script_attributes",597,{"type":157,"name":208,"callback":209,"priority":210,"file":181,"line":231},642,{"type":183,"name":213,"callback":209,"priority":214,"file":181,"line":233},643,{"type":157,"name":217,"callback":209,"priority":214,"file":181,"line":235},644,{"type":157,"name":191,"callback":225,"file":237,"line":238},"src\\botfilter.php",1728,[],[],[],[243],{"hook":187,"callback":187,"file":181,"line":244},182,{"dangerousFunctions":246,"sqlUsage":410,"outputEscaping":412,"fileOperations":471,"externalRequests":472,"nonceChecks":29,"capabilityChecks":28,"bundledLibraries":473},[247,251,255,258,262,265,268,271,274,278,281,284,287,290,293,297,300,303,305,307,311,313,316,319,322,325,328,331,335,338,342,344,347,350,354,357,360,364,367,370,373,377,380,383,386,389,392,395,398,401,405,408],{"fn":248,"file":181,"line":249,"context":250},"assert",485,"assert(!empty($script_tag), \"cant add nonce to empty script tag\");",{"fn":248,"file":252,"line":253,"context":254},"src\\api.php",235,"assert(isset($r->post['uuid']) || isset($r->post['agent']), \"uuid or agent is required\");",{"fn":248,"file":252,"line":256,"context":257},444,"assert(isset($r->get[\"filename\"]), \"filename is required\");",{"fn":259,"file":252,"line":260,"context":261},"unserialize",590,"$bot = unserialize(file_get_contents($file));",{"fn":248,"file":252,"line":263,"context":264},919,"assert(count($hash_slice) \u003C 24, \"curl multi can only handle 24 at a time\");",{"fn":248,"file":252,"line":266,"context":267},1497,"assert($api_effect instanceof Effect, \"api method did not return valid Effect\");",{"fn":259,"file":252,"line":269,"context":270},2560,"$plugin_act = (!empty($plugin_ser)) ? count(unserialize($plugin_ser)) : 0;",{"fn":259,"file":252,"line":272,"context":273},2564,"$cron_events = (!empty($plugin_ser)) ? count(unserialize($cron_ser)) : 0;",{"fn":248,"file":275,"line":276,"context":277},"src\\bitfire_pure.php",49,"assert(!empty($code), \"empty code in code_class\");",{"fn":248,"file":275,"line":279,"context":280},50,"assert($code \u003C 100000, \"invalid code class >10000\");",{"fn":248,"file":275,"line":282,"context":283},51,"assert($code > 0, \"invalid code class \u003C1\");",{"fn":248,"file":275,"line":285,"context":286},1062,"assert(count($headers) \u003C= 16, \"too many headers\");",{"fn":248,"file":275,"line":288,"context":289},1063,"assert(count($headers) > 4, \"missing some headers\");",{"fn":259,"file":237,"line":291,"context":292},1474,"return unserialize($file->raw());",{"fn":248,"file":294,"line":295,"context":296},"src\\cms.php",466,"assert($malware instanceof Malware, \"Malware_List can only contain Malware objects\");",{"fn":248,"file":294,"line":298,"context":299},1887,"assert(strlen($from) >= ($from_offset + $from_len), \"from_offset + from_len is greater than the leng",{"fn":248,"file":294,"line":301,"context":302},1888,"assert(in_array($opcode, ['i', 'd', 'c', 'r', 'z']), \"invalid opcode\");",{"fn":248,"file":294,"line":304,"context":299},1912,{"fn":248,"file":294,"line":306,"context":302},1913,{"fn":248,"file":308,"line":309,"context":310},"src\\cuckoo.php",85,"assert($offset >= 0 && !empty($data), \"invalid write offset\u002Fdata\");",{"fn":248,"file":308,"line":90,"context":312},"assert(($offset + strlen($data)) \u003C= $this->mem_end + CUCKOO_MEM_EXTRA, \"write offset past end of mem",{"fn":248,"file":308,"line":314,"context":315},87,"assert(strlen($data) \u003C= CUCKOO_MEM_CHUNK, \"data too large to write to cache: \" . strlen($data) . \" \u002F",{"fn":248,"file":308,"line":317,"context":318},105,"assert($offset >= 0 && $len > 0, \"invalid read offset\u002Flen ($offset \u002F $len)\");",{"fn":248,"file":308,"line":320,"context":321},106,"assert($offset \u003C= $this->mem_end, \"read past end of memory: $offset, {$this->mem_end}\");",{"fn":259,"file":308,"line":323,"context":324},213,"$x = unserialize($data);",{"fn":248,"file":308,"line":326,"context":327},449,"assert($num_items \u003C= 65535, \"max 64K items in cache\");",{"fn":248,"file":308,"line":329,"context":330},450,"assert($chunk_size \u003C= 1024, \"max base chunk_size 1K\");",{"fn":248,"file":332,"line":333,"context":334},"src\\dashboard.php",214,"assert(file_exists($custom_css_file), \"missing core file $custom_css_file\");",{"fn":248,"file":332,"line":336,"context":337},215,"assert(is_readable($custom_css_file), \"core file $custom_css_file is not readable\");",{"fn":248,"file":339,"line":340,"context":341},"src\\db.php",260,"assert(!empty($this->_db), \"database: {$this->database} is not connected [\".gettype($this->_db).\"]\")",{"fn":248,"file":339,"line":343,"context":341},334,{"fn":248,"file":339,"line":345,"context":346},475,"assert(is_resource($this->_db), \"database not connected\");",{"fn":248,"file":339,"line":348,"context":349},751,"assert(is_resource($stream), \"stream must be a resource\");",{"fn":259,"file":351,"line":352,"context":353},"src\\server.php",1268,"$data = unserialize($file->raw());",{"fn":259,"file":351,"line":355,"context":356},1521,"$bot_info = unserialize(file_get_contents($file));",{"fn":248,"file":351,"line":358,"context":359},1744,"assert(file_exists($path), \"can't update character frequency if the file doesn't exist: $path\");",{"fn":259,"file":361,"line":362,"context":363},"src\\storage.php",61,"return unserialize($raw);",{"fn":248,"file":361,"line":365,"context":366},131,"assert(in_array(self::$_type, ['nop', 'shmop', 'opcache']), \"must call set_type before using cache\")",{"fn":248,"file":361,"line":368,"context":369},187,"assert(self::$_type !== null, \"must call set_type before using cache\");",{"fn":248,"file":361,"line":371,"context":372},405,"assert(is_array($data) || is_string($data), \"$key_name generator returned invalid data (\" . gettype(",{"fn":248,"file":374,"line":375,"context":376},"src\\util.php",918,"public static function create() : Effect { assert(func_num_args() == 0, \"incorrect call of Effect::c",{"fn":248,"file":374,"line":378,"context":379},955,"assert(is_numeric($status), \"exit status must be numeric [$status]\");",{"fn":248,"file":374,"line":381,"context":382},965,"assert(!empty($mod->filename), \"file problem %s\");",{"fn":248,"file":374,"line":384,"context":385},1071,"assert(!empty($file->filename), \"can't write to null file: \" . en_json($file));",{"fn":248,"file":374,"line":387,"context":388},1650,"assert(class_exists('\\BitFire\\Config'), \"programmer error, call debug() before config is loaded\");",{"fn":248,"file":374,"line":390,"context":391},1651,"assert(format_chk($fmt, count($args)), \"programmer error, format string does not match number of arg",{"fn":259,"file":374,"line":393,"context":394},2247,"return unserialize($compress);",{"fn":248,"file":374,"line":396,"context":397},2382,"assert(is_int($config->trim_len) && $config->trim_len > 0 && $config->trim_len \u003C 128, \"invalid trim ",{"fn":248,"file":374,"line":399,"context":400},2383,"assert(is_int($config->valid_seconds) && $config->valid_seconds > 0, \"invalid valid_seconds value\");",{"fn":248,"file":402,"line":403,"context":404},"src\\webfilter.php",616,"assert(! empty($needle), \"generic block list error: needle:[$needle] - code[$key]\");",{"fn":248,"file":402,"line":406,"context":407},617,"assert(! ctype_digit($needle), \"generic block list error: needle code swap\");",{"fn":248,"file":402,"line":165,"context":409},"assert($needle[0] === \"\u002F\", \"generic block list error: no regex_identifier\");",{"prepared":28,"raw":29,"locations":411},[],{"escaped":413,"rawEcho":414,"locations":415},97,27,[416,419,421,423,425,428,430,432,433,436,438,440,442,444,446,448,451,453,455,456,459,461,463,465,467,469,470],{"file":161,"line":417,"context":418},364,"raw output",{"file":161,"line":420,"context":418},366,{"file":181,"line":422,"context":418},230,{"file":181,"line":424,"context":418},243,{"file":426,"line":427,"context":418},"error_handler.php",309,{"file":332,"line":429,"context":418},394,{"file":332,"line":431,"context":418},398,{"file":332,"line":431,"context":418},{"file":434,"line":435,"context":418},"src\\diff.php",780,{"file":434,"line":437,"context":418},787,{"file":434,"line":439,"context":418},793,{"file":434,"line":441,"context":418},795,{"file":374,"line":443,"context":418},393,{"file":374,"line":445,"context":418},1187,{"file":374,"line":447,"context":418},1191,{"file":449,"line":450,"context":418},"verify.php",168,{"file":449,"line":452,"context":418},189,{"file":449,"line":454,"context":418},190,{"file":449,"line":197,"context":418},{"file":457,"line":458,"context":418},"views\\block.php",23,{"file":457,"line":460,"context":418},34,{"file":457,"line":462,"context":418},39,{"file":457,"line":464,"context":418},43,{"file":457,"line":466,"context":418},70,{"file":457,"line":468,"context":418},76,{"file":457,"line":468,"context":418},{"file":457,"line":468,"context":418},199,4,[474],{"name":475,"version":476,"knownCves":477},"jQuery","3.6.1",[],[479,506,517,535,555,566,574],{"entryPoint":480,"graph":481,"unsanitizedCount":505,"severity":41},"do_ip_block (ip_blocking.php:82)",{"nodes":482,"edges":501},[483,488,494,496],{"id":484,"type":485,"label":486,"file":487,"line":150},"n0","source","$_SERVER","ip_blocking.php",{"id":489,"type":490,"label":491,"file":487,"line":492,"wp_function":493},"n1","sink","header() [Header Injection]",95,"header",{"id":495,"type":485,"label":486,"file":487,"line":150},"n2",{"id":497,"type":490,"label":498,"file":487,"line":499,"wp_function":500},"n3","file_get_contents() [SSRF\u002FLFI]",107,"file_get_contents",[502,504],{"from":484,"to":489,"sanitized":503},false,{"from":495,"to":497,"sanitized":503},2,{"entryPoint":507,"graph":508,"unsanitizedCount":505,"severity":41},"\u003Cip_blocking> (ip_blocking.php:0)",{"nodes":509,"edges":514},[510,511,512,513],{"id":484,"type":485,"label":486,"file":487,"line":150},{"id":489,"type":490,"label":491,"file":487,"line":492,"wp_function":493},{"id":495,"type":485,"label":486,"file":487,"line":150},{"id":497,"type":490,"label":498,"file":487,"line":499,"wp_function":500},[515,516],{"from":484,"to":489,"sanitized":503},{"from":495,"to":497,"sanitized":503},{"entryPoint":518,"graph":519,"unsanitizedCount":505,"severity":41},"\u003Capi> (src\\api.php:0)",{"nodes":520,"edges":532},[521,523,527,528],{"id":484,"type":485,"label":486,"file":252,"line":522},832,{"id":489,"type":490,"label":524,"file":252,"line":525,"wp_function":526},"fopen() [File Access]",1573,"fopen",{"id":495,"type":485,"label":486,"file":252,"line":522},{"id":497,"type":490,"label":529,"file":252,"line":530,"wp_function":531},"file_put_contents() [File Write]",2750,"file_put_contents",[533,534],{"from":484,"to":489,"sanitized":503},{"from":495,"to":497,"sanitized":503},{"entryPoint":536,"graph":537,"unsanitizedCount":505,"severity":41},"\u003Cserver> (src\\server.php:0)",{"nodes":538,"edges":551},[539,541,543,545,548],{"id":484,"type":485,"label":486,"file":351,"line":540},301,{"id":489,"type":490,"label":498,"file":351,"line":542,"wp_function":500},911,{"id":495,"type":485,"label":486,"file":351,"line":544},1427,{"id":497,"type":546,"label":547,"file":351,"line":544},"transform","→ convert_bot_file()",{"id":549,"type":490,"label":529,"file":351,"line":550,"wp_function":531},"n4",1297,[552,553,554],{"from":484,"to":489,"sanitized":503},{"from":495,"to":497,"sanitized":503},{"from":497,"to":549,"sanitized":503},{"entryPoint":556,"graph":557,"unsanitizedCount":505,"severity":41},"check_pro_ver (src\\util.php:2080)",{"nodes":558,"edges":564},[559,562],{"id":484,"type":485,"label":560,"file":374,"line":561},"$_SERVER (x2)",2099,{"id":489,"type":490,"label":529,"file":374,"line":563,"wp_function":531},2101,[565],{"from":484,"to":489,"sanitized":503},{"entryPoint":567,"graph":568,"unsanitizedCount":505,"severity":41},"\u003Cutil> (src\\util.php:0)",{"nodes":569,"edges":572},[570,571],{"id":484,"type":485,"label":560,"file":374,"line":561},{"id":489,"type":490,"label":529,"file":374,"line":563,"wp_function":531},[573],{"from":484,"to":489,"sanitized":503},{"entryPoint":575,"graph":576,"unsanitizedCount":28,"severity":41},"\u003Cuninstall> (uninstall.php:0)",{"nodes":577,"edges":585},[578,581,583],{"id":484,"type":485,"label":486,"file":579,"line":580},"uninstall.php",59,{"id":489,"type":546,"label":582,"file":579,"line":580},"→ removeBitFireBlock()",{"id":495,"type":490,"label":529,"file":579,"line":584,"wp_function":531},109,[586,587],{"from":484,"to":489,"sanitized":503},{"from":489,"to":495,"sanitized":503},{"summary":589,"deductions":590},"The \"bitfire\" plugin v4.8.2 exhibits a mixed security posture. While it demonstrates good practices in handling SQL queries with prepared statements and a high percentage of properly escaped output, several areas raise significant concern. The presence of dangerous functions like 'assert' and 'unserialize' is a red flag, especially when coupled with a lack of nonce checks on any entry points, suggesting potential for arbitrary code execution or deserialization vulnerabilities if malicious data is introduced. The taint analysis revealing all analyzed flows with unsanitized paths is particularly alarming, even without critical or high severity classifications, as it indicates a high likelihood of data being mishandled. The plugin's vulnerability history, while showing no currently unpatched CVEs, does include a past medium-severity vulnerability related to information exposure. This, combined with the static analysis findings, suggests that while the developers are addressing past issues, underlying coding practices may still harbor risks.",[591,594,596,598,600],{"reason":592,"points":593},"Dangerous functions found (assert, unserialize)",15,{"reason":595,"points":160},"No nonce checks found on any entry points",{"reason":597,"points":593},"All analyzed taint flows have unsanitized paths",{"reason":599,"points":472},"Bundled outdated library (jQuery v3.6.1)",{"reason":601,"points":160},"Past medium severity vulnerability (Exposure of Sensitive Information)","2026-03-16T19:59:07.561Z",{"wat":604,"direct":611},{"assetPaths":605,"generatorPatterns":607,"scriptPaths":608,"versionParams":609},[606],"\u002Fwp-content\u002Fplugins\u002Fbitfire\u002Fpublic\u002Fbitfire_core.js",[],[],[610],"bitfire_core.js?ver=",{"cssClasses":612,"htmlComments":613,"htmlAttributes":614,"restEndpoints":615,"jsGlobals":616,"shortcodeOutput":618},[],[],[],[],[617],"BITFIRE_VER",[]]