[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2qLJMuGO5e7BS6WUiABsDh3LZBSi65p9vwQvTQnX9Eg":3},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":18,"download_link":25,"security_score":13,"vuln_count":26,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29,"vulnerabilities":30,"developer":87,"crawl_stats":36,"alternatives":95,"analysis":196,"fingerprints":762},"limit-login-attempts-reloaded","Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall","2.26.28","WPChef","https:\u002F\u002Fprofiles.wordpress.org\u002Fwpchefgadget\u002F","\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.limitloginattempts.com\" rel=\"nofollow ugc\">Limit Login Attempts Reloaded\u003C\u002Fa> functions as a robust deterrent against \u003Ca href=\"https:\u002F\u002Fwww.limitloginattempts.com\u002Fcracking-the-code-unveiling-the-mechanics-behind-brute-force-attacks\u002F\" rel=\"nofollow ugc\">brute force attacks\u003C\u002Fa>, bolstering your website’s security measures and optimizing its performance. It achieves this by \u003Cstrong>restricting the number of login attempts allowed\u003C\u002Fstrong>. This applies not only to the standard login method, but also to XMLRPC, Woocommerce, and custom login pages. With more than 2.5 million active users, this plugin fulfills all your login security requirements.\u003C\u002Fp>\n\u003Cp>The plugin functions by automatically preventing further attempts from a particular Internet Protocol (IP) address and\u002For username once a predetermined limit of retries has been surpassed. This significantly weakens the effectiveness of brute force attacks on your website.\u003C\u002Fp>\n\u003Cp>By default, WordPress permits an unlimited number of login attempts, posing a vulnerability where passwords can be easily deciphered through brute force methods.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Limit Login Attempts Reloaded Premium (Try Free with \u003Ca href=\"https:\u002F\u002Fwww.limitloginattempts.com\u002Fpremium-security-zero-cost-discover-the-benefits-of-micro-cloud\u002F\" rel=\"nofollow ugc\">Micro Cloud\u003C\u002Fa>)\u003C\u002Fstrong>\u003Cbr \u002F>\nUpgrade to \u003Ca href=\"https:\u002F\u002Fwww.limitloginattempts.com\u002Fplans\u002F\" rel=\"nofollow ugc\">Limit Login Attempts Reloaded Premium\u003C\u002Fa> to extend cloud-based protection to the Limit Login Attempts Reloaded plugin, thereby enhancing your login security. The premium version includes a range of highly beneficial features, including \u003Ca href=\"https:\u002F\u002Fwww.limitloginattempts.com\u002Ffeatures\u002Fip-intelligence\u002F\" rel=\"nofollow ugc\">IP intelligence\u003C\u002Fa> to \u003Cstrong>detect, counter and deny malicious login attempts\u003C\u002Fstrong>. Your \u003Ca href=\"https:\u002F\u002Fwww.limitloginattempts.com\u002Ffailed-login-attempts-in-wordpress\u002F\" rel=\"nofollow ugc\">failed login attempts\u003C\u002Fa> will be safely neutralized in the cloud so your website can function at its optimal performance during an attack.\u003C\u002Fp>\n\u003Cp>\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FJfkvIiQft14?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\u003C\u002Fp>\n\u003Ch4>Features (Free Version):\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\u003Cstrong>2FA\u003C\u002Fstrong> – Coming soon.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Limit Logins\u003C\u002Fstrong> – Limit the number of retry attempts when logging in (per each IP).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Configurable Lockout Timings\u003C\u002Fstrong> – Modify the amount of time a user or IP must wait after a lockout.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Remaining Tries\u003C\u002Fstrong> – Informs the user about the remaining retries or lockout time on the login page.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Lockout Email Notifications\u003C\u002Fstrong> – Informs the admin via email of lockouts.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Denied Attempt Logs\u003C\u002Fstrong> – View a log of all denied attempts and lockouts.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IP & Username Safelist\u002FDenylist\u003C\u002Fstrong> – Control access to usernames and IPs.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>New User Registration Protection (Micro Cloud Accounts)\u003C\u002Fstrong> – Protects default WP registration.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Sucuri\u003C\u002Fstrong> compatibility.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Wordfence\u003C\u002Fstrong> compatibility.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ultimate Member\u003C\u002Fstrong> compatibility.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WPS Hide Login\u003C\u002Fstrong> compatibility.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>MemberPress\u003C\u002Fstrong> compatibility.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>XMLRPC\u003C\u002Fstrong> gateway protection.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Woocommerce\u003C\u002Fstrong> login page protection.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Multi-site compatibility\u003C\u002Fstrong> with extra MU settings.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>GDPR\u003C\u002Fstrong> compliant.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Custom IP origins support\u003C\u002Fstrong> (Cloudflare, Sucuri, etc.).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>llar_admin\u003C\u002Fstrong> own capability.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Features (Premium Version):\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\u003Cstrong>Performance Optimizer\u003C\u002Fstrong> – Offload the burden of excessive failed logins from your server to protect your server resources, resulting in improved speed and efficiency of your website.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Enhanced IP Intelligence\u003C\u002Fstrong> – Identify repetitive and suspicious login attempts to detect potential brute force attacks. IPs with known malicious activity are stored and used to help prevent and counter future attacks.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Enhanced Throttling\u003C\u002Fstrong> – Longer lockout intervals each time a malicious IP or username tries to login unsuccessfully.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Deny By Country\u003C\u002Fstrong> – \u003Ca href=\"https:\u002F\u002Fwww.limitloginattempts.com\u002Fblock-logins-by-country-in-wordpress\u002F\" rel=\"nofollow ugc\">Block logins by country\u003C\u002Fa> by simply selecting the countries you want to deny.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Auto IP Denylist\u003C\u002Fstrong> – Automatically add IP addresses to your active cloud deny list that repeatedly fail login attempts.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>New User Registration Protection\u003C\u002Fstrong> – Protects default WP registration.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Global Denylist Protection\u003C\u002Fstrong> – Utilize our active cloud IP data from thousands of websites in the LLAR network.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Synchronized Lockouts\u003C\u002Fstrong> –  Lockout IP data can be shared between multiple domains for enhanced protection in your network.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Synchronized Safelist\u002FDenylist\u003C\u002Fstrong> – Safelist\u002FDenylist IP and username data can be shared between multiple domains.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Premium Support\u003C\u002Fstrong> – Email support with a security tech.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Auto Backups of All IP Data\u003C\u002Fstrong> – Store your active IP data in the cloud.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Successful Logins Log\u003C\u002Fstrong> – Store successful logins in the cloud including IP info, city, state and lat\u002Flong.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Enhanced lockout logs\u003C\u002Fstrong> – Gain valuable insights into the origins of IPs that are attempting logins.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>CSV Download of IP Data\u003C\u002Fstrong> – Download IP data direclty from the cloud.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Supports IPV6 Ranges For Safelist\u002FDenylist\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Unlock The Locked Admin\u003C\u002Fstrong> – Easily \u003Ca href=\"https:\u002F\u002Fwww.limitloginattempts.com\u002Fhow-to-unlock-your-site-if-you-are-locked-out-by-limit-login-attempts-reloaded\u002F\" rel=\"nofollow ugc\">unlock the locked admin\u003C\u002Fa> through the cloud.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>*Some features require higher level plans.\u003C\u002Fp>\n\u003Ch4>Upgrading from the old Limit Login Attempts plugin?\u003C\u002Fh4>\n\u003Col>\n\u003Cli>Go to the Plugins section in your site’s backend.\u003C\u002Fli>\n\u003Cli>Remove the Limit Login Attempts plugin.\u003C\u002Fli>\n\u003Cli>Install the Limit Login Attempts Reloaded plugin.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>All your settings will be kept intact!\u003C\u002Fp>\n\u003Cp>Many languages are currently supported in the Limit Login Attempts Reloaded plugin but we welcome any additional ones.\u003C\u002Fp>\n\u003Cp>Help us bring Limit Login Attempts Reloaded to even more countries.\u003C\u002Fp>\n\u003Cp>Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish\u003C\u002Fp>\n\u003Cp>Plugin uses standard actions and filters only.\u003C\u002Fp>\n\u003Cp>Based on the original code from Limit Login Attempts plugin by Johan Eenfeldt.\u003C\u002Fp>\n\u003Ch4>Branding Guidelines\u003C\u002Fh4>\n\u003Cp>Limit Login Attempts Reloaded™ is a trademark of Atlantic Silicon Inc. When writing about the plugin, please make sure to use Reloaded after Limit Login Attempts. Limit Login Attempts is the old plugin.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Limit Login Attempts Reloaded (correct)\u003C\u002Fli>\n\u003Cli>Limit Login Attempts (incorrect)\u003C\u002Fli>\n\u003C\u002Ful>\n","Block excessive login attempts and protect your site against brute force attacks. Simple, yet powerful tools to improve site performance.",2000000,79399145,98,1441,"2026-01-12T16:01:00.000Z","6.9.4","3.0","",[20,21,22,23,24],"2fa","brute-force","firewall","login-security","security","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flimit-login-attempts-reloaded.2.26.28.zip",4,0,"2023-12-20 00:00:00","2026-03-15T15:16:48.613Z",[31,47,62,77],{"id":32,"url_slug":33,"title":34,"description":35,"plugin_slug":4,"theme_slug":36,"affected_versions":37,"patched_in_version":38,"severity":39,"cvss_score":40,"cvss_vector":41,"vuln_type":42,"published_date":28,"updated_date":43,"references":44,"days_to_patch":46},"CVE-2023-6934","limit-login-attempts-reloaded-authenticated-contributor-stored-cross-site-scripting-via-shortcode","Limit Login Attempts Reloaded \u003C= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",null,"\u003C=2.25.26","2.25.27","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2024-07-29 21:36:51",[45],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F906049c0-4710-47aa-bf44-cdf29032dc1f?source=api-prod",223,{"id":48,"url_slug":49,"title":50,"description":51,"plugin_slug":4,"theme_slug":36,"affected_versions":52,"patched_in_version":53,"severity":39,"cvss_score":54,"cvss_vector":55,"vuln_type":56,"published_date":57,"updated_date":58,"references":59,"days_to_patch":61},"CVE-2023-5525","limit-login-attempts-reloaded-missing-authorization","Limit Login Attempts Reloaded \u003C= 2.25.25 - Missing Authorization","The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_auto_update() function hooked via AJAX in all versions up to, and including, 2.25.25. This makes it possible for authenticated attackers, with access to a valid nonce, to toggle auto-updates for the plugin on and off.","\u003C=2.25.25","2.25.26",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2023-11-06 00:00:00","2024-01-22 19:56:02",[60],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F1df31843-0af7-486c-b0aa-4eaf72a7e70f?source=api-prod",78,{"id":63,"url_slug":64,"title":65,"description":66,"plugin_slug":4,"theme_slug":36,"affected_versions":67,"patched_in_version":68,"severity":69,"cvss_score":70,"cvss_vector":71,"vuln_type":72,"published_date":73,"updated_date":58,"references":74,"days_to_patch":76},"CVE-2020-35590","limit-login-attempts-reloaded-login-rate-limiting-bypass","Limit Login Attempts Reloaded \u003C= 2.17.3 - Login Rate Limiting Bypass","LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.","\u003C=2.17.3","2.17.4","high",7.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L","Improper Restriction of Excessive Authentication Attempts","2020-12-14 00:00:00",[75],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F669c50b8-316c-4f63-8b78-361cfcfd4d5f?source=api-prod",1135,{"id":78,"url_slug":79,"title":80,"description":81,"plugin_slug":4,"theme_slug":36,"affected_versions":82,"patched_in_version":68,"severity":39,"cvss_score":83,"cvss_vector":84,"vuln_type":42,"published_date":73,"updated_date":58,"references":85,"days_to_patch":76},"CVE-2020-35589","limit-login-attempts-reloaded-reflected-cross-site-scripting","Limit Login Attempts Reloaded \u003C= 2.15.2 - Reflected Cross-Site Scripting","The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin\u002Foptions-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.","\u003C=2.15.2",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[86],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8a052ca1-2c2c-4c8a-9213-5f01b0fa70dd?source=api-prod",{"slug":88,"display_name":7,"profile_url":8,"plugin_count":89,"total_installs":90,"avg_security_score":91,"avg_patch_time_days":92,"trust_score":93,"computed_at":94},"wpchefgadget",3,2003200,89,643,71,"2026-04-03T19:24:18.513Z",[96,113,136,157,177],{"slug":97,"name":98,"version":99,"author":100,"author_profile":101,"description":102,"short_description":103,"active_installs":27,"downloaded":104,"rating":27,"num_ratings":27,"last_updated":105,"tested_up_to":16,"requires_at_least":106,"requires_php":107,"tags":108,"homepage":18,"download_link":111,"security_score":112,"vuln_count":27,"unpatched_count":27,"last_vuln_date":36,"fetched_at":29},"vmpfence-security","VMP Security – Firewall, Malware Scan, and Login Security","2.2.5","VMP™","https:\u002F\u002Fprofiles.wordpress.org\u002Ftanveer269\u002F","\u003Cp>\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FQavtowPq0TQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\u003C\u002Fp>\n\u003Ch4>Advanced Firewall and Security Scanner\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Tired of worrying about your WordPress site getting hacked?\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>VMP Security is like having a professional security team watching your website 24\u002F7. We combine a powerful firewall, intelligent malware scanner, and advanced threat detection to keep your site safe from hackers, malware, and security vulnerabilities.\u003C\u002Fp>\n\u003Ch3>Why Choose VMP Security?\u003C\u002Fh3>\n\u003Cp>✅ \u003Cstrong>Comprehensive Real-Time Protection\u003C\u002Fstrong> – Advanced security features that detect and stop attacks in real-time.\u003Cbr \u002F>\n✅ \u003Cstrong>Easy to Use\u003C\u002Fstrong> – Set it up in 5 minutes. No security degree required.\u003Cbr \u002F>\n✅ \u003Cstrong>Performance Optimized\u003C\u002Fstrong> – Won’t slow down your site. Runs efficiently in the background.\u003Cbr \u002F>\n✅ \u003Cstrong>Always Up-to-Date\u003C\u002Fstrong> – Our 280+ firewall rules and malware signatures are constantly updated.\u003Cbr \u002F>\n✅ \u003Cstrong>Complete Coverage\u003C\u002Fstrong> – Firewall, malware scanner, 2FA, brute force protection, and more in one plugin.\u003C\u002Fp>\n\u003Ch3>🔥 Web Application Firewall (WAF)\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Think of it as a security guard for your website.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Our firewall inspects every visitor before they reach your WordPress site. Bad guys? Blocked instantly. Legitimate visitors? They won’t even notice we’re there.\u003C\u002Fp>\n\u003Ch3>What It Protects Against:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>SQL Injection\u003C\u002Fstrong> – Hackers trying to steal your database\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Cross-Site Scripting (XSS)\u003C\u002Fstrong> – Malicious code injection\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Remote File Inclusion (RFI)\u003C\u002Fstrong> – Attempts to upload backdoors\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Local File Inclusion (LFI)\u003C\u002Fstrong> – Unauthorized file access\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Command Injection\u003C\u002Fstrong> – Server takeover attempts\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Path Traversal\u003C\u002Fstrong> – Directory browsing attacks\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Key Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>280+ Built-in Security Rules\u003C\u002Fstrong> – Covering all major attack types\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Zero-Day Protection\u003C\u002Fstrong> – Pattern-based detection catches new threats\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Attack Logging\u003C\u002Fstrong> – See exactly who’s trying to hack you\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Custom Rules\u003C\u002Fstrong> – Add your own protection patterns\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Learning Mode\u003C\u002Fstrong> – Fine-tune rules based on your legitimate traffic\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IP Blocking\u003C\u002Fstrong> – Automatic permanent bans for repeat offenders\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🚀 Extended Protection (WAF Optimizer)\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Run the firewall before WordPress — stop attacks before vulnerable code can execute.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>By default, the firewall loads as a WordPress plugin. Extended Protection takes it a step further by running the firewall \u003Cem>before\u003C\u002Fem> WordPress and all other plugins load, so malicious requests are blocked before any potentially vulnerable code has a chance to run.\u003C\u002Fp>\n\u003Ch3>Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Pre-WordPress Execution\u003C\u002Fstrong> – Firewall processes every request before WordPress core loads\u003C\u002Fli>\n\u003Cli>\u003Cstrong>One-Click Optimization\u003C\u002Fstrong> – Guided wizard to enable extended protection safely\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Safe Removal\u003C\u002Fstrong> – Dedicated removal wizard to revert changes cleanly\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Automatic Backup\u003C\u002Fstrong> – Download a backup of your server configuration before any changes\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Server Auto-Detection\u003C\u002Fstrong> – Automatically detects Apache or LiteSpeed and configures accordingly\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Multisite Aware\u003C\u002Fstrong> – Configurable from the main site of a WordPress multisite network\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Protection Level Indicator\u003C\u002Fstrong> – See at a glance whether basic or extended protection is active\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🛡️ Brute Force Protection\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Stop password guessing attacks before they succeed.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Hackers use bots to try thousands of password combinations. We stop them cold.\u003C\u002Fp>\n\u003Ch3>Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Smart Login Limiting\u003C\u002Fstrong> – Lock out IPs after failed attempts\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Invalid Username Blocking\u003C\u002Fstrong> – Instant block for fake usernames\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Leaked Password Detection\u003C\u002Fstrong> – Check credentials against breach databases\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Strong Password Enforcement\u003C\u002Fstrong> – Force admins and users to use secure passwords\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Username Blacklist\u003C\u002Fstrong> – Block known malicious usernames instantly\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Permanent Bans\u003C\u002Fstrong> – Get rid of persistent attackers for good\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>⚡ Rate Limiting & Bot Protection\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Prevent site scraping, resource exhaustion, and vulnerability scanning.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Not all attacks are malicious code. Some attackers just overwhelm your site with requests. We stop that too.\u003C\u002Fp>\n\u003Ch3>What We Control:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Request Limits\u003C\u002Fstrong> – Maximum requests per IP per time period\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Human vs Bot Detection\u003C\u002Fstrong> – Smart classification of traffic\u003C\u002Fli>\n\u003Cli>\u003Cstrong>404 Error Monitoring\u003C\u002Fstrong> – Detect scanning attempts\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Google Crawler Handling\u003C\u002Fstrong> – Special treatment for legitimate search engines\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Throttling or Blocking\u003C\u002Fstrong> – Slow down or stop violators\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Allowlist Support\u003C\u002Fstrong> – Whitelist your own IPs and trusted services\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🌍 Country Blocking\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Block entire countries from accessing your site.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Protect your WordPress site from geo-targeted attacks by blocking traffic from specific countries. Perfect for sites with regional focus or facing attacks from certain locations.\u003C\u002Fp>\n\u003Ch3>Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Comprehensive Geo-Blocking\u003C\u002Fstrong> – Block any country by ISO code\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Granular Control\u003C\u002Fstrong> – Block login only or entire site access\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Block Statistics\u003C\u002Fstrong> – Track attempts and blocks per country\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Top Attackers Report\u003C\u002Fstrong> – See which countries attack you most\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Temporary Blocks\u003C\u002Fstrong> – Set expiration times for country blocks\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Permanent Blocks\u003C\u002Fstrong> – Long-term protection from persistent threats\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Detailed Logging\u003C\u002Fstrong> – Complete audit trail with IP, country, and request data\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Attack Analytics\u003C\u002Fstrong> – Visual reports showing attack patterns by country\u003C\u002Fli>\n\u003Cli>\u003Cstrong>GeoIP Integration\u003C\u002Fstrong> – Automatic IP-to-country lookup with IP2Location\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Auto-Updates\u003C\u002Fstrong> – GeoIP database updates automatically\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🎯 Custom Pattern Matching\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Block threats using advanced pattern matching.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Go beyond simple IP blocking. Create sophisticated blocking rules based on hostnames, user agents, referrers, and IP ranges.\u003C\u002Fp>\n\u003Ch3>Pattern Types:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Hostname Blocking\u003C\u002Fstrong> – Block specific domains or wildcard patterns\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User Agent Blocking\u003C\u002Fstrong> – Stop malicious bots and scrapers\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Referrer Blocking\u003C\u002Fstrong> – Block traffic from specific sources\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IP Range Blocking\u003C\u002Fstrong> – CIDR notation support for network blocks\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Wildcard Patterns\u003C\u002Fstrong> – Flexible matching with * wildcards\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Regex Support\u003C\u002Fstrong> – Advanced users can use regular expressions\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Management Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Pattern Groups\u003C\u002Fstrong> – Organize related patterns together\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Match Statistics\u003C\u002Fstrong> – Track how often patterns trigger\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Active\u002FInactive\u003C\u002Fstrong> – Enable or disable patterns without deleting\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Source Tracking\u003C\u002Fstrong> – Know if patterns are local or from sync service\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reason Logging\u003C\u002Fstrong> – Document why each pattern was created\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Match History\u003C\u002Fstrong> – See when patterns last matched\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🚫 Blocking Options\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Centralized management for all blocking features.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Manage all your site’s blocking rules from one convenient location. Control who can access your site and how.\u003C\u002Fp>\n\u003Ch3>Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>IP Blocking\u003C\u002Fstrong> – Block individual IPs or entire IP ranges using CIDR notation\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Country Blocking\u003C\u002Fstrong> – Block entire countries from accessing your site\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Pattern Blocking\u003C\u002Fstrong> – Create custom blocking rules based on hostnames, user agents, and referrers\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Temporary Blocks\u003C\u002Fstrong> – Set time-limited blocks that expire automatically\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Permanent Blocks\u003C\u002Fstrong> – Long-term protection from persistent threats\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Block Statistics\u003C\u002Fstrong> – See what’s being blocked and why with detailed analytics\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Allowlist Management\u003C\u002Fstrong> – Whitelist trusted IPs and services to bypass all blocks\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Unified Dashboard\u003C\u002Fstrong> – Manage all blocking types in one place\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🔐 Two-Factor Authentication (2FA)\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Add an extra layer of security to your WordPress login.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Even if someone steals your password, they can’t get in without the second factor.\u003C\u002Fp>\n\u003Ch3>Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>QR Code Setup\u003C\u002Fstrong> – Easy configuration with any authenticator app\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Backup Codes\u003C\u002Fstrong> – Never get locked out of your own site\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User Management\u003C\u002Fstrong> – Force 2FA for admins or specific roles\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Frontend 2FA Management\u003C\u002Fstrong> – Users can manage their own 2FA settings\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Email Notifications\u003C\u002Fstrong> – Get notified when 2FA is enabled\u002Fdisabled\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Shortcode Support\u003C\u002Fstrong> – Add 2FA controls anywhere on your site\u003C\u002Fli>\n\u003Cli>\u003Cstrong>XML-RPC Protection\u003C\u002Fstrong> – Require 2FA for XML-RPC requests\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WooCommerce Integration\u003C\u002Fstrong> – Secure your online store checkout\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🔍 Advanced Malware Scanner\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Multiple specialized scanners working together to find threats.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>We don’t just look for known malware. Our intelligent scanner detects suspicious patterns, unauthorized changes, and hidden backdoors.\u003C\u002Fp>\n\u003Ch3>Our Security Scanners:\u003C\u002Fh3>\n\u003Col>\n\u003Cli>\u003Cstrong>Malware Scanner\u003C\u002Fstrong> – Detects backdoors, trojans, and malicious code from our 40,000+ malware scanner\u003C\u002Fli>\n\u003Cli>\u003Cstrong>File Integrity Monitor\u003C\u002Fstrong> – Compares files against official WordPress versions\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Vulnerability Scanner\u003C\u002Fstrong> – Identifies security flaws in plugins and themes\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User Security Scanner\u003C\u002Fstrong> – Finds suspicious admin accounts\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Content Safety Scanner\u003C\u002Fstrong> – Analyzes posts\u002Fcomments for malicious content\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Public Files Scanner\u003C\u002Fstrong> – Detects exposed configuration files\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Server State Scanner\u003C\u002Fstrong> – Monitors server security settings\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Binary Scanner\u003C\u002Fstrong> – Checks images and executables for embedded malware\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Domain Reputation Scanner\u003C\u002Fstrong> – Verifies URLs against threat databases\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch3>Scan Types:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Quick Scan\u003C\u002Fstrong> – Critical files only (2-5 minutes)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Standard Scan\u003C\u002Fstrong> – Balanced coverage (6-12 minutes)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>High Sensitivity Scan\u003C\u002Fstrong> – Complete site analysis (10-25 minutes)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Custom Scan\u003C\u002Fstrong> – Choose exactly what to scan\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🚨 Advanced Threat Detection\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Advanced pattern matching and behavioral analysis.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>Intelligent Detection:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Pattern Analysis\u003C\u002Fstrong> – Detects obfuscated and encrypted malware\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Behavior Analysis\u003C\u002Fstrong> – Identifies suspicious file operations\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reputation Checking\u003C\u002Fstrong> – Validates URLs against Google Safe Browsing\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Legitimacy Assessment\u003C\u002Fstrong> – Distinguishes real threats from false positives\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Unknown File Detection\u003C\u002Fstrong> – Flags files that shouldn’t be there\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Password Breach Checking\u003C\u002Fstrong> – Scans for compromised credentials\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>📊 Live Traffic Monitor & Event Tracking\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>See exactly what’s happening on your site in real-time.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Real-Time Traffic View\u003C\u002Fstrong> – Watch visitors and attacks as they happen\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Event Logging\u003C\u002Fstrong> – Complete audit trail of security events\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Attack Statistics\u003C\u002Fstrong> – Visual dashboards showing threats over time\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IP Intelligence\u003C\u002Fstrong> – WHOIS lookup and IP reputation checking\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Human vs Bot Tracking\u003C\u002Fstrong> – Classify and analyze traffic patterns\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Export Capabilities\u003C\u002Fstrong> – Download logs and reports for analysis\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🎛️ Easy-to-Use Dashboard\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>All your security in one place. No tech degree required.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>What You Get:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Security Status\u003C\u002Fstrong> – Green, yellow, or red. Know your status at a glance\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Recent Attacks\u003C\u002Fstrong> – See who’s trying to hack you\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Scan Results\u003C\u002Fstrong> – Detailed reports with clear action items\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Firewall Status\u003C\u002Fstrong> – Protection levels and rule statistics\u003C\u002Fli>\n\u003Cli>\u003Cstrong>One-Click Actions\u003C\u002Fstrong> – Block IPs, ignore false positives, repair files\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Scheduled Scans\u003C\u002Fstrong> – Set it and forget it\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>⚙️ Advanced Features for Power Users\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Need more control? We’ve got you covered.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Custom Firewall Rules\u003C\u002Fstrong> – Write your own protection patterns\u003C\u002Fli>\n\u003Cli>\u003Cstrong>File Exclusions\u003C\u002Fstrong> – Skip certain directories or file types\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Performance Tuning\u003C\u002Fstrong> – Adjust memory limits and timeouts\u003C\u002Fli>\n\u003Cli>\u003Cstrong>API Integrations\u003C\u002Fstrong> – Google Safe Browsing, IP reputation databases\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IPv4\u002FIPv6 Support\u003C\u002Fstrong> – Dual-stack or IPv4-only mode\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Multisite Compatible\u003C\u002Fstrong> – Works perfectly with WordPress networks\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Developer Friendly\u003C\u002Fstrong> – Hooks and filters for customization\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Sync Service\u003C\u002Fstrong> – Central management for multiple sites\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🔒 Privacy & Your Data\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Your site data and scan results stay on your server. Optional features like settings export use secure cloud storage.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>What We DON’T Do:\u003C\u002Fh3>\n\u003Cp>❌ We don’t send your file content or database data to external servers\u003Cbr \u002F>\n❌ We don’t track your users\u003Cbr \u002F>\n❌ We don’t collect analytics about your site\u003Cbr \u002F>\n❌ We don’t send data without your knowledge\u003C\u002Fp>\n\u003Ch3>External Services (Optional):\u003C\u002Fh3>\n\u003Cp>We use external services only when necessary for specific security features. You can see exactly what’s sent:\u003C\u002Fp>\n\u003Cp>\u003Cstrong>VMP Security Servers\u003C\u002Fstrong>\u003Cbr \u002F>\n* License activation and validation (free\u002Fpremium)\u003Cbr \u002F>\n* WAF rules synchronization and updates\u003Cbr \u002F>\n* Malware signature database updates\u003Cbr \u002F>\n* Two-Factor Authentication (2FA) system management\u003Cbr \u002F>\n* Settings export\u002Fimport cloud storage(optional)\u003Cbr \u002F>\n* Privacy: Your site data remains on your server – only configuration and security rules are synced\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Google Services\u003C\u002Fstrong> (safebrowsing.googleapis.com, www.google.com\u002Frecaptcha)\u003Cbr \u002F>\n* URL threat detection and reCAPTCHA spam protection\u003Cbr \u002F>\n* Privacy: https:\u002F\u002Fpolicies.google.com\u002Fprivacy\u003C\u002Fp>\n\u003Cp>\u003Cstrong>WordPress.org APIs\u003C\u002Fstrong> (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org)\u003Cbr \u002F>\n* Download original files for integrity checking during malware scans\u003Cbr \u002F>\n* Privacy: https:\u002F\u002Fwordpress.org\u002Fabout\u002Fprivacy\u002F\u003C\u002Fp>\n\u003Cp>\u003Cstrong>GitHub\u003C\u002Fstrong> (raw.githubusercontent.com)\u003Cbr \u002F>\n* Download WordPress core files for file comparison\u003C\u002Fp>\n\u003Cp>\u003Cstrong>IP Lookup Services\u003C\u002Fstrong> (api.ipify.org, ifconfig.me, icanhazip.com, ip-api.com, ipwhois.app, download.ip2location.com)\u003Cbr \u002F>\n* Server IP detection, geolocation, and country blocking features\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Threat Intelligence\u003C\u002Fstrong> (api.urlvoid.com, www.virustotal.com, checkurl.phishtank.com)\u003Cbr \u002F>\n* URL reputation checking and threat validation\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Vulnerability Databases\u003C\u002Fstrong> (services.nvd.nist.gov, wpscan.com, cvedetails.com, cve.mitre.org)\u003Cbr \u002F>\n* Check for known security vulnerabilities during scans\u003C\u002Fp>\n\u003Cp>\u003Cstrong>All malware scanning happens on YOUR server.\u003C\u002Fstrong> We do not upload your files or database content to external services except for certain features used by the user.\u003C\u002Fp>\n\u003Ch3>🛠️ Advanced Tools\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Professional-grade tools for site management and troubleshooting.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>Diagnostics Tool\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Comprehensive system health check to troubleshoot issues quickly.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Run 15+ diagnostic tests to verify your site’s security configuration and identify potential problems:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Plugin Status\u003C\u002Fstrong> – Check if VMP Security is working correctly\u003C\u002Fli>\n\u003Cli>\u003Cstrong>File Permissions\u003C\u002Fstrong> – Verify read\u002Fwrite access to critical directories\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Connectivity Tests\u003C\u002Fstrong> – Ensure your site can communicate with security services\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Time Sync\u003C\u002Fstrong> – Verify server time is accurate for security features\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WordPress Health\u003C\u002Fstrong> – Complete audit of WordPress configuration\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Plugins & Themes\u003C\u002Fstrong> – View all installed plugins and themes with versions\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Scheduled Tasks\u003C\u002Fstrong> – Monitor cron jobs to ensure scans run on time\u003C\u002Fli>\n\u003Cli>\u003Cstrong>PHP Environment\u003C\u002Fstrong> – Check PHP version and required extensions\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Firewall Status\u003C\u002Fstrong> – Verify WAF is protecting your site\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Settings Export\u002FImport\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Backup and migrate your security configuration easily.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Cloud-based configuration backup and migration using secure tokens:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Generate Export Token\u003C\u002Fstrong> – Upload settings to VMP server and receive a unique token\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Cloud Storage\u003C\u002Fstrong> – Your settings are securely stored on VMP servers\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Easy Import\u003C\u002Fstrong> – Use the token to download settings on any site\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Site Migration\u003C\u002Fstrong> – Quickly migrate security settings between sites\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Configuration Backup\u003C\u002Fstrong> – Keep your settings safe in the cloud\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Flexible Import\u003C\u002Fstrong> – Choose to merge with or replace existing settings\u003C\u002Fli>\n\u003C\u002Ful>\n","Your all-in-one WordPress security solution. Stop hackers with our firewall, detect malware before it spreads, and protect your site.",765,"2026-03-05T09:58:00.000Z","5.0","7.4",[20,109,22,110,24],"brute-force-protection","malware-scanner","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvmpfence-security.2.2.5.zip",100,{"slug":114,"name":115,"version":116,"author":117,"author_profile":118,"description":119,"short_description":120,"active_installs":121,"downloaded":122,"rating":123,"num_ratings":124,"last_updated":125,"tested_up_to":16,"requires_at_least":126,"requires_php":127,"tags":128,"homepage":131,"download_link":132,"security_score":133,"vuln_count":134,"unpatched_count":27,"last_vuln_date":135,"fetched_at":29},"wordfence","Wordfence Security – Firewall, Malware Scan, and Login Security","8.1.4","Mark Maunder","https:\u002F\u002Fprofiles.wordpress.org\u002Fmmaunder\u002F","\u003Cp>\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002Fi4ZN2TwlaBE?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\u003C\u002Fp>\n\u003Ch4>THE MOST POPULAR WORDPRESS FIREWALL & SECURITY SCANNER\u003C\u002Fh4>\n\u003Cp>WordPress security requires a team of dedicated analysts researching the latest malware variants and WordPress exploits, turning them into firewall rules and malware signatures, and releasing those to customers in real-time.\u003C\u002Fp>\n\u003Cp>Choose the right protection for you: \u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fproducts\u002Fpricing\u002F\" rel=\"nofollow ugc\">Wordfence Free, Premium, Care or Response\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Wordfence is widely acknowledged as the number one WordPress security research team in the World. Our plugin provides a comprehensive suite of security features, and our team’s research is what powers our plugin and provides the level of security that we are known for.\u003C\u002Fp>\n\u003Cp>At Wordfence, WordPress security isn’t a division of our business – WordPress security is all we do. We employ a global 24-hour dedicated incident response team that provides our priority customers with a 1 hour response time for any security incident.\u003C\u002Fp>\n\u003Cp>The sun never sets on our global security team and we run a sophisticated threat intelligence platform to aggregate, analyze and produce ground breaking security research on the newest security threats.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Wordfence Security includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more.\u003C\u002Fstrong> Our \u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002F\" rel=\"nofollow ugc\">Threat Defense Feed\u003C\u002Fa> arms Wordfence with the newest firewall rules, malware signatures, and malicious IP addresses it needs to keep your website safe.\u003C\u002Fp>\n\u003Cp>Rounded out by 2FA and a suite of additional features, Wordfence is the most comprehensive WordPress security solution available.\u003C\u002Fp>\n\u003Ch3>🔥 WORDPRESS FIREWALL\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Ffirewall\u002F\" rel=\"nofollow ugc\">Web Application Firewall\u003C\u002Fa>\u003C\u002Fstrong> identifies and blocks malicious traffic. Built and maintained by a large team focused 100% on WordPress security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Real-time firewall rule and malware signature [Premium]\u003C\u002Fstrong> updates via the Threat Defense Feed (free version is delayed by 30 days).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Fblocking\u002F\" rel=\"nofollow ugc\">Real-time IP Blocklist\u003C\u002Fa> [Premium]\u003C\u002Fstrong> blocks all requests from the most malicious IPs, protecting your site while reducing load.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Protects your site at the endpoint\u003C\u002Fstrong>, enabling deep integration with WordPress. Unlike cloud alternatives, it does not break encryption, cannot be bypassed and cannot leak data.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Fscan\u002F\" rel=\"nofollow ugc\">Integrated malware scanner\u003C\u002Fa>\u003C\u002Fstrong> blocks requests that include malicious code or content.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Ffirewall\u002Fbrute-force\u002F\" rel=\"nofollow ugc\">Protection from brute force\u003C\u002Fa>\u003C\u002Fstrong> attacks by limiting login attempts.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>📡 WORDPRESS SECURITY SCANNER\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Malware scanner\u003C\u002Fstrong> checks core files, themes and plugins for malware, bad URLs, backdoors, SEO spam, malicious redirects and code injections.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Real-time malware signature updates [Premium]\u003C\u002Fstrong> via the Threat Defense Feed (free version is delayed by 30 days).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Compares with WordPress.org repository\u003C\u002Fstrong> your core files, themes and plugins, checking their integrity and reporting any changes to you.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Repair WordPress core, theme, and plugin files\u003C\u002Fstrong> that have changed by overwriting them with a pristine, original version. Delete any files that don’t belong easily within the Wordfence interface.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Malware Removal Tools\u003C\u002Fstrong> “Delete File” and “Delete All Deletable Files” options allow for efficient malware removal. Remember to investigate the scan results and backup files first!\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Checks your site for known security vulnerabilities\u003C\u002Fstrong> and alerts you to any issues. Also alerts you to potential security issues when a plugin has been closed or abandoned.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Checks your content safety\u003C\u002Fstrong> by scanning file contents, posts and comments for dangerous URLs and suspicious content.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Checks to see if your site or IP have been blocklisted [Premium]\u003C\u002Fstrong> for malicious activity, generating spam or other security issues.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🔒 LOGIN SECURITY\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Ftools\u002Ftwo-factor-authentication\u002F\" rel=\"nofollow ugc\">Two-factor authentication (2FA)\u003C\u002Fa>\u003C\u002Fstrong>, one of the most secure forms of remote system authentication available via any TOTP-based authenticator app or service.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Flogin-security\u002F\" rel=\"nofollow ugc\">Login Page CAPTCHA\u003C\u002Fa>\u003C\u002Fstrong> stops bots from logging in.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Flogin-security\u002F#woocommerce-and-custom-integrations\" rel=\"nofollow ugc\">2FA for WooCommerce and custom integrations\u003C\u002Fa>\u003C\u002Fstrong> allow for 2FA to be setup on custom account pages\u003C\u002Fli>\n\u003Cli>\u003Cstrong>XML-RPC\u003C\u002Fstrong> options including disabling or adding 2FA.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Password Security:\u003C\u002Fstrong> Block logins for administrators using known compromised passwords.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>📋 SECURITY AUDIT LOG [Premium]\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Faudit-log\" rel=\"nofollow ugc\">The Audit Log\u003C\u002Fa>\u003C\u002Fstrong> monitors all changes and actions in security-sensitive areas of the site.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Remote tamper-proof data storage\u003C\u002Fstrong> via Wordfence Central.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Monitor events and actions\u003C\u002Fstrong> ranging  from user creation and editing to plugin\u002Ftheme installation and updates to post and page changes.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Configurable\u003C\u002Fstrong> to log all events or significant events only, which includes all authentication, site configuration, and site functionality events.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🌐 WORDFENCE CENTRAL\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fproducts\u002Fwordfence-central\u002F\" rel=\"nofollow ugc\">Wordfence Central\u003C\u002Fa>\u003C\u002Fstrong> is a powerful and efficient way to manage the security for multiple sites in one place.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Centralized management:\u003C\u002Fstrong> Efficiently assess the security status of all your websites in one view. View detailed security findings without leaving Wordfence Central.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Powerful templates\u003C\u002Fstrong> make configuring Wordfence a breeze.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Highly configurable alerts\u003C\u002Fstrong> can be delivered via email, SMS or Slack. Improve the signal to noise ratio by leveraging severity level options and a daily digest option.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Track and alert on important security events\u003C\u002Fstrong> including administrator logins, breached password usage and surges in attack activity.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Free to use\u003C\u002Fstrong> for unlimited sites.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🛠️ SECURITY TOOLS\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Ftools\u002Flive-traffic\u002F\" rel=\"nofollow ugc\">Live Traffic\u003C\u002Fa>\u003C\u002Fstrong> monitors visits and hack attempts not shown in other analytics packages in real time; including origin, their IP address, the time of day and time spent on your site.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Block attackers by IP\u003C\u002Fstrong> or build advanced rules based on IP Range, Hostname, User Agent and Referrer.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fwww.wordfence.com\u002Fhelp\u002Fblocking\u002Fcountry-blocking\u002F\" rel=\"nofollow ugc\">Country blocking\u003C\u002Fa>\u003C\u002Fstrong> available with Wordfence Premium.\u003C\u002Fli>\n\u003C\u002Ful>\n","Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.",5000000,406617999,94,4829,"2025-12-20T21:06:00.000Z","4.7","7.0",[20,22,129,130,24],"malware","scanner","https:\u002F\u002Fwww.wordfence.com\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwordfence.8.1.4.zip",96,12,"2022-09-06 00:00:00",{"slug":137,"name":138,"version":139,"author":140,"author_profile":141,"description":142,"short_description":143,"active_installs":144,"downloaded":145,"rating":123,"num_ratings":146,"last_updated":147,"tested_up_to":16,"requires_at_least":106,"requires_php":148,"tags":149,"homepage":152,"download_link":153,"security_score":154,"vuln_count":155,"unpatched_count":27,"last_vuln_date":156,"fetched_at":29},"all-in-one-wp-security-and-firewall","All-In-One Security (AIOS) – Security and Firewall","5.4.6","David Anderson \u002F Team Updraft","https:\u002F\u002Fprofiles.wordpress.org\u002Fdavidanderson\u002F","\u003Ch3>THE TOP RATED WORDPRESS SECURITY AND FIREWALL PLUGIN\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fteamupdraft.com\u002Fall-in-one-security?utm_source=aios-wp-dir&utm_medium=referral&utm_campaign=plugin-dir&utm_content=aios&utm_creative_format=description\" rel=\"nofollow ugc\">All-in-One Security (AIOS)\u003C\u002Fa> is a WordPress security plugin from the same, trusted team that brought you UpdraftPlus.\u003C\u002Fp>\n\u003Cp>It’s called ‘All-In-One’ because it’s packed full of ways to keep your WordPress website(s) safe and secure.\u003C\u002Fp>\n\u003Cp>It includes:\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Login security features\u003C\u002Fstrong> keep bots at bay. Lock out users based on a configurable number of login attempts, get two-factor authentication and more.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>File and database security.\u003C\u002Fstrong> Get notified of file changes that occur outside of normal operations. Block access to key files and scan files and folders to spot insecure permissions.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Firewall.\u003C\u002Fstrong> Get PHP, .htaccess and 6G firewall rules courtesy of Perishable Press. Spot and block fake Google Bots and more!\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Spam prevention.\u003C\u002Fstrong> Prevent annoying spam comments and reduce unnecessary load on the server. Automatically and permanently block IP addresses that exceed a set number of spam comments.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Audit log.\u003C\u002Fstrong> View events happening on your WordPress website. Find out if a plugin or theme has been added, removed, updated and more.\u003C\u002Fp>\n\u003Ch4>WHY ALL-IN-ONE SECURITY?\u003C\u002Fh4>\n\u003Cp>AIOS has a near-perfect \u003Cstrong>4.7 \u002F 5-star user rating\u003C\u002Fstrong> across more than 1 million installs.\u003C\u002Fp>\n\u003Cp>Great for beginners and experts alike. AIOS guides you logically and clearly through each of its features which are all clearly explained. Security features are marked as basic, intermediate and advanced. Each step increases your security score. Turn them on and watch your protection grow!\u003C\u002Fp>\n\u003Cp>We have a large support team of software developers. That means we have the availability and the skillset to help you with the trickiest of queries.\u003C\u002Fp>\n\u003Cp>We comb the WordPress plugin directory for support tickets daily – most queries are responded to within 24 hours.\u003C\u002Fp>\n\u003Cp>\u003Cem>Excellent plugin with numerous well-thought-out options for making a website more secure. I have been using it for years and am very happy with it. I recently had a small problem setting up a website and – even as a non-premium user – I received support very quickly. Highly recommended!\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>For even more ways to stay safe and secure, upgrade to \u003Ca href=\"https:\u002F\u002Fteamupdraft.com\u002Fall-in-one-security\u002Fpricing?utm_source=aios-wp-dir&utm_medium=referral&utm_campaign=plugin-dir&utm_content=aios_premium&utm_creative_format=description\" rel=\"nofollow ugc\">AIOS Premium\u003C\u002Fa> – it packs a punch security-wise, whilst being \u003Cstrong>extremely cost-competitive\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Ch4>LOGIN SECURITY\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Two-factor authentication (TFA)\u003C\u002Fstrong> – Require TFA for specific user roles. Supports Google Authenticator, Microsoft Authenticator, Authy, and many more.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detect and manage ‘admin’ usernames\u003C\u002Fstrong> – Identify default ‘admin’ usernames and guide users to change them to protect against brute force attacks.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Identify and correct identical login and display names\u003C\u002Fstrong> – Detect cases where the display name matches the username and provide guidance to improve login security.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Prevent user enumeration\u003C\u002Fstrong> – Block unauthorised access to URLs that can reveal sensitive information such as usernames or other details.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Control login attempts\u003C\u002Fstrong> – Prevent brute force attacks by limiting the number of failed login attempts. Choose how many login attempts are allowed, set lockout durations, and more.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Force user logout\u003C\u002Fstrong> – Automatically log out users after a specified period of time. Unattended sessions are closed, reducing the risk of unauthorised access.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Manually approve new registrations\u003C\u002Fstrong> – Review and approve new user registrations to prevent spam and fake sign-ups.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Enhance WordPress salt security\u003C\u002Fstrong> – Adds 64 extra characters to WordPress salts, rotating them weekly. Makes cracking passwords virtually impossible, even if your database is stolen.\u003C\u002Fp>\n\u003Ch4>Plugin Support\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>If you have a question or problem with the All-In-One Security plugin, post it on the support forum and we will help you. Premium customers can log queries directly with the team via https:\u002F\u002Fteamupdraft.com\u002Fall-in-one-security\u002F\u003Cbr \u002F>\n\u003Cstrong>Monitor and manage active sessions\u003C\u002Fstrong> – If a user is logged in who shouldn’t be, log them out or add them to a blacklist.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>SPAM PREVENTION\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Block spam coming from bots\u003C\u002Fstrong> – Reduce the load on your server and improve the user experience by automatically blocking spam comments from bots.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Monitor spam IP addresses\u003C\u002Fstrong> – Monitor the IP addresses of people or bots leaving spam comments. Choose which ones to block based on a configurable number of comments left.\u003C\u002Fp>\n\u003Ch4>FILE \u002F DATABASE Security\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Scan and fix file permissions\u003C\u002Fstrong> – Scan for insecure file permissions. Click once to fix issues and safeguard critical files and folders.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Disable PHP file editing\u003C\u002Fstrong> – Disable editing of PHP files (such as plugins and themes) via the dashboard. It’s often the first tool that attackers use as it allows for code execution.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Protect sensitive files\u003C\u002Fstrong> – Prevent access to files like readme.html that might reveal information about your WordPress installation.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>File change scanner\u003C\u002Fstrong> – Get notified of any file changes which occur on your system. Exclude files and folders which change as part of normal operations.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Prevent image hotlinking\u003C\u002Fstrong> – Prevent other websites from displaying your images via hotlinking and protect server bandwidth.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Secure database backups\u003C\u002Fstrong> – Perform a database backup via UpdraftPlus from AIOS. Change the default ‘wp_’ prefix to hide your WordPress database from hackers.\u003C\u002Fp>\n\u003Ch4>FIREWALL\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Get .htaccess firewall rules\u003C\u002Fstrong> – Deny access to the .htaccess and wp-config.php files. Disable the server signature and limit file uploads to a configurable size.**\u003C\u002Fp>\n\u003Cp>Block access to the debug.log file and prevent Apache servers from listing the contents of a directory when an index.php file is not present\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Get PHP firewall rules\u003C\u002Fstrong> – PHP firewall rules prevent malicious users from exploiting well-known vulnerabilities in XML-RPC. Safeguard your content by disabling RSS and Atom feeds and avoid cross-site scripting (XSS) attacks.\u003Cbr \u002F>\nBlock fake Google bots and POST requests made by bots – Block fake Google bots and stop bots from making POST requests by blocking IP addresses where the user-agent and referrer fields are blank.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Utilise 6G firewall rules\u003C\u002Fstrong> – Employ flexible blacklist rules to reduce the number of malicious URL requests that hit your website (courtesy of Perishable Press).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>And more\u003C\u002Fstrong> – Blacklist (and whitelist) IP ranges and user agents and block unauthorized access to data by disabling REST API access for non-logged-in requests.\u003C\u002Fp>\n\u003Ch4>TWO-FACTOR AUTHENTICATION ENHANCED [Premium]\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Two-factor authentication\u003C\u002Fstrong> is included in the free plugin. Upgrade to Premium if you’d like to:\u003Cbr \u002F>\nRequire TFA after a set time period – Mandate TFA for all admins or other roles after their accounts reach a specified age.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Control how often TFA is required\u003C\u002Fstrong> – Set TFA to be required after a certain number of days on trusted devices instead of every login.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Customise design layout\u003C\u002Fstrong> – Adjust the TFA design to match your website’s existing layout and branding.\u003Cbr \u002F>\nEmergency codes – Generate one-time use emergency codes to regain access if you lose your TFA device.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>WordPress Multisite Compatible\u003C\u002Fstrong> – Ensure compatibility with WordPress multisite networks and their sub-sites for consistent TFA application.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Integration with login forms\u003C\u002Fstrong> – Integrate TFA with various login forms, including WooCommerce, Affiliates-WP, Elementor Pro, bbPress, and ‘Theme My Login’ without additional coding.\u003C\u002Fp>\n\u003Ch4>SMART 404 BLOCKING [Premium]\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Block IPs based on 404 errors\u003C\u002Fstrong> – Detect hackers probing your URLs via script and bots by the 404 errors they leave behind.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Smart 404 Configuration\u003C\u002Fstrong> – Set a figure for the maximum number of 404 events allowed before an IP address is blocked. Choose a time period within which the 404 events must occur (e.g., 10 errors within 10 minutes).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Smart 404 block by URL string\u003C\u002Fstrong> – Instantly block an IP address if a 404 event includes a specific URL string.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Smart 404 whitelisting\u003C\u002Fstrong> – Prevent particular IP addresses from being permanently blocked due to 404 events.\u003C\u002Fp>\n\u003Ch4>COUNTRY BLOCKING [Premium]\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Block traffic to the entire site or to specific pages or posts\u003C\u002Fstrong> – Useful if you’re an e-commerce site and you want to block sales to some countries for shipping or tax reasons.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Whitelist some users from blocked countries\u003C\u002Fstrong> – Whitelist IP addresses or IP ranges even if they are part of a blocked country.\u003C\u002Fp>\n\u003Ch4>MALWARE SCANNING [Premium]\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Automatic malware scanning\u003C\u002Fstrong> – Detect and protect against the latest malware, trojans, and spyware.\u003Cbr \u002F>\nAlerts you to blacklisting by search engines – Monitor your site for blacklisting by search engines due to malicious code.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Response time monitoring\u003C\u002Fstrong> – Keep track of your website’s response time to identify and address any performance issues.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Uptime monitoring\u003C\u002Fstrong> – Checks your website’s uptime every 5 minutes and alerts you immediately if your site or server goes down.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Advice and malware removal\u003C\u002Fstrong> – Need hands-on advice and support for malware removal? Our team of genuine cybersecurity experts is here to help.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Notification if something’s amiss\u003C\u002Fstrong> – Receive notifications about any issues with your site so you can address problems before they escalate.\u003C\u002Fp>\n\u003Ch4>Plugin Support\u003C\u002Fh4>\n\u003Cp>If you have a question or problem with the All-In-One Security plugin, post it on the support forum and we will help you. Premium customers can log queries directly with the team via https:\u002F\u002Fteamupdraft.com\u002Fall-in-one-security\u003C\u002Fp>\n\u003Ch4>Developers\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>If you are a developer and you need some extra hooks or filters for this plugin then let us know.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Translations\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>All-In-One Security plugin can be translated to any language.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Currently available translations:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>English\u003C\u002Fli>\n\u003Cli>German\u003C\u002Fli>\n\u003Cli>Spanish\u003C\u002Fli>\n\u003Cli>French\u003C\u002Fli>\n\u003Cli>Hungarian\u003C\u002Fli>\n\u003Cli>Italian\u003C\u002Fli>\n\u003Cli>Swedish\u003C\u002Fli>\n\u003Cli>Russian\u003C\u002Fli>\n\u003Cli>Chinese\u003C\u002Fli>\n\u003Cli>Portuguese (Brazil)\u003C\u002Fli>\n\u003Cli>Persian\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Privacy Policy\u003C\u002Fh4>\n\u003Cp>This plugin may collect IP addresses for security reasons such as mitigating brute force login threats and malicious activity.\u003C\u002Fp>\n\u003Cp>The collected information is stored on your server. No information is transmitted to third parties or remote server locations.\u003C\u002Fp>\n\u003Ch4>Usage\u003C\u002Fh4>\n\u003Cp>Go to the settings menu after you activate the plugin and follow the instructions.\u003C\u002Fp>\n\u003Ch3>Usage\u003C\u002Fh3>\n\u003Cp>Go to the settings menu after you activate the plugin and follow the instructions.\u003C\u002Fp>\n","Protect your website investment with All-In-One Security (AIOS) – a comprehensive and easy to use security plugin designed especially for WordPress.",1000000,36139406,1693,"2026-01-28T22:15:00.000Z","5.6",[22,23,150,24,151],"malware-scanning","two-factor-authentication","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fall-in-one-wp-security-and-firewall\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fall-in-one-wp-security-and-firewall.5.4.6.zip",93,26,"2024-02-08 00:00:00",{"slug":158,"name":159,"version":160,"author":161,"author_profile":162,"description":163,"short_description":164,"active_installs":165,"downloaded":166,"rating":13,"num_ratings":167,"last_updated":168,"tested_up_to":16,"requires_at_least":169,"requires_php":148,"tags":170,"homepage":172,"download_link":173,"security_score":174,"vuln_count":175,"unpatched_count":27,"last_vuln_date":176,"fetched_at":29},"gotmls","Anti-Malware Security and Brute-Force Firewall","4.23.88","Eli","https:\u002F\u002Fprofiles.wordpress.org\u002Fscheeeli\u002F","\u003Cp>\u003Cstrong>Features:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Download Definition Updates to protect against new threats.\u003C\u002Fli>\n\u003Cli>Run a Complete Scan to automatically remove known security threats, backdoor scripts, and database injections.\u003C\u002Fli>\n\u003Cli>Firewall block SoakSoak and other malware from exploiting Revolution Slider and other plugins with known vulnerabilites.\u003C\u002Fli>\n\u003Cli>Upgrade vulnerable versions of timthumb scripts.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Premium Features:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Patch your wp-login and XMLRPC to block Brute-Force and DDoS attacks.\u003C\u002Fli>\n\u003Cli>Check the integrity of your WordPress Core files.\u003C\u002Fli>\n\u003Cli>Automatically download new Definition Updates when running a Complete Scan.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Register this plugin at \u003Ca href=\"http:\u002F\u002Fgotmls.net\u002F\" rel=\"nofollow ugc\">GOTMLS.NET\u003C\u002Fa> and get access to new definitions of “Known Threats” and added features like Automatic Removal, plus patches for specific security vulnerabilities like old versions of timthumb. Updated definition files can be downloaded automatically within the admin once your Key is registered. Otherwise, this plugin just scans for “Potential Threats” and leaves it up to you to identify and remove the malicious ones.\u003C\u002Fp>\n\u003Cp>NOTICE: This plugin makes calls to GOTMLS.NET to check for updates not unlike what WordPress does when checking your plugins and themes for new versions. Staying up-to-date is an essential part of any security plugin and this plugin can let you know when there are new plugin and definition update available. If you’re allergic to “phone home” scripts then don’t use this plugin (or WordPress at all for that matter).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Special thanks to:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Clarus Dignus for design suggestions and graphic design work on the banner image.\u003C\u002Fli>\n\u003Cli>Jelena Kovacevic and Andrew Kurtis of webhostinghub.com for providing the Spanish translation.\u003C\u002Fli>\n\u003Cli>Marcelo Guernieri for the Brazilian Portuguese translation.\u003C\u002Fli>\n\u003Cli>Umut Can Alparslan for the Turkish translation.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fprofiles.wordpress.org\u002Fmichacassola\u002F\" rel=\"nofollow ugc\">Micha Cassola\u003C\u002Fa> for the German translation.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fprofiles.wordpress.org\u002Fsitustarget\u002F\" rel=\"nofollow ugc\">Robi Erwin Setiawan\u003C\u002Fa> for the Indonesian translation.\u003C\u002Fli>\n\u003C\u002Ful>\n","This Anti-Malware scanner searches for Malware, Viruses, and other security threats and vulnerabilities on your server and it helps you fix them.",100000,7622347,781,"2026-03-09T14:47:00.000Z","3.3",[171,21,22,130,24],"anti-malware","https:\u002F\u002Fgotmls.net\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgotmls.4.23.88.zip",83,9,"2025-10-28 15:41:58",{"slug":178,"name":179,"version":180,"author":181,"author_profile":182,"description":183,"short_description":184,"active_installs":185,"downloaded":186,"rating":133,"num_ratings":187,"last_updated":188,"tested_up_to":16,"requires_at_least":189,"requires_php":190,"tags":191,"homepage":192,"download_link":193,"security_score":133,"vuln_count":194,"unpatched_count":27,"last_vuln_date":195,"fetched_at":29},"defender-security","Defender Security – Malware Scanner, Login Security & Firewall","5.10.0","WPMU DEV - Your All-in-One WordPress Platform","https:\u002F\u002Fprofiles.wordpress.org\u002Fwpmudev\u002F","\u003Cp>\u003Cstrong>Defender adds the best in WordPress plugin security to your website with just a few clicks, including malware scanner, firewall, password protection, and login security features. Stop brute force login attacks, weak password usage, SQL injections, cross-site scripting (XSS), and other WordPress security vulnerabilities and hacks with Defender’s malware scanner, providing antivirus scans, IP blocking, firewall, activity log, security log, and two-factor authentication (2FA) login security.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>No more complex security settings, Defender’s malware scanner, firewall, and login security features add all the hardening and security you need.\u003C\u002Fp>\n\u003Cp>Defender is brought to you by the WordPress speed specialists that created Smush image optimization, now active on more than +1 million websites.\u003C\u002Fp>\n\u003Cp>Plus, connect for free to WPMU DEV’s AntiBot Global Firewall to block harmful IPs with data from over 750,000 sites.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Enjoy complete site protection from malware, vulnerabilities, bot attacks, and session hijacking from the start with \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fproject\u002Fwp-defender\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro\" rel=\"nofollow ugc\">Defender Pro\u003C\u002Fa>.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Level up security immediately with exclusive Pro features like scheduled malware scanning, Safe Repair for suspicious files, and known WordPress vulnerability detection. \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fproject\u002Fwp-defender\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro\" rel=\"nofollow ugc\">Learn more about Pro\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>Security Recommendations\u003C\u002Fh3>\n\u003Cp>Defender’s one-click security hardening recommendations instantly adds layers of protection and security to your site.\u003C\u002Fp>\n\u003Ch3>Enhance Security and Block Hackers At Every Level:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Malware Scanner\u003C\u002Fstrong> – Scan WordPress core files for modifications and unexpected changes which may be caused by malware. Scan for malware and tighten up the security of your files.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Outdated & Removed Plugins\u003C\u002Fstrong> – Scans for plugins removed from WordPress.org or not updated in 2+ years.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>AntiBot Global Firewall\u003C\u002Fstrong> – Connect for free to WPMU DEV to block harmful IPs with data from over 750,000 sites.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WordPress Security Firewall\u003C\u002Fstrong> – Block or allowlist IPs, implement IP blocking, and Geo IP blocking, user agent banning and protect against brute force attacks.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Two-Factor Authentication (2FA)\u003C\u002Fstrong> – Easily set up better security with 2FA to prevent most login attacks such as brute force, App verification, backup codes, lost device email, WooCommerce 2FA, and Web Authentication.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Login Masking\u003C\u002Fstrong> – Change the location of WordPress’s default login area to improve login security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Login Lockout\u003C\u002Fstrong> – Failed login attempts lockout for even more security assurance.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User Agent Banning\u003C\u002Fstrong> – Fortify security by blocking bad bots and user agents from accessing your site.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Security Headers\u003C\u002Fstrong> – Add an extra layer of defense security and protect against common attacks like: XSS, code injection, and more.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>404 Detection Security\u003C\u002Fstrong> – Automated block of bot IPs.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Security Configs\u003C\u002Fstrong> – Create your ideal Defender security plugin settings and export \u002F import saved configs to any other site.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Geolocation IP Lockout Security\u003C\u002Fstrong> – Block users based on location and country (IP blocking).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Disable Trackbacks And Pingbacks\u003C\u002Fstrong> – Disable these notifications to enhance spam protection and site security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Core And Server Update Security Recommendations\u003C\u002Fstrong> – Stay on top of your system security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Antivirus Scan\u003C\u002Fstrong> – Scan for active security threats, viruses, and other malware.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Disable File Editor\u003C\u002Fstrong> – If they get in, they won’t get far.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Hide Error Reporting\u003C\u002Fstrong> – Hide code errors on the frontend so hackers can’t exploit site security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Update Security Keys\u003C\u002Fstrong> – Update old WordPress security keys to be more encrypted and provide better security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Prevent Information Disclosure\u003C\u002Fstrong> – Improve server security and protect sensitive files by locking down specific file types.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Prevent PHP Execution\u003C\u002Fstrong> – Defender bolsters security by automatically preventing any PHP code from being executed.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Bulk Apply Security Recommendations\u003C\u002Fstrong> – Apply multiple recommended security improvements at once for quicker site hardening.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Google reCAPTCHA Security\u003C\u002Fstrong> – Easy to add, stop fraud and abuse – including BuddyPress and WooCommerce.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Cloudflare Turnstile\u003C\u002Fstrong> – Captcha-free protection from spam and automated attacks, including BuddyPress and WooCommerce support.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Pwned Password Check\u003C\u002Fstrong> – Increase security by protecting against compromised passwords.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Force Password Reset\u003C\u002Fstrong> – Force users with selected roles to reset passwords.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Force Strong Passwords\u003C\u002Fstrong> – Ensure users create secure credentials by enforcing robust password requirements.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User Agent Blocklist Presets\u003C\u002Fstrong> – Easily block unwanted bots and scripts using curated user agent presets.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Known Vulnerability & Suspicious Code Scan (Pro Only)\u003C\u002Fstrong> – Scan WordPress core, themes, and plugins for vulnerabilities and harmful code.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Malicious Bot Detector (Pro Only)\u003C\u002Fstrong> – Block malicious bots with layered defenses, including traps for bots that ignore robots.txt and checks for fake crawlers posing as search engines.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Google Blocklist Monitoring (Pro Only)\u003C\u002Fstrong> – Get instant alerts if your site is flagged by Google.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Session Protection (Pro Only)\u003C\u002Fstrong> – Stop session hijacking and prevent unauthorized account access.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Safe Repair For Suspicious Files (Pro Only)\u003C\u002Fstrong> – Restore or replace compromised files safely with a single click.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Automated Reports (Pro Only)\u003C\u002Fstrong> – Receive scheduled security reports straight to your inbox.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Learn The Ropes With These Hands-On Defender Security Plugin Tutorials\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fblog\u002Fhow-to-get-the-most-out-of-defender-security\u002F\" rel=\"nofollow ugc\">How to Get the Most Out of Defender Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fblog\u002Fstop-hackers-with-defender-wordpress-security-plugin\u002F\" rel=\"nofollow ugc\">How to Stop Hackers in Their Tracks with Defender Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fblog\u002Fdelete-suspicious-code-defender\u002F\" rel=\"nofollow ugc\">Find Out if You’re Hacked: How to Find and Delete Suspicious Code with Defender Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fblog\u002Fdefender-ip-address-lockout-firewall\u002F\" rel=\"nofollow ugc\">How to Create a Powerful and Secure Customized Firewall with Defender Security\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>WordPress Security Scans\u003C\u002Fh3>\n\u003Cp>Defender’s malware scanner security checks for suspicious code and malware. It also compares your WordPress install with the WP directory master copy, and reports any changes so you can restore the original file with a click.\u003C\u002Fp>\n\u003Ch3>Two-Factor Authentication (2FA) Security\u003C\u002Fh3>\n\u003Cp>Easily add an extra layer of protection and security to your WordPress sites with Defender’s two-factor authentication (2FA) features. Including: mobile app verification (Google Authenticator, Microsoft Authenticator, Authy), backup code generation, lost device emails, WooCommerce 2FA, Biometric Authentication (fingerprint\u002Ffacial recognition), and Hardware Key Authentication (USB security keys). Easily prevent brute force attacks and login security vulnerabilities.\u003C\u002Fp>\n\u003Ch3>Login Protection\u003C\u002Fh3>\n\u003Cp>Brute force attacks are no match for Defender’s login security. Limit login attempts so hackers can’t guess passwords. Permanently ban IPs or trigger a timed lockout after a set number of failed login attempts. Use Geo IP blocking to ban users from specific countries or locations.\u003C\u002Fp>\n\u003Ch3>Firewall Security and IP Manager\u003C\u002Fh3>\n\u003Cp>Improve your website security with Defender’s IP manager and firewall. Manually block specific IPs, import a list of banned IPs, and set automated timed and permanent lockouts. Defender makes it easy to block and unblock specific locations quickly thanks to its advanced firewall security(WAF) offering Geographical IP blocking.\u003C\u002Fp>\n\u003Ch3>User Agent Banning\u003C\u002Fh3>\n\u003Cp>Add user agents to the block or allowlist and stop bad bots from spamming and scraping your site. All major search engines and special network bots are allow-listed out of the box. Easy to set up, Defender’s user agent banning tool now includes built-in bot and script presets to help you quickly block malicious traffic. It does all the security work for you—no editing of the .htaccess file required.\u003C\u002Fp>\n\u003Ch3>Google reCAPTCHA Integration\u003C\u002Fh3>\n\u003Cp>Add reCAPTCHA security to your login \u002F registration pages, lost password forms, and post comments in a couple of steps to up security and help protect from fraud and abuse. Select reCAPTCHA type, language, location, and style to suit. As well as Google, Defender also supports the following reCAPTCHA types:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>BuddyPress reCAPTCHA\u003C\u002Fli>\n\u003Cli>WooCommerce reCAPTCHA\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Login Screen Masking\u003C\u002Fh3>\n\u003Cp>Defender makes it easy to move your login screen to a custom URL. Not only does login screen masking improve security, but it also lets you white label your login user experience and improves branding.\u003C\u002Fp>\n\u003Ch3>Force Password Reset\u003C\u002Fh3>\n\u003Cp>Enhance site security by forcing all users with selected roles to reset their password at any time. Especially helpful if you suspect a possible data breach on your site.\u003C\u002Fp>\n\u003Ch3>Security Headers\u003C\u002Fh3>\n\u003Cp>Protect your site against common attacks, such as: XSS, code injection, cross site scripting, and more. Enable the following security headers:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>X-Frame-Options\u003C\u002Fli>\n\u003Cli>X-XSS-Protection\u003C\u002Fli>\n\u003Cli>X-Content-Type-Options\u003C\u002Fli>\n\u003Cli>Strict Transport\u003C\u002Fli>\n\u003Cli>Referrer Policy\u003C\u002Fli>\n\u003Cli>Permissions-Policy\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>404 Limiter\u003C\u002Fh3>\n\u003Cp>Detect when bots are being used to scan your site for security vulnerabilities and shut them down. The 404 limiter lets you stop the scan by detecting when a bot keeps visiting pages that do not exist, which can also save you from a giant strain on your site’s performance.\u003C\u002Fp>\n\u003Ch3>Security Notifications and Reports\u003C\u002Fh3>\n\u003Cp>Defender runs surveillance and sends security notifications with information that matters. All activity and notifications are recorded in the activity log to let you see at a glance the website security actions that have been taken by the Defender security plugin.\u003C\u002Fp>\n\u003Ch3>Reduce Security Setup Time With Saved Configs\u003C\u002Fh3>\n\u003Cp>Save your Defender security plugin configurations and reapply them to your other sites in just a few clicks. You can create and save an unlimited number of security configurations.\u003C\u002Fp>\n\u003Ch3>Pwned Password Check\u003C\u002Fh3>\n\u003Cp>Entered passwords are checked against public database breach records to further boost security. If a password is identified as compromised, the user will be asked to change it.\u003C\u002Fp>\n\u003Ch3>Custom IP Block\u002FAllowlist\u003C\u002Fh3>\n\u003Cp>Create your IP block\u002Fallow list once, then apply and automatically sync it to all your other sites with just a single click. Save hours by not having to manually add IPs to each individual site. *Note: a [free WPMU DEV account] (https:\u002F\u002Fwpmudev.com\u002Fregister) is required to access this feature.\u003C\u002Fp>\n\u003Ch3>What Do People Say About Defender?\u003C\u002Fh3>\n\u003Cp>★★★★★\u003Cbr \u002F>\n“I found other pro security plugins a bit too fiddly for my taste…I’m delighted with Defender” – \u003Ca href=\"https:\u002F\u002Fprofiles.wordpress.org\u002Fkeithadv\" rel=\"nofollow ugc\">KeithADV\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>★★★★★\u003Cbr \u002F>\n“Thank you for bringing back a free and easy to use 2-Factor Authentication after Clef! Defender helps keep me aware of my site’s security.” – \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fusers\u002Fawijasa\u002F\" rel=\"ugc\">awijasa\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>★★★★★\u003Cbr \u002F>\n“Defender’s interface is very intuitive with warnings that are very helpful” – \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fprofile\u002Fdjohns\" rel=\"nofollow ugc\">djohns\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>★★★★★\u003Cbr \u002F>\n“Defender Recently blocked over 3000 attacks in one week without any noticeable impact on the website. WPMUDEV knocking it out of the park on this one.” – \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002Fprofile\u002Fdavidoswald\u002F\" rel=\"nofollow ugc\">David Oswald\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>Secure Websites, More Trust, Better Profit\u003C\u002Fh3>\n\u003Cp>If you’re running a business website or eCommerce store, privacy, security, uptime and trust are essential.\u003C\u002Fp>\n\u003Cp>The Defender security plugin is here to help you: it’s a one of a kind WordPress security plugin that makes web security easy for anyone, for free!\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Malware scanner\u003C\u002Fli>\n\u003Cli>Google two-factor authentication (2FA)\u003C\u002Fli>\n\u003Cli>Web Authentication\u003C\u002Fli>\n\u003Cli>Firewall setup and configuration\u003C\u002Fli>\n\u003Cli>One-click site hardening and security tweaking\u003C\u002Fli>\n\u003Cli>WordPress core file scanning and repair\u003C\u002Fli>\n\u003Cli>Ongoing firewall security\u003C\u002Fli>\n\u003Cli>Google reCAPTCHA\u003C\u002Fli>\n\u003Cli>Security headers\u003C\u002Fli>\n\u003Cli>One-click security configs\u003C\u002Fli>\n\u003Cli>Login Screen Masking\u003C\u002Fli>\n\u003Cli>Pwned Password Check\u003C\u002Fli>\n\u003Cli>IP Blocklist manager and logging\u003C\u002Fli>\n\u003Cli>Geo IP blocking\u003C\u002Fli>\n\u003Cli>User agent banning\u003C\u002Fli>\n\u003Cli>Unlimited file scans\u003C\u002Fli>\n\u003Cli>Timed Lockout brute force login attack shield for login security\u003C\u002Fli>\n\u003Cli>404 limiter for blocking vulnerability scans\u003C\u002Fli>\n\u003Cli>IP lockout notifications and security reports\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>All the above is free and will enhance WordPress security for you. If you need extra security for your WordPress site, \u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=you_should_get_wpmudev_membership#trial\" rel=\"nofollow ugc\">you should get a WPMU DEV Membership\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>Our Membership gives you access to Defender Pro – which security features include automated scanning, scheduled malware scans for Core, themes, plugins and other files, audit logs, firewall protection, Safe Repair, Blocklist monitoring – alongside Snapshot Pro cloud backups, the Hub with automated plugin, theme and core updates and safe-upgrade scans, all our premium WordPress plugins, 24\u002F7 WordPress support and if your sites already been hacked our team of security experts will clean it up at no additional cost.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=and_you_can_find_out_more_here#trial\" rel=\"nofollow ugc\">It’s an incredible deal, and you can find out more here\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>About Us\u003C\u002Fh3>\n\u003Cp>WPMU DEV is a premium supplier of quality WordPress plugins and themes. For premium support with any WordPress-related issues you can join us here:\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_link\" rel=\"nofollow ugc\">https:\u002F\u002Fwpmudev.com\u002F\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Don’t forget to stay up to date on everything WordPress from the Internet’s number one resource:\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwpmudev.com\u002F?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_blog_link\" rel=\"nofollow ugc\">WPMU DEV Blog\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Hey, one more thing… we hope you \u003Ca href=\"https:\u002F\u002Fprofiles.wordpress.org\u002FWPMUDEV\u002F\" rel=\"nofollow ugc\">enjoy our free offerings\u003C\u002Fa> as much as we’ve loved making them for you!\u003C\u002Fp>\n","WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, firewall, 2FA, brute force login security, and more.",90000,4036012,329,"2026-03-03T11:21:00.000Z","6.4","8.0.0",[22,23,129,110,24],"https:\u002F\u002Fwpmudev.com\u002Fproject\u002Fwp-defender\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdefender-security.5.10.0.zip",7,"2024-06-28 00:00:00",{"attackSurface":197,"codeSignals":477,"taintFlows":684,"riskAssessment":748,"analyzedAt":761},{"hooks":198,"ajaxHandlers":364,"restRoutes":469,"shortcodes":470,"cronEvents":476,"entryPointCount":410,"unprotectedCount":343},[199,205,211,215,221,225,229,233,237,241,245,249,252,255,260,263,267,270,273,277,281,285,289,293,297,301,305,309,313,317,320,323,326,329,332,336,340,345,348,352,355,360],{"type":200,"name":201,"callback":202,"file":203,"line":204},"action","phpmailer_init","add_attachments_to_php_mailer","core\\Helpers.php",395,{"type":200,"name":206,"callback":207,"priority":208,"file":209,"line":210},"admin_enqueue_scripts","enqueue",999,"core\\LimitLoginAttempts.php",127,{"type":200,"name":212,"callback":213,"file":209,"line":214},"login_enqueue_scripts","login_page_enqueue",128,{"type":216,"name":217,"callback":218,"priority":219,"file":209,"line":220},"filter","limit_login_whitelist_ip","check_whitelist_ips",10,129,{"type":216,"name":222,"callback":223,"priority":219,"file":209,"line":224},"limit_login_whitelist_usernames","check_whitelist_usernames",130,{"type":216,"name":226,"callback":227,"priority":219,"file":209,"line":228},"limit_login_blacklist_ip","check_blacklist_ips",131,{"type":216,"name":230,"callback":231,"priority":219,"file":209,"line":232},"limit_login_blacklist_usernames","check_blacklist_usernames",132,{"type":216,"name":234,"callback":235,"priority":208,"file":209,"line":236},"illegal_user_logins","register_user_blacklist",134,{"type":216,"name":238,"callback":239,"file":209,"line":240},"um_custom_authenticate_error_codes","ultimate_member_register_error_codes",135,{"type":200,"name":242,"callback":243,"file":209,"line":244},"admin_notices","show_leave_review_notice",140,{"type":200,"name":246,"callback":247,"file":209,"line":248},"admin_print_scripts-toplevel_page_limit-login-attempts","load_admin_scripts",142,{"type":200,"name":250,"callback":247,"file":209,"line":251},"admin_print_scripts-settings_page_limit-login-attempts",143,{"type":200,"name":253,"callback":247,"file":209,"line":254},"admin_print_scripts-index.php",144,{"type":200,"name":256,"callback":257,"priority":258,"file":209,"line":259},"admin_init","dashboard_page_redirect",9999,146,{"type":200,"name":256,"callback":261,"priority":219,"file":209,"line":262},"setup_cookie",147,{"type":200,"name":264,"callback":265,"file":209,"line":266},"login_footer","login_page_gdpr_message",149,{"type":200,"name":264,"callback":268,"priority":258,"file":209,"line":269},"login_page_render_js",151,{"type":200,"name":271,"callback":268,"priority":258,"file":209,"line":272},"wp_footer",152,{"type":200,"name":274,"callback":275,"file":209,"line":276},"wp_dashboard_setup","register_dashboard_widgets",155,{"type":200,"name":278,"callback":279,"priority":219,"file":209,"line":280},"login_form_register","llar_submit_login_form_register",157,{"type":216,"name":282,"callback":283,"priority":219,"file":209,"line":284},"registration_errors","llar_submit_registration_errors",158,{"type":200,"name":286,"callback":287,"file":209,"line":288},"init","load_plugin_textdomain_in_time",251,{"type":200,"name":290,"callback":291,"file":209,"line":292},"wp_login_failed","limit_login_failed",259,{"type":216,"name":294,"callback":294,"priority":295,"file":209,"line":296},"wp_authenticate_user",99999,260,{"type":200,"name":298,"callback":299,"priority":219,"file":209,"line":300},"wp_login","limit_login_success",261,{"type":216,"name":302,"callback":303,"file":209,"line":304},"shake_error_codes","failure_shake",263,{"type":200,"name":306,"callback":307,"file":209,"line":308},"login_errors","fixup_error_messages",264,{"type":200,"name":310,"callback":311,"file":209,"line":312},"um_submit_form_errors_hook_login","um_limit_login_failed",266,{"type":216,"name":314,"callback":315,"priority":219,"file":209,"line":316},"mepr_validate_login","mepr_validate_login_handler",268,{"type":200,"name":318,"callback":318,"file":209,"line":319},"network_admin_menu",271,{"type":200,"name":318,"callback":321,"file":209,"line":322},"network_setting_menu_alert_icon",274,{"type":200,"name":324,"callback":324,"file":209,"line":325},"admin_menu",278,{"type":200,"name":327,"callback":327,"priority":208,"file":209,"line":328},"admin_bar_menu",281,{"type":200,"name":324,"callback":330,"file":209,"line":331},"setting_menu_alert_icon",284,{"type":216,"name":333,"callback":334,"file":209,"line":335},"xmlrpc_login_error","xmlrpc_error_messages",288,{"type":200,"name":337,"callback":338,"file":209,"line":339},"wp_head","add_wc_notices",291,{"type":200,"name":341,"callback":342,"priority":343,"file":209,"line":344},"authenticate","track_credentials",1,298,{"type":200,"name":341,"callback":346,"priority":27,"file":209,"line":347},"authenticate_filter",299,{"type":200,"name":341,"callback":349,"priority":350,"file":209,"line":351},"authenticate_filter_errors_fix",35,305,{"type":200,"name":298,"callback":353,"priority":208,"file":209,"line":354},"cloud_app_null",687,{"type":200,"name":356,"callback":357,"priority":258,"file":358,"line":359},"plugins_loaded","closure","limit-login-attempts-reloaded.php",41,{"type":216,"name":361,"callback":357,"priority":219,"file":362,"line":363},"wp_kses_allowed_html","views\\onboarding-popup.php",248,[365,372,376,380,384,388,392,396,400,404,407,411,415,419,423,427,431,435,439,443,447,451,454,457,461,465],{"action":366,"nopriv":367,"callback":368,"hasNonce":369,"hasCapCheck":367,"file":370,"line":371},"limit-login-unlock",false,"ajax_unlock",true,"core\\Ajax.php",17,{"action":373,"nopriv":367,"callback":374,"hasNonce":369,"hasCapCheck":367,"file":370,"line":375},"dismiss_review_notice","dismiss_review_notice_callback",18,{"action":377,"nopriv":367,"callback":378,"hasNonce":369,"hasCapCheck":367,"file":370,"line":379},"dismiss_notify_notice","dismiss_notify_notice_callback",19,{"action":381,"nopriv":367,"callback":382,"hasNonce":369,"hasCapCheck":367,"file":370,"line":383},"enable_notify","enable_notify_callback",20,{"action":385,"nopriv":367,"callback":386,"hasNonce":367,"hasCapCheck":367,"file":370,"line":387},"app_config_save","app_config_save_callback",21,{"action":389,"nopriv":367,"callback":390,"hasNonce":369,"hasCapCheck":367,"file":370,"line":391},"app_setup","app_setup_callback",22,{"action":393,"nopriv":367,"callback":394,"hasNonce":369,"hasCapCheck":367,"file":370,"line":395},"app_log_action","app_log_action_callback",23,{"action":397,"nopriv":367,"callback":398,"hasNonce":369,"hasCapCheck":367,"file":370,"line":399},"app_load_log","app_load_log_callback",24,{"action":401,"nopriv":367,"callback":402,"hasNonce":369,"hasCapCheck":367,"file":370,"line":403},"app_load_successful_login","app_load_successful_login_callback",25,{"action":405,"nopriv":367,"callback":406,"hasNonce":369,"hasCapCheck":367,"file":370,"line":155},"app_load_lockouts","app_load_lockouts_callback",{"action":408,"nopriv":367,"callback":409,"hasNonce":369,"hasCapCheck":367,"file":370,"line":410},"app_load_acl_rules","app_load_acl_rules_callback",27,{"action":412,"nopriv":367,"callback":413,"hasNonce":369,"hasCapCheck":367,"file":370,"line":414},"app_load_country_access_rules","app_load_country_access_rules_callback",28,{"action":416,"nopriv":367,"callback":417,"hasNonce":369,"hasCapCheck":367,"file":370,"line":418},"app_toggle_country","app_toggle_country_callback",29,{"action":420,"nopriv":367,"callback":421,"hasNonce":369,"hasCapCheck":367,"file":370,"line":422},"app_country_rule","app_country_rule_callback",30,{"action":424,"nopriv":367,"callback":425,"hasNonce":369,"hasCapCheck":367,"file":370,"line":426},"app_acl_add_rule","app_acl_add_rule_callback",31,{"action":428,"nopriv":367,"callback":429,"hasNonce":369,"hasCapCheck":367,"file":370,"line":430},"app_acl_remove_rule","app_acl_remove_rule_callback",32,{"action":432,"nopriv":369,"callback":433,"hasNonce":369,"hasCapCheck":367,"file":370,"line":434},"get_remaining_attempts_message","get_remaining_attempts_message_callback",33,{"action":436,"nopriv":367,"callback":437,"hasNonce":369,"hasCapCheck":367,"file":370,"line":438},"subscribe_email","subscribe_email_callback",37,{"action":440,"nopriv":367,"callback":441,"hasNonce":369,"hasCapCheck":367,"file":370,"line":442},"strong_account_policies","strong_account_policies_callback",38,{"action":444,"nopriv":367,"callback":445,"hasNonce":369,"hasCapCheck":367,"file":370,"line":446},"block_by_country","block_by_country_callback",39,{"action":448,"nopriv":367,"callback":449,"hasNonce":369,"hasCapCheck":367,"file":370,"line":450},"dismiss_onboarding_popup","dismiss_onboarding_popup_callback",40,{"action":452,"nopriv":367,"callback":453,"hasNonce":369,"hasCapCheck":367,"file":370,"line":359},"onboarding_reset","onboarding_reset_callback",{"action":455,"nopriv":367,"callback":455,"hasNonce":369,"hasCapCheck":367,"file":370,"line":456},"close_premium_message",42,{"action":458,"nopriv":367,"callback":459,"hasNonce":369,"hasCapCheck":367,"file":370,"line":460},"toggle_auto_update","toggle_auto_update_callback",43,{"action":462,"nopriv":367,"callback":463,"hasNonce":369,"hasCapCheck":367,"file":370,"line":464},"activate_micro_cloud","activate_micro_cloud_callback",44,{"action":466,"nopriv":367,"callback":467,"hasNonce":369,"hasCapCheck":367,"file":370,"line":468},"test_email_notifications","test_email_notifications_callback",45,[],[471],{"tag":472,"callback":473,"file":474,"line":475},"llar-link","llar_link_callback","core\\Shortcodes.php",14,[],{"dangerousFunctions":478,"sqlUsage":479,"outputEscaping":482,"fileOperations":480,"externalRequests":89,"nonceChecks":155,"capabilityChecks":480,"bundledLibraries":683},[],{"prepared":480,"raw":27,"locations":481},2,[],{"escaped":363,"rawEcho":483,"locations":484},104,[485,488,490,492,494,496,498,500,503,505,506,508,510,512,514,516,518,520,522,524,527,529,531,532,534,536,539,540,543,545,548,550,552,554,556,557,558,559,561,563,565,567,569,571,573,575,578,580,581,583,585,587,589,591,593,594,597,598,600,602,604,606,608,610,611,613,614,616,618,619,620,622,624,626,628,629,630,631,633,635,637,639,641,642,644,646,648,651,653,654,656,658,660,662,664,666,667,669,671,673,675,677,679,681],{"file":370,"line":486,"context":487},316,"raw output",{"file":370,"line":489,"context":487},342,{"file":370,"line":491,"context":487},463,{"file":370,"line":493,"context":487},479,{"file":370,"line":495,"context":487},517,{"file":370,"line":497,"context":487},537,{"file":370,"line":499,"context":487},549,{"file":501,"line":502,"context":487},"core\\CloudApp.php",231,{"file":501,"line":504,"context":487},232,{"file":203,"line":387,"context":487},{"file":209,"line":507,"context":487},345,{"file":209,"line":509,"context":487},375,{"file":209,"line":511,"context":487},377,{"file":209,"line":513,"context":487},378,{"file":209,"line":515,"context":487},384,{"file":209,"line":517,"context":487},2294,{"file":209,"line":519,"context":487},2387,{"file":209,"line":521,"context":487},2402,{"file":523,"line":328,"context":487},"views\\app-widgets\\acl-rules.php",{"file":525,"line":526,"context":487},"views\\app-widgets\\active-lockouts.php",8,{"file":525,"line":528,"context":487},81,{"file":530,"line":350,"context":487},"views\\app-widgets\\country-access-rules.php",{"file":530,"line":468,"context":487},{"file":530,"line":533,"context":487},120,{"file":530,"line":535,"context":487},136,{"file":537,"line":538,"context":487},"views\\app-widgets\\event-log.php",60,{"file":537,"line":251,"context":487},{"file":541,"line":542,"context":487},"views\\app-widgets\\login-attempts.php",95,{"file":541,"line":544,"context":487},184,{"file":546,"line":547,"context":487},"views\\chart-circle-failed-attempts-today.php",181,{"file":549,"line":547,"context":487},"views\\chart-failed-attempts.php",{"file":549,"line":551,"context":487},182,{"file":553,"line":538,"context":487},"views\\micro-cloud-modal.php",{"file":553,"line":555,"context":487},68,{"file":553,"line":93,"context":487},{"file":553,"line":123,"context":487},{"file":553,"line":214,"context":487},{"file":362,"line":560,"context":487},77,{"file":362,"line":562,"context":487},163,{"file":362,"line":564,"context":487},207,{"file":362,"line":566,"context":487},210,{"file":362,"line":568,"context":487},240,{"file":362,"line":570,"context":487},402,{"file":362,"line":572,"context":487},449,{"file":362,"line":574,"context":487},543,{"file":576,"line":577,"context":487},"views\\options-page.php",57,{"file":576,"line":579,"context":487},73,{"file":576,"line":259,"context":487},{"file":576,"line":582,"context":487},150,{"file":576,"line":584,"context":487},156,{"file":576,"line":586,"context":487},162,{"file":576,"line":588,"context":487},168,{"file":576,"line":590,"context":487},172,{"file":576,"line":592,"context":487},176,{"file":576,"line":551,"context":487},{"file":595,"line":596,"context":487},"views\\tab-dashboard.php",112,{"file":595,"line":248,"context":487},{"file":595,"line":599,"context":487},191,{"file":595,"line":601,"context":487},196,{"file":595,"line":603,"context":487},203,{"file":595,"line":605,"context":487},209,{"file":595,"line":607,"context":487},216,{"file":595,"line":609,"context":487},224,{"file":595,"line":502,"context":487},{"file":595,"line":612,"context":487},238,{"file":595,"line":288,"context":487},{"file":595,"line":615,"context":487},262,{"file":617,"line":155,"context":487},"views\\tab-debug.php",{"file":617,"line":442,"context":487},{"file":617,"line":468,"context":487},{"file":621,"line":422,"context":487},"views\\tab-logs-custom.php",{"file":623,"line":442,"context":487},"views\\tab-logs-local.php",{"file":623,"line":625,"context":487},52,{"file":623,"line":627,"context":487},70,{"file":623,"line":528,"context":487},{"file":623,"line":228,"context":487},{"file":623,"line":248,"context":487},{"file":623,"line":632,"context":487},197,{"file":623,"line":634,"context":487},205,{"file":623,"line":636,"context":487},218,{"file":623,"line":638,"context":487},226,{"file":623,"line":640,"context":487},233,{"file":623,"line":300,"context":487},{"file":623,"line":643,"context":487},304,{"file":645,"line":254,"context":487},"views\\tab-premium.php",{"file":645,"line":647,"context":487},165,{"file":649,"line":650,"context":487},"views\\tab-settings.php",55,{"file":649,"line":652,"context":487},61,{"file":649,"line":232,"context":487},{"file":649,"line":655,"context":487},160,{"file":649,"line":657,"context":487},173,{"file":649,"line":659,"context":487},186,{"file":649,"line":661,"context":487},189,{"file":649,"line":663,"context":487},202,{"file":649,"line":665,"context":487},214,{"file":649,"line":615,"context":487},{"file":649,"line":668,"context":487},272,{"file":649,"line":670,"context":487},369,{"file":649,"line":672,"context":487},383,{"file":649,"line":674,"context":487},432,{"file":649,"line":676,"context":487},441,{"file":649,"line":678,"context":487},525,{"file":649,"line":680,"context":487},596,{"file":649,"line":682,"context":487},605,[],[685,708,728,738],{"entryPoint":686,"graph":687,"unsanitizedCount":343,"severity":39},"app_log_action_callback (core\\Ajax.php:180)",{"nodes":688,"edges":705},[689,694,698],{"id":690,"type":691,"label":692,"file":370,"line":693},"n0","source","$_POST",198,{"id":695,"type":696,"label":697,"file":370,"line":693},"n1","transform","→ request()",{"id":699,"type":700,"label":701,"file":702,"line":703,"wp_function":704},"n2","sink","fopen() [File Access]","core\\http\\HttpTransportFopen.php",64,"fopen",[706,707],{"from":690,"to":695,"sanitized":367},{"from":695,"to":699,"sanitized":367},{"entryPoint":709,"graph":710,"unsanitizedCount":343,"severity":39},"\u003CAjax> (core\\Ajax.php:0)",{"nodes":711,"edges":724},[712,715,719,720,722],{"id":690,"type":691,"label":713,"file":370,"line":714},"$_POST (x4)",53,{"id":695,"type":700,"label":716,"file":370,"line":717,"wp_function":718},"echo() [XSS]",485,"echo",{"id":699,"type":691,"label":692,"file":370,"line":693},{"id":721,"type":696,"label":697,"file":370,"line":693},"n3",{"id":723,"type":700,"label":701,"file":702,"line":703,"wp_function":704},"n4",[725,726,727],{"from":690,"to":695,"sanitized":369},{"from":699,"to":721,"sanitized":367},{"from":721,"to":723,"sanitized":367},{"entryPoint":729,"graph":730,"unsanitizedCount":27,"severity":737},"app_load_successful_login_callback (core\\Ajax.php:380)",{"nodes":731,"edges":735},[732,734],{"id":690,"type":691,"label":692,"file":370,"line":733},396,{"id":695,"type":700,"label":716,"file":370,"line":497,"wp_function":718},[736],{"from":690,"to":695,"sanitized":369},"low",{"entryPoint":739,"graph":740,"unsanitizedCount":27,"severity":737},"app_load_acl_rules_callback (core\\Ajax.php:739)",{"nodes":741,"edges":746},[742,744],{"id":690,"type":691,"label":692,"file":370,"line":743},745,{"id":695,"type":700,"label":716,"file":370,"line":745,"wp_function":718},769,[747],{"from":690,"to":695,"sanitized":369},{"summary":749,"deductions":750},"The 'limit-login-attempts-reloaded' plugin v2.26.28 exhibits a mixed security posture.  On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and performing nonce checks on all its AJAX handlers. The lack of critical or high severity taint flows and no currently unpatched CVEs are also strong indicators of a generally secure recent state.\n\nHowever, concerns arise from the presence of one AJAX handler without authentication checks, which represents a direct attack vector.  While the static analysis did not reveal dangerous functions or raw SQL, the vulnerability history shows a pattern of past issues, including high and medium severity vulnerabilities, particularly related to missing authorization, excessive authentication attempts, and cross-site scripting. This history suggests a need for continued vigilance and a robust review process for future updates.  The 70% proper output escaping, while not critically low, indicates room for improvement in preventing potential cross-site scripting vulnerabilities.\n\nIn conclusion, the plugin has strengths in its handling of SQL and AJAX nonces. Nevertheless, the single unprotected AJAX endpoint and the historical vulnerability data warrant attention. The plugin is not without risks, and ongoing monitoring and prompt patching of any newly discovered vulnerabilities will be crucial.",[751,753,756,758],{"reason":752,"points":526},"Unprotected AJAX handler found",{"reason":754,"points":755},"Output escaping not fully comprehensive (70%)",5,{"reason":757,"points":219},"History of past high severity vulnerabilities",{"reason":759,"points":760},"History of past medium severity vulnerabilities",6,"2026-03-16T16:57:06.046Z",{"wat":763,"direct":778},{"assetPaths":764,"generatorPatterns":770,"scriptPaths":771,"versionParams":772},[765,766,767,768,769],"\u002Fwp-content\u002Fplugins\u002Flimit-login-attempts-reloaded\u002Fassets\u002Fcss\u002Flogin.css","\u002Fwp-content\u002Fplugins\u002Flimit-login-attempts-reloaded\u002Fassets\u002Fcss\u002Fstyles.css","\u002Fwp-content\u002Fplugins\u002Flimit-login-attempts-reloaded\u002Fassets\u002Fjs\u002Fdist\u002Fapp.js","\u002Fwp-content\u002Fplugins\u002Flimit-login-attempts-reloaded\u002Fassets\u002Fjs\u002Flogin.js","\u002Fwp-content\u002Fplugins\u002Flimit-login-attempts-reloaded\u002Fassets\u002Fjs\u002Fvendors.js",[],[767,768,769],[773,774,775,776,777],"limit-login-attempts-reloaded\u002Fassets\u002Fcss\u002Flogin.css?ver=","limit-login-attempts-reloaded\u002Fassets\u002Fcss\u002Fstyles.css?ver=","limit-login-attempts-reloaded\u002Fassets\u002Fjs\u002Fdist\u002Fapp.js?ver=","limit-login-attempts-reloaded\u002Fassets\u002Fjs\u002Flogin.js?ver=","limit-login-attempts-reloaded\u002Fassets\u002Fjs\u002Fvendors.js?ver=",{"cssClasses":779,"htmlComments":783,"htmlAttributes":786,"restEndpoints":789,"jsGlobals":791,"shortcodeOutput":794},[780,781,782],"llar-login-form","llar-login-wrapper","llar_stats_widget",[784,785],"\u003C!-- LLAR -->","\u003C!-- limit-login-attempts-reloaded -->",[787,788],"data-llar-nonce","data-llar-endpoint",[790],"\u002Fwp-json\u002Fllar\u002Fv1\u002Fajax_check_login",[792,793],"llar","lla_ajax_object",[]]