Atlant Security
Atlant Security is a comprehensive WordPress security plugin that provides enterprise-grade protection through 17 integrated security modules organized in a 5-layer defense architecture. 5-Layer Defense Architecture Early-Request WAF – Firewall, rate limiter, and IP blocking inspect every request at
About this tool.
Atlant Security is a comprehensive WordPress security plugin that provides enterprise-grade protection through 17 integrated security modules organized in a 5-layer defense architecture.
5-Layer Defense Architecture
- 01Early-Request WAF – Firewall, rate limiter, and IP blocking inspect every request at init priority 0, early in WordPress’s load – before the page is queried or rendered and before other plugins process the request.
- 02Application-Aware – Login security, custom login URL, two-factor authentication, session hardening, cron monitoring, and REST API policies.
- 03Content & Config – WordPress hardening, security headers, AI crawler management, and honeypot traps.
- 04Outbound & Data – SSRF prevention, malware scanning (files and database).
- 05Response & Recovery – Post-breach recovery, notifications, visitor log, and audit log.
Key Features
Web Application Firewall (WAF) Inspects every request against 28+ attack pattern families including SQL injection, XSS, remote code execution, path traversal, PHP object injection, and WordPress-specific attacks. Block or log-only mode. Triple URL decoding prevents evasion.
Brute Force Protection Progressive lockout system (5 min > 30 min > 24 hours) with configurable thresholds. Generic login error messages prevent username enumeration. Author ID scans are blocked, and author archive URLs can be rebuilt from display names so they no longer publish valid login names.
Malware Scanner Local file and database scanner with 38 malware signatures. Detects backdoors, webshells (WSO, c99, r57), crypto miners, credit card skimmers, and obfuscated code. Quarantine system with web access blocking.
Two-Factor Authentication (2FA) TOTP (Google Authenticator, Authy) and email OTP. Per-role enforcement, 10 recovery codes, 5-minute challenge timeout, replay attack prevention.
Honeypot Traps Zero-false-positive bot detection: hidden link traps, fake login pages, comment honeypots, and Contact Form 7 integration. 3-layer safe bot protection ensures Googlebot, Bingbot, and allowed AI crawlers are never blocked.
AI Crawler Management Control 20+ known AI/LLM training crawlers (GPTBot, ClaudeBot, Google-Extended, Bytespider, and more). Per-crawler toggles, robots.txt integration, and 403 enforcement. Block training crawlers while allowing browsing bots.
Security Headers Manage HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP, CORP, and COOP. Letter-grade scoring system. Remove X-Powered-By and Server headers.
