Defenora Secure Shield

Rate limiting

• Login and lost-password request limits (transients / object cache)
• Unauthenticated REST write requests (GET/HEAD/OPTIONS are not limited, so public content and WooCommerce reads keep working)
• XML-RPC is not hard-killed; login protection still applies to XML-RPC authentication

WordPress hardening (optional, reversible)

• Disable the plugin and theme file editors
• Hide the WordPress generator tag and core asset ver query args (plugin/theme cache-busting is left intact)
• Disable XML-RPC, or leave it on and block system.multicall (default: multicall blocked, XML-RPC still enabled)
• REST API: unchanged (default), require login for sensitive routes, or restrict most guest REST access (with public/WooCommerce allowlists)
• Compatibility impact is explained on the Hardening screen before you enable a control
• Plugin-managed values can be restored; .htaccess is not edited automatically

Security scanner

• Quick Scan: high-impact configuration checks, with a progress percentage per step
• Full Scan: configuration checks plus core/plugin/theme integrity, suspicious file patterns, user audit, database checks, and security headers
• Report includes score, failed issues, fatal step errors, full check list, and suspicious-file findings
• Scans are read-only: no automatic file deletion, plugin/theme deactivation, or database cleanup
• Scheduled scans: off (manual only), daily, or weekly via WP-Cron (default weekly); overlapping scans are prevented
• Official WordPress.org checksums are used when available; if the checksum service is down, that is not treated as a compromise

File integrity and suspicious code

• Compares WordPress core (and WordPress.org plugins/themes when checksums exist) using official APIs over HTTPS
• Flags PHP in uploads and conservative local patterns (for example dangerous PHP constructs). Terminology is “potentially suspicious,” not a confirmed malware verdict
• Scanned PHP is never executed ( eval is not used to test files)
• Recommended action is review/quarantine, not automatic delete

User security

• Lists usernames, roles, registration dates, and last login when this plugin has observed a login
• Highlights administrator accounts, the default admin username, recently created administrators, and unusual capabilities
• Never displays passwords, hashes, cookies, or other secrets

Database checks

• Administrator capability rows, autoloaded options size, mixed site URL protocols, incomplete user rows
• Does not display password hashes, API keys, salts, or tokens
• Does not delete options or users automatically

Security headers and HTTPS

• Checks Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, and X-Frame-Options (front-end request during full scan)
• Optional sending of safe headers from WordPress ( send_headers ); skipped in wp-admin and skipped if a header is already present
• Aggressive CSP is off unless you enable it; test thoroughly
• HTTPS recommendations only; the plugin does not install certificates

Activity logs

• Events such as login success/failure/block, logout, password reset/change, user create/delete, role changes, plugin/theme/core events, hardening and setting changes, scans
• Fields: ID, time (UTC), type, severity (INFO–CRITICAL), user ID, optional IP and user agent, description
• Search, event type, severity, date range, pagination
• Passwords and secrets are never logged

Privacy

• Optional IP and user-agent logging
• Retention period and automatic log cleanup (WP-Cron)
• WordPress personal data export and erase integration
• Optional “delete all plugin data on uninstall” (off by default)
• No telemetry and no phone-home. Full scans may contact WordPress.org checksum endpoints over HTTPS

Notifications

• Optional emails: administrator login, repeated failed logins, scan completed, critical findings, setting changes
• Cooldown to avoid email floods
• Uses wp_mail() and the site admin email unless you set another address

Tools and diagnostics

• Run scans, export logs (CSV), clear logs, reset plugin settings (confirmation required)
• Diagnostics: WordPress/PHP/database versions, theme, plugin count, memory limit, WP-Cron, HTTPS, REST mode, XML-RPC, file permissions, object cache — no secrets
• Copy or download a safe diagnostics text file

Requirements

• WordPress 6.2 or later
• PHP 8.0 or later
• Capability manage_options (or network options in network admin on multisite)

The free plugin is meant to be useful on its own. It does not disable essential protection to force an upgrade.