Loyal Security – Firewall & Malware Scanner
Loyal Security – Firewall & Malware Scanner is an all-in-one WordPress security suite: a dual-mode web application firewall, malware scanner with file integrity monitoring, server hardening, two-factor authentication, backups, and audit logging — in a single self-contained plugin. Every protection r
Loyal Security – Firewall & Malware Scanner is an all-in-one WordPress security suite: a dual-mode web application firewall, malware scanner with file integrity monitoring, server hardening, two-factor authentication, backups, and audit logging — in a single self-contained plugin.
Every protection runs on your own server with the rules bundled in the plugin. No Node.js, no build step: the admin dashboard is a React app powered by WordPress core’s own bundled wp-element, and every PHP class is loaded by a built-in autoloader. Install it, activate it, and it works. A small number of features use outside services; each one is listed under “External services” below, with what it sends and how to switch it off.
Everything in this plugin is free and fully functional — nothing is locked, limited or time-restricted. Loyal Security Pro is a separate plugin, sold and downloaded from our website, that adds automation and agency tools on top.
Features
- Web Application Firewall — Optimized Mode (runs before WordPress even loads, via a lightweight prepend) or Standard Mode (runs inside WordPress). Blocks SQL injection, XSS, LFI/RFI, path traversal, and RCE.
- Rate limiting, brute-force protection & DDoS shielding — plus a bad-bot blocker and country-level geo-blocking that works with or without a CDN (bundled IP-to-country data, no outside lookups).
- Virtual patching — shields known-vulnerable third-party plugins/themes until you’re able to update them.
- Deep system hardening — .htaccess/Nginx rule generation, wp-config hardening, directory-browsing lockdown, REST API & XML-RPC restriction, version obfuscation.
- Malware scanner — heuristic regex + token-based detection engine, on-demand full-site scans, and a weekly automatic scan.
- File integrity monitoring — WordPress.org checksum verification for core and plugins, plus baseline diffing for everything else, including themes, mu-plugins and drop-ins.
- Database scanner — checks posts, page-builder content, category descriptions, comments, options, user meta and code-snippet plugins for injected scripts (including scripts loaded from outside hosts), spam links, a hijacked site address and rogue admin accounts.
