NullState Security™

NullState Security™ is a free WordPress security plugin with modular hardening, threat interception, forensic logging, a live traffic monitor (90-day retention), two-factor authentication (TOTP), and a vulnerability scanner.

Key free features:

• Core hardening – disables XML-RPC, hides version leaks, protects the uploads directory
• Brute-force protection – automatic IP lockout after repeated failed logins
• IP blacklist – block attackers manually or from the Live Traffic feed, with CSV import/export
• Request filtering – blocks directory traversal, SQL injection, XSS, eval() and other attack payloads
• User-Agent Bouncer – blocks known malicious scanners and bots (e.g. Nuclei, sqlmap)
• Emergency lockdown – temporarily disable non-admin logins and block the site
• Session terminator – end all other sessions with one click
• Cache & temp purge – clear caches and kill memory-resident shells
• Admin creation lockdown – detect and delete rogue administrator accounts
• Uploads shield – block script execution in the uploads directory
• Forensic logging – every security event recorded with full request context
• Live traffic monitor (90-day) – real-time view of every request, classified as human, bot, or attack, with country flags and one-click IP blocking
• Two-factor authentication – TOTP-based 2FA (Google Authenticator, Authy, …) with backup codes
• Vulnerability scanner – checks plugins, themes and core for known vulnerabilities (optional free WPScan API token for detailed data)
• Manual malware sweeps – C2 trojan cleanup, JS dropshell removal, trojanized CSS stripping, fake dependency removal, transient drop-shell cleanup
• Security scorecard – 0–100 score with actionable recommendations

For advanced security solutions, enterprise-grade protection, and expert support, visit nullstatesecurity.net .

External Services