Papy3D Security Guard
Papy3D Security Guard is a modular WordPress security suite. Protections are disabled by default and can be enabled independently. Early login protection, local CAPTCHA, lockouts, honeypots and IPv4/IPv6/CIDR controls. Local WAF with observation, balanced and strict modes, plus delegation to Papy3D
Papy3D Security Guard is a modular WordPress security suite. Protections are disabled by default and can be enabled independently.
- Early login protection, local CAPTCHA, lockouts, honeypots and IPv4/IPv6/CIDR controls.
- Local WAF with observation, balanced and strict modes, plus delegation to Papy3D WAF when installed.
- TOTP, recovery codes, login alerts, forced password resets and session controls.
- WordPress hardening, sensitive-file checks, core integrity verification and bounded security logs.
- Incremental heuristic malware/backdoor scanner with explicit exceptions, encrypted quarantine and WP-CLI support.
- File-permission, HTTPS, trusted-proxy and mixed-content diagnostics.
- Optional Wordfence Intelligence synchronization followed by offline vulnerability checks.
- GDPR controls, centralized alerts and secret-free JSON settings transfer.
CAPTCHA, TOTP and normal malware scans remain local. External requests occur only for explicitly enabled or requested features documented below.
Data and privacy
Settings are stored in WordPress options. The encryption master key is stored separately as a non-autoloaded option or multisite network option. Early-guard runtime state contains bounded counters, timestamps and truncated HMAC identifiers rather than plaintext usernames, passwords or CAPTCHA answers. Local WAF events may contain time, IP address, HMAC identifier, method, path without query string, rule identifiers, severity, action, bounded redacted excerpts, payload hash and user agent. Cookies, authorization headers, complete passwords and complete request bodies are not stored.
TOTP data is encrypted or hashed in user metadata. Repeated-login/TOTP counters are HMAC-keyed and expiring. Username blacklist and honeypot reports can store detected IP addresses, bounded identifiers, counters and timestamps. Login and sensitive-action alerts may include IP address and user agent in email sent through the site’s configured mail system. No analytics, external CAPTCHA, remote QR-code or remote authentication service is used.
