Vardalion Security

Vardalion Security is a security plugin for WordPress that monitors suspicious behaviour, assigns threat scores and can automatically block hostile IP addresses.

The free Core plugin includes:

• Request inspection for common exploit and malicious-request patterns.
• Brute-force and authentication protection.
• User-enumeration and REST user-endpoint protection.
• Login request rate limiting.
• Bot and security-scanner detection.
• Threat scoring with configurable automatic IP blocking.
• Repeat-offender escalation and optional permanent blocking.
• Manual IP and CIDR network blocking with lockout-safety checks.
• Subnet intelligence and administrator-reviewed network recommendations.
• Security event logging, filtering and CSV export.
• High-severity email alerts.
• Emergency Mode for recovering from an enforcement configuration problem.
• WordPress core-file checksum verification for protected wp-admin PHP paths.
• Trusted-proxy and Cloudflare-origin handling controls.

Vardalion Security Core is permanently free. It does not expire, require a licence key, or unlock included functionality after payment.

An optional separately distributed Vardalion Security Pro companion plugin can extend Core with additional commercial functionality. Pro code, licensing and update delivery are not included in the WordPress.org Core plugin.

Privacy

Vardalion Security is a security plugin and may process information that can be personal data, including IP addresses and user-agent strings.

Core security data is stored locally in the WordPress database. Administrators control the configured log-retention period and can manually remove blocks.

Vardalion Security Core does not send security logs or visitor telemetry to Vince Web Design.