All in One Content Protector & Security

All in One Content Protector & Security checks how secure your WordPress site really is. It explains each problem in plain language, shows the evidence it found and how to fix it, and can fix many problems for you once you confirm.

It is built to be safe on a live site:

• Scans only read your site.

• Nothing is changed until you confirm a fix, and every fix can be undone.

• Every protection is off until you switch it on.

• Your files, database and plugin list never leave your server.

Security overview

• A security score out of 100, with its history.

• Open issues by severity (critical, high, medium, low) and the number of passed checks.

• The status of WordPress, PHP, the database and HTTPS.

• Recent security events and suspicious traffic.

• Recommended next steps.

Every issue has its own page with:

• what was found, and the evidence

• why it matters

• step-by-step instructions, with links to official documentation

• the issue’s history

An issue is marked as solved only when a new scan confirms the problem is gone. You can also accept a risk with a note; it reopens automatically if the evidence changes.

Security scanner

77 read-only checks in eight areas:

• WordPress:

• updates and automatic security updates

• core files compared with the official WordPress.org checksums

• keys and salts, debug settings and the file editor

• user registration with privileged roles

• user name exposure

• PHP:

• supported version (end-of-life detection)

• error display, dangerous settings and functions

• whether PHP can run in the uploads folder

• Database:

• server version and connection encryption

• excessive privileges of the database user

• administrators hidden from the user list or created outside WordPress

• malicious code stored in settings

• Passwords are never displayed.

• Files:

• wp-config.php permissions and exposure

• writable files and PHP files in uploads

• suspicious.htaccess and.user.ini rules

• downloadable backups and database dumps

• forgotten phpinfo pages and database tools

• File changes:

• Plugins from WordPress.org are compared with their official checksums.

• Themes, premium plugins, must-use plugins and drop-ins are compared with a baseline.

• Changes made by updates are accepted automatically.

• Plugins and themes:

• available updates

• known vulnerabilities, with the version that fixes them

• plugins closed on WordPress.org, and unmaintained or unused extensions

• A plugin is never called vulnerable just because it is old or inactive.

• Web server:

• HTTPS and certificate expiry

• security headers and CORS settings

• directory listings and version disclosure

• Traffic: ongoing login attacks, XML-RPC abuse, and proxies that are not set up.

Scans run in short steps, so they never time out. You can cancel and resume them, and they continue in the background. Run a quick scan, a full scan or a scan of one area, or schedule daily or weekly scans.

A check that cannot run is reported as “could not check”, never as passed.

Vulnerability alerts

Add a free Wordfence Intelligence API key and the plugin downloads the vulnerability database once a day. It compares the database with your plugins, themes and WordPress version on your server, so your plugin list is not sent anywhere. Developers can add other data sources.

Login, bot and traffic protection

All of these are off until you switch them on:

• Login protection. Temporary blocks after repeated failed logins, longer for repeat offenders. Blocks always expire, unless you add one yourself.

• XML-RPC control. Disable pingbacks, block system.multicall, or turn XML-RPC off completely. This works on every server, including Nginx.

• Bot blocking. Block repeated probing for sensitive files, floods of “page not found” requests, known attack tools and fake search engine crawlers. Crawlers are checked by their published addresses or by reverse DNS, never by the user agent alone.

• Security headers. Sent by PHP on every server. The Content-Security-Policy starts in report-only mode and comes with a compatibility check against your home page.

• Hardening. Disable the file editor, hide PHP errors, and hide user names and the WordPress version from visitors.

• Allowlist and manual blocks. Cloudflare and proxy support, and an emergency safe mode.

The plugin takes care not to block real visitors:

• Logged-in administrators and allowlisted addresses are never blocked.

• If another website makes a visitor’s browser send requests to your site, those requests never get the visitor blocked.

• A proxy or CDN address shared by many visitors is never blocked automatically.

These protections work inside WordPress and reduce automated attacks. They cannot stop network floods (DDoS); that needs protection from your host or CDN.

Safe fixes you can undo

Many issues have an Apply fix button. Before anything changes you see:

• the problem and the exact change

• the expected impact

• the backup that will be made, and how to undo the change

You have to confirm before anything is changed.

• Changes to.htaccess are backed up, tested with a request to your site, and reverted automatically if the site returns an error.

• Every fix can be undone from the change history.

• The plugin never changes file permissions, PHP versions, database privileges, or plugin and theme files.

Alerts and reports

• E-mail alerts for new issues (each issue only once), new administrator accounts and repeated login attacks.

• Daily or weekly summaries.

• A printable report.

• CSV exports of issues and events, and JSON exports of scans.

• A Site Health test.

• WP-CLI commands ( wp aowpcs ).

Content protection

Block text selection, image dragging, right-click and the browser console. You can choose not to apply these to logged-in editors and administrators.

This makes casual copying less convenient. Anything a browser shows can still be saved by a determined visitor, so treat it as a deterrent, not a security measure.

External services

The plugin contacts these services only when the related feature is turned on.

org)

• Used for: official checksums of WordPress and of WordPress.org plugins, plugin and theme directory information, and WordPress’ own update checks.

• Data sent: your WordPress version and language, and the names and versions of your installed plugins and themes.

• Turned on by: “WordPress.org lookups” in Security → Settings.

• Privacy policy

com)

• Used for: the vulnerability database. It is downloaded and compared on your server.

• Data sent: your API key and, as with any download, your server’s IP address.

• Turned on by: entering an API key.

• Terms · Privacy policy

com)

• Used for: the published address ranges of their crawlers. Nothing about your site is sent.

• Turned on by: crawler verification.

• Google privacy policy · Microsoft privacy statement

com)

• Used for: Cloudflare’s published address ranges. Nothing about your site is sent.

• Turned on by: the Cloudflare preset.

• Privacy policy

Your DNS resolver

• Used for: reverse DNS lookups of addresses that claim to be search engine crawlers.

• Turned on by: crawler verification.

Your own site

• Used for: checking what visitors can reach (exposed files, headers, directory listings), by requesting your own pages.

Privacy

Traffic monitoring is off by default. When you turn it on, the plugin stores the following, for suspicious requests only:

• the time

• the IP address, shortened by default

• the request method, and the path without the query string

• the HTTP status

• the user agent

• why the request was flagged

For failed logins it stores only whether the account exists, never the user name or password. Passwords, cookies, authorization headers and request bodies are never stored.

Events are deleted after 30 days; you can change this. Administrator logins are recorded with the user ID; you can turn this off.