Defenora Secure Shield

Defenora Secure Shield is a free WordPress security plugin for site administrators. org Plugin Directory: no trialware lockouts of core features, no hidden tracking, and no automatic file or database deletion.

Scanning and scoring report only the checks this plugin can run. They do not mean a website is fully secure or free of malware.

Dashboard

• Overall security score with clear bands (excellent through critical improvements recommended)

• Counts of critical issues, warnings, and passed checks

• Module status: login protection, hardening, file integrity, security headers, XML-RPC, REST API

• Last scan time, last security event, blocked login count, stored event count

• Quick Scan and Full Scan with live percentage progress

• After each scan: full report, failed issues found, and fatal scan-step errors (if a step crashed)

• The plugin never displays “your website is 100% secure”

Security score

• Transparent weighted checks (HTTPS, file editor, XML-RPC, debug mode, login protection, administrators, REST API, headers, sensitive files, debug.log)

• Each check explains what was tested, why it matters, the current result, and a recommended action

• Hardening is never applied silently; administrators apply or revert it

Login security and brute-force protection

• Tracks successful logins, failed logins, logouts, and password reset requests

• Temporary lockouts by IP and by username (never permanent automatic blocks)

• Configurable failed-attempt threshold and lockout duration

• Login cooldown and rate limits for login and password-reset requests

• Optional generic login errors (does not hide lockout or rate-limit messages)

• Optional idle session timeout (off by default)

• Force logout of another user’s sessions from the Users screen

• Trusted IPs (never lock) and trusted proxies (X-Forwarded-For only if REMOTE_ADDR matches)

• Usernames that should never be locked

• Emergency bypass: define( 'SWSS_DISABLE_LOGIN_PROTECTION', true ); in wp-config.php

Rate limiting

• Login and lost-password request limits (transients / object cache)

• Unauthenticated REST write requests (GET/HEAD/OPTIONS are not limited, so public content and WooCommerce reads keep working)

• XML-RPC is not hard-killed; login protection still applies to XML-RPC authentication

WordPress hardening (optional, reversible)

• Disable the plugin and theme file editors

• Hide the WordPress generator tag and core asset ver query args (plugin/theme cache-busting is left intact)

• Disable XML-RPC, or leave it on and block system.multicall (default: multicall blocked, XML-RPC still enabled)

• REST API: unchanged (default), require login for sensitive routes, or restrict most guest REST access (with public/WooCommerce allowlists)

• Compatibility impact is explained on the Hardening screen before you enable a control

• Plugin-managed values can be restored;.htaccess is not edited automatically

Security scanner

• Quick Scan: high-impact configuration checks, with a progress percentage per step

• Full Scan: configuration checks plus core/plugin/theme integrity, suspicious file patterns, user audit, database checks, and security headers

• Report includes score, failed issues, fatal step errors, full check list, and suspicious-file findings

• Scans are read-only: no automatic file deletion, plugin/theme deactivation, or database cleanup

• Scheduled scans: off (manual only), daily, or weekly via WP-Cron (default weekly); overlapping scans are prevented

• Official WordPress.org checksums are used when available; if the checksum service is down, that is not treated as a compromise

File integrity and suspicious code

• Compares WordPress core (and WordPress.org plugins/themes when checksums exist) using official APIs over HTTPS

• Flags PHP in uploads and conservative local patterns (for example dangerous PHP constructs). Terminology is “potentially suspicious,” not a confirmed malware verdict

• Scanned PHP is never executed ( eval is not used to test files)

• Recommended action is review/quarantine, not automatic delete

User security

• Lists usernames, roles, registration dates, and last login when this plugin has observed a login

• Highlights administrator accounts, the default admin username, recently created administrators, and unusual capabilities

• Never displays passwords, hashes, cookies, or other secrets

Database checks

• Administrator capability rows, autoloaded options size, mixed site URL protocols, incomplete user rows

• Does not display password hashes, API keys, salts, or tokens

• Does not delete options or users automatically

Security headers and HTTPS

• Checks Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, and X-Frame-Options (front-end request during full scan)

• Optional sending of safe headers from WordPress ( send_headers ); skipped in wp-admin and skipped if a header is already present

• Aggressive CSP is off unless you enable it; test thoroughly

• HTTPS recommendations only; the plugin does not install certificates

Activity logs

• Events such as login success/failure/block, logout, password reset/change, user create/delete, role changes, plugin/theme/core events, hardening and setting changes, scans

• Fields: ID, time (UTC), type, severity (INFO–CRITICAL), user ID, optional IP and user agent, description

• Search, event type, severity, date range, pagination

• Passwords and secrets are never logged

Privacy

• Optional IP and user-agent logging

• Retention period and automatic log cleanup (WP-Cron)

• WordPress personal data export and erase integration

• Optional “delete all plugin data on uninstall” (off by default)

• No telemetry and no phone-home. Full scans may contact WordPress.org checksum endpoints over HTTPS

Notifications

• Optional emails: administrator login, repeated failed logins, scan completed, critical findings, setting changes

• Cooldown to avoid email floods

• Uses wp_mail() and the site admin email unless you set another address

Tools and diagnostics

• Run scans, export logs (CSV), clear logs, reset plugin settings (confirmation required)

• Diagnostics: WordPress/PHP/database versions, theme, plugin count, memory limit, WP-Cron, HTTPS, REST mode, XML-RPC, file permissions, object cache — no secrets

• Copy or download a safe diagnostics text file

Requirements

• WordPress 6.2 or later

• PHP 8.0 or later

• Capability manage_options (or network options in network admin on multisite)

The free plugin is meant to be useful on its own. It does not disable essential protection to force an upgrade.