Loyal Security – Firewall & Malware Scanner

Loyal Security – Firewall & Malware Scanner is an all-in-one WordPress security suite: a dual-mode web application

firewall, malware scanner with file integrity monitoring, server hardening, two-factor

authentication, backups, and audit logging — in a single self-contained plugin.

Every protection runs on your own server with the rules bundled in the plugin. js, no

build step: the admin dashboard is a React app powered by WordPress core’s own bundled

wp-element, and every PHP class is loaded by a built-in autoloader. Install it, activate it,

and it works. A small number of features use outside services; each one is listed under

“External services” below, with what it sends and how to switch it off.

Everything in this plugin is free and fully functional — nothing is locked, limited or

time-restricted. Loyal Security Pro is a separate plugin, sold and downloaded from our

website, that adds automation and agency tools on top.

Features

• Web Application Firewall — Optimized Mode (runs before WordPress even loads, via a

lightweight prepend) or Standard Mode (runs inside WordPress). Blocks SQL injection, XSS,

LFI/RFI, path traversal, and RCE.

• Rate limiting, brute-force protection & DDoS shielding — plus a bad-bot blocker and

country-level geo-blocking that works with or without a CDN (bundled IP-to-country data,

no outside lookups).

• Virtual patching — shields known-vulnerable third-party plugins/themes until you’re

able to update them.

• Deep system hardening —.htaccess/Nginx rule generation, wp-config hardening,

directory-browsing lockdown, REST API & XML-RPC restriction, version obfuscation.

• Malware scanner — heuristic regex + token-based detection engine, on-demand full-site

scans, and a weekly automatic scan.

• File integrity monitoring — WordPress.org checksum verification for core and plugins,

plus baseline diffing for everything else, including themes, mu-plugins and drop-ins.

• Database scanner — checks posts, page-builder content, category descriptions, comments,

options, user meta and code-snippet plugins for injected scripts (including scripts loaded

from outside hosts), spam links, a hijacked site address and rogue admin accounts.

• Incident response — safe quarantine, one-click clean-file recovery, and file-permission

reset.

• Backup & restore — on-demand and scheduled full-site backups (files + database), plus a

downloadable recovery tool you can upload to restore a backup even if WordPress itself won’t

load.

• Two-factor authentication — TOTP with QR enrollment and backup codes, passkeys, login

CAPTCHA, password policy, breached-password checking, and active-session management.

• Audit log — full event trail with IP/user/proxy tracking, configurable retention

(90 days by default), and CSV export.

• Email notifications — alerts with human-readable event guidance, throttling, quiet

hours and per-event muting.

• Live Traffic monitor — real-time request feed with user-agent classification, filters,

and one-click block/unblock.

• Content Security Policy manager — builds a policy from the resources your site

actually loads, with a report-only mode.

• Admin-bar Security Score — an at-a-glance A–F health grade.

• Inline vulnerability notices — flags installed plugins/themes with known CVEs directly

on the Plugins, Themes, and Updates screens.

• WP-CLI support — wp loyal-security status | scan | firewall | backup | twofa.

Loyal Security Pro

Loyal Security Pro is a separate plugin for people running security across many sites. It is

not needed for anything listed above. It adds:

• Hourly threat-intelligence updates, plus extra firewall and malware rules published for

Pro sites.

• Under Attack Mode — a one-click emergency shield with automatic expiry.

• Faster scheduled scans & auto-quarantine — daily or twice-daily scans, and infected files

isolated the moment they are found.

• Sentinel AI — AI-assisted review of suspicious activity with reversible responses.

• Threat hunting, uptime monitoring and compliance reports.

• Webhook, PagerDuty and OpsGenie alerts, and Cloudflare edge sync.

• WooCommerce-aware backups and staging restores.

• Agency tooling — white-label dashboard, role management, and multi-site hub.

External services

Loyal Security connects to the services below. Nothing else is contacted, and no request

carries your site’s URL, your visitors’ personal data, or your content unless stated here.

Requests the plugin makes identify themselves as LoyalSecurity/<version> instead of

WordPress’s default user agent (which includes the site’s URL).

Loyal Security threat-intelligence service (licensekit.loyalsecuritywp.com)

Our own service, used for:

• Threat-intelligence feed (on by default). Keeps the vulnerability (CVE) database up to

date, and delivers new firewall rules, malware signatures and virtual patches whenever we

publish them. Twice a day, and when you

click “Sync now”, the plugin requests each dataset and sends: the dataset name, the version

it already has, the feed channel (“free”, or “pro” with the separate Pro plugin), the

subscription key if Pro stored one, and — for the vulnerability dataset only — the slugs (folder names) of the

installed plugins and themes, so only advisories that concern them are returned. Switch

automatic updates off with Settings → Threat Intelligence → “Auto Sync”, or turn the module

off with “Enabled”; the plugin then keeps using the rules it already has.

• Pricing on the “About Pro” screen. Opening that screen fetches the public plan list. No

site data is sent.

• Connection test. Only when you click “Test connection” on the Threat Intelligence

screen: sends a timestamp, an anonymous install ID and, if present, a hash of the

subscription key.

• Firewall-bypass reports and virtual-patch suggestions (off by default). Only after an

administrator gives explicit consent (Loyal Security → Bypass Telemetry in the Advanced view,

where it can be withdrawn at any time): when an attack appears to have got past the firewall, the plugin

sends the attacker’s request (method, path, parameters, IP address and country), the matching

minor) and an anonymous install ID —

with cookies, authorization headers and nonces removed. With the same consent, a virtual

patch you approve can be shared as a rule suggestion.

html

Have I Been Pwned — Pwned Passwords (api.pwnedpasswords.com)

On by default. When a user logs in, the plugin checks whether the password appears in known

data breaches, using k-anonymity: only the first five characters of the password’s SHA-1 hash

are sent — never the password, the username or the email address. It never blocks a login; the

user sees a warning. Switch it off with Settings → Identity & Access → “Breach Check”.

com/Privacy

Cloudflare Turnstile (challenges.cloudflare.com)

Only if you choose Turnstile as the login CAPTCHA and enter your keys. The Turnstile script

loads on the login form, and on submission the visitor’s CAPTCHA token and IP address are sent

to Cloudflare to verify it.

com/turnstile-privacy-policy/

Google reCAPTCHA (www.google.com)

Only if you choose reCAPTCHA v3 as the login CAPTCHA and enter your keys. The reCAPTCHA script

loads on the login form, and on submission the visitor’s CAPTCHA token and IP address are sent

to Google to verify it.

com/privacy

Google Safe Browsing (safebrowsing.googleapis.com)

Only if you enter your own Safe Browsing API key (Settings → Hardening). The plugin then sends

your site’s home URL to check whether Google has flagged it. Nothing is sent without a key.

com/privacy

WordPress.org (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org)

File integrity checks download the official checksums of WordPress core and of the installed

org plugins (plugin slug and version). When you choose to repair or reinstall, the

official WordPress core or plugin package, or a single core file, is downloaded. These are the

same public services WordPress uses for updates.

File Integrity Monitoring is on by default and its check also runs on a weekly schedule, so

these checksums are fetched automatically as well as when you start a check yourself. Switch

the automatic run off in Settings → File Integrity Monitoring (the scheduled check, or the

whole module).

org does not publish a separate

terms of service for these endpoints; they are the same public APIs WordPress core itself uses,

org/about/license/

Stylesheets your pages already load (CSP scanner)

Only when an administrator clicks “Scan” on the Content Security Policy screen. To suggest

which domains your policy should allow, the scanner loads a few of your own pages and the

external stylesheets those pages already use (for example a Google Fonts or CDN stylesheet),

with a plain request that carries no site data. Those providers’ own terms apply to those

files, exactly as when a visitor loads your site.

DNS (your server’s resolver)

To confirm that a visitor claiming to be a search-engine crawler (Googlebot, Bingbot…) really

is one, the plugin performs a reverse and forward DNS lookup of that visitor’s IP address

through your server’s normal DNS resolver. The result is cached.