About this plugin
Vardalion Security is a security plugin for WordPress that monitors suspicious behaviour, assigns threat scores and can automatically block hostile IP addresses.
The free Core plugin includes:
- Request inspection for common exploit and malicious-request patterns.
- Brute-force and authentication protection.
- User-enumeration and REST user-endpoint protection.
- Login request rate limiting.
- Bot and security-scanner detection.
- Threat scoring with configurable automatic IP blocking.
- Repeat-offender escalation and optional permanent blocking.
- Manual IP and CIDR network blocking with lockout-safety checks.
- Subnet intelligence and administrator-reviewed network recommendations.
- Security event logging, filtering and CSV export.
- High-severity email alerts.
- Emergency Mode for recovering from an enforcement configuration problem.
- WordPress core-file checksum verification for protected wp-admin PHP paths.
- Trusted-proxy and Cloudflare-origin handling controls.
Vardalion Security Core is permanently free. It does not expire, require a licence key, or unlock included functionality after payment.
An optional separately distributed Vardalion Security Pro companion plugin can extend Core with additional commercial functionality. org Core plugin.
Privacy
Vardalion Security is a security plugin and may process information that can be personal data, including IP addresses and user-agent strings.
Core security data is stored locally in the WordPress database. Administrators control the configured log-retention period and can manually remove blocks.
Vardalion Security Core does not send security logs or visitor telemetry to Vince Web Design.
Vardalion Security also supplies suggested privacy-policy text to WordPress under Settings > Privacy > Policy Guide so site administrators can adapt the disclosure to their own site.
org using the site’s installed WordPress version and locale. See the external service disclosure in the FAQ above.