Defenora Secure Shield

Description

Defenora Secure Shield is a free WordPress security plugin for site administrators. It is designed for the WordPress.org Plugin Directory: no trialware lockouts of core features, no hidden tracking, and no automatic file or database deletion.

Scanning and scoring report only the checks this plugin can run. They do not mean a website is fully secure or free of malware.

Dashboard

• Overall security score with clear bands (excellent through critical improvements recommended)
• Counts of critical issues, warnings, and passed checks
• Module status: login protection, hardening, file integrity, security headers, XML-RPC, REST API
• Last scan time, last security event, blocked login count, stored event count
• Quick Scan and Full Scan with live percentage progress
• After each scan: full report, failed issues found, and fatal scan-step errors (if a step crashed)
• The plugin never displays “your website is 100% secure”

Security score

• Transparent weighted checks (HTTPS, file editor, XML-RPC, debug mode, login protection, administrators, REST API, headers, sensitive files, debug.log)
• Each check explains what was tested, why it matters, the current result, and a recommended action
• Hardening is never applied silently; administrators apply or revert it

Login security and brute-force protection

• Tracks successful logins, failed logins, logouts, and password reset requests
• Temporary lockouts by IP and by username (never permanent automatic blocks)
• Configurable failed-attempt threshold and lockout duration
• Login cooldown and rate limits for login and password-reset requests
• Optional generic login errors (does not hide lockout or rate-limit messages)
• Optional idle session timeout (off by default)
• Force logout of another user’s sessions from the Users screen
• Trusted IPs (never lock) and trusted proxies (X-Forwarded-For only if REMOTE_ADDR matches)
• Usernames that should never be locked
• Emergency bypass: define( 'SWSS_DISABLE_LOGIN_PROTECTION', true ); in wp-config.php

Rate limiting

• Login and lost-password request limits (transients / object cache)
• Unauthenticated REST write requests (GET/HEAD/OPTIONS are not limited, so public content and WooCommerce reads keep working)
• XML-RPC is not hard-killed; login protection still applies to XML-RPC authentication

WordPress hardening (optional, reversible)

• Disable the plugin and theme file editors
• Hide the WordPress generator tag and core asset ver query args (plugin/theme cache-busting is left intact)
• Disable XML-RPC, or leave it on and block system.multicall (default: multicall blocked, XML-RPC still enabled)
• REST API: unchanged (default), require login for sensitive routes, or restrict most guest REST access (with public/WooCommerce allowlists)
• Compatibility impact is explained on the Hardening screen before you enable a control
• Plugin-managed values can be restored; .htaccess is not edited automatically

Security scanner

• Quick Scan: high-impact configuration checks, with a progress percentage per step
• Full Scan: configuration checks plus core/plugin/theme integrity, suspicious file patterns, user audit, database checks, and security headers
• Report includes score, failed issues, fatal step errors, full check list, and suspicious-file findings
• Scans are read-only: no automatic file deletion, plugin/theme deactivation, or database cleanup
• Scheduled scans: off (manual only), daily, or weekly via WP-Cron (default weekly); overlapping scans are prevented
• Official WordPress.org checksums are used when available; if the checksum service is down, that is not treated as a compromise

File integrity and suspicious code

• Compares WordPress core (and WordPress.org plugins/themes when checksums exist) using official APIs over HTTPS
• Flags PHP in uploads and conservative local patterns (for example dangerous PHP constructs). Terminology is “potentially suspicious,” not a confirmed malware verdict
• Scanned PHP is never executed (eval is not used to test files)
• Recommended action is review/quarantine, not automatic delete

User security

• Lists usernames, roles, registration dates, and last login when this plugin has observed a login
• Highlights administrator accounts, the default admin username, recently created administrators, and unusual capabilities
• Never displays passwords, hashes, cookies, or other secrets

Database checks

• Administrator capability rows, autoloaded options size, mixed site URL protocols, incomplete user rows
• Does not display password hashes, API keys, salts, or tokens
• Does not delete options or users automatically

Security headers and HTTPS

• Checks Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, and X-Frame-Options (front-end request during full scan)
• Optional sending of safe headers from WordPress (send_headers); skipped in wp-admin and skipped if a header is already present
• Aggressive CSP is off unless you enable it; test thoroughly
• HTTPS recommendations only; the plugin does not install certificates

Activity logs

• Events such as login success/failure/block, logout, password reset/change, user create/delete, role changes, plugin/theme/core events, hardening and setting changes, scans
• Fields: ID, time (UTC), type, severity (INFO–CRITICAL), user ID, optional IP and user agent, description
• Search, event type, severity, date range, pagination
• Passwords and secrets are never logged

Privacy

• Optional IP and user-agent logging
• Retention period and automatic log cleanup (WP-Cron)
• WordPress personal data export and erase integration
• Optional “delete all plugin data on uninstall” (off by default)
• No telemetry and no phone-home. Full scans may contact WordPress.org checksum endpoints over HTTPS

Notifications

• Optional emails: administrator login, repeated failed logins, scan completed, critical findings, setting changes
• Cooldown to avoid email floods
• Uses wp_mail() and the site admin email unless you set another address

Tools and diagnostics

• Run scans, export logs (CSV), clear logs, reset plugin settings (confirmation required)
• Diagnostics: WordPress/PHP/database versions, theme, plugin count, memory limit, WP-Cron, HTTPS, REST mode, XML-RPC, file permissions, object cache — no secrets
• Copy or download a safe diagnostics text file

Requirements

• WordPress 6.2 or later
• PHP 8.0 or later
• Capability manage_options (or network options in network admin on multisite)

The free plugin is meant to be useful on its own. It does not disable essential protection to force an upgrade.