Description
007AJ Security Scanner & Firewall is a lightweight security plugin by 007AJ. It runs on your own server, and every feature is off until you turn it on.
Login lockout
- Counts failed logins per IP address. After a set number of failures (default 5 in 15 minutes) the address is locked out for a set time (default 30 minutes).
- Applies to every login that goes through WordPress: the login form, XML-RPC and application passwords. A locked-out address cannot log in even with the right password.
- The login form shows how long the lockout lasts. A successful login resets the counter.
- Locked-out addresses are listed on the Dashboard with an Unlock button.
- Optional email to the site admin when a lockout happens (at most one email every 15 minutes).
Firewall (lite)
- Checks the page address, the query string (names and values) and the names of submitted form fields for obvious attack probes: SQL injection (for example
UNION SELECT,' OR '1'='1,SLEEP(), script injection (<script>, event handlers,javascript:links) and path traversal (../,/etc/passwd,php://). Matching requests get a 403 page. - Logged-in administrators and editors are not checked, so writing posts that contain HTML or code keeps working. Submitted form values (comments, contact forms) are not checked either, to avoid false alarms.
- Optional switch to turn off XML-RPC completely (also removes the pingback header and turns off pingbacks).
- Optional limit on form submissions to wp-login.php per IP address (default 20 in 5 minutes); extra requests get a 429 answer.
- The rules were written for this plugin. They catch common, obvious probes; they are not a complete defence and do not replace keeping WordPress, themes and plugins up to date.
Integrity scan
- A “Run scan now” button compares every WordPress core file on the server with the official checksums published by WordPress.org.
- Lists modified and missing core files, plus files in wp-admin, wp-includes and the site root that are not part of WordPress.
- Reports only. The plugin never changes or deletes files. Plugins, themes and uploads are not scanned.
Hardening switches
- Turn off the theme and plugin file editors (sets
DISALLOW_FILE_EDITunless wp-config.php already sets it). - Limit username discovery for visitors who are not logged in:
?author=Nrequests go to the home page, the REST users endpoint answers 401, and the users sitemap is removed. - Hide the WordPress version generator tag (cosmetic).
- Turn off application passwords.
Activity log
- Records logins, failed logins, lockouts, firewall blocks, rate-limit hits, blocked user discovery, scans and setting changes, with time, IP address and username.
- Keeps only the newest 500 entries. Filter by event; clear with one click.
Dashboard
Today’s lockouts, failed logins, blocked requests, the last scan result, hardening switches and log size, all on one screen.
How IP addresses are read
Only REMOTE_ADDR is used. Forwarded headers such as X-Forwarded-For can be forged by the visitor and are never trusted. If your site is behind a proxy or CDN that does not pass the real visitor address to PHP, every visitor may appear to have the same address. The Settings screen shows the address the server sees for you, so you can check this before turning on lockouts.
External Services
This plugin connects to one external service, and only when an administrator asks it to.
WordPress.org core checksums (api.wordpress.org)
- What it is for: the integrity scan downloads the official list of WordPress core file checksums so it can compare them with the files on your server.
- When: only when an administrator clicks “Run scan now” on the Integrity scan screen. There are no automatic or scheduled requests.
- What is sent: a request to
https://api.wordpress.org/core/checksums/1.0/with your WordPress version number and site language (for exampleversion=7.1&locale=en_US), with the user agent set toWordPress/<version>. Your site address, users and files are not sent. Your server’s IP address is visible to WordPress.org, as with any web request. - Service provider: WordPress.org. Terms of use: https://wordpress.org/about/terms-of-service/ – Privacy policy: https://wordpress.org/about/privacy/
No other outbound requests are made. Nothing is sent to 007AJ. The plugin row on the Plugins screen and the dismissible notice on the plugin’s Dashboard contain a plain link to https://007aj.com/007aj-security-scanner-firewall-suite; nothing is loaded from that address and nothing is sent unless you click the link yourself.
Privacy
What the plugin stores on your server, depending on the features you turn on:
- Activity log (if on): time, event type, IP address, the username entered or used, the user ID of a logged-in user, and a short detail (for example the firewall rule that matched and the page address requested). Newest 500 entries only.
- Login lockout (if on): for each locked-out address, the IP address, the last username tried, the number of failed attempts and the lockout end time, removed when the lockout ends. Failed-attempt and login-request counters are stored as temporary values keyed by a one-way hash of the IP address and expire on their own.
- Lockout emails (if on) go to the site admin address and contain the IP address and last username tried.
- Integrity scan: the last scan result (lists of file names), with no personal data.
- Daily counters for the Dashboard (numbers only).
The plugin adds suggested text to Settings > Privacy and registers a personal data exporter and eraser with WordPress (Tools > Export Personal Data / Erase Personal Data). They find activity log entries by the person’s user ID, username or email address.
Installation
- Upload the
007aj-security-scanner-firewallfolder to/wp-content/plugins/, or install it from Plugins > Add New. - Activate the plugin from the Plugins screen.
- Open 007AJ Security > Settings, turn on the features you want and save.
- Open 007AJ Security > Integrity scan and click Run scan now for a first check of your core files.
FAQ
-
I locked myself out. What now?
-
Wait until the lockout ends, or log in from a different network. If you have file access, you can also rename the plugin folder in
wp-content/plugins/to turn it off. Deactivating the plugin removes all current lockouts. -
Will the firewall break my site?
-
It skips logged-in administrators and editors, does not look at submitted form values, and only matches obvious attack patterns. If a visitor is blocked by mistake, the activity log shows which rule matched; you can turn the firewall off in Settings.
-
Does this plugin remove malware?
-
No. The integrity scan tells you which WordPress core files were changed, removed or added. To restore core files, use Dashboard > Updates > Re-install. Plugins, themes and uploads are not scanned.
-
Does the plugin contact any outside server?
-
Only when you click “Run scan now”. See “External Services” below.
-
What happens to my data when I delete the plugin?
-
By default settings and the log are kept. To remove everything, tick “Delete all plugin data when the plugin is deleted” in Settings before deleting the plugin. This drops the log table and removes all of the plugin’s options and temporary counters.
-
Is there a paid version?
-
007AJ Security Scanner & Firewall Suite is a separate, standalone paid plugin. This plugin shows one dismissible notice about it on its own Dashboard and one link on the Plugins screen. Nothing here is disabled, limited or time-limited.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“007AJ Security Scanner & Firewall” is open source software. The following people have contributed to this plugin.
Contributors
Translate “007AJ Security Scanner & Firewall” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.1.3
- Removed “Tested up to” from the plugin header so it lives only in readme (wordpress.org requirement).
0.1.2
- Fix: on MySQL/MariaDB, activity log entries with long non-ASCII text (for example a long multibyte username or request path) were silently dropped because the text was cut by bytes in the middle of a character. Text is now cut by characters and invalid UTF-8 is removed first.
0.1.1
- Login lockout: failed-login counting per IP, configurable limit, window and lockout length, lockout notice on the login form, Dashboard list with Unlock, optional admin email.
- Firewall (lite): rules for common SQL injection, script injection and path traversal probes; optional XML-RPC switch; optional wp-login.php rate limit.
- Integrity scan: manual comparison of WordPress core files with the official WordPress.org checksums; lists modified, missing and unknown files.
- Hardening switches: file editor, username discovery, generator tag, application passwords.
- Activity log: capped table (500 entries) with filter and clear; personal data exporter and eraser now return and remove real entries.
- Dashboard with today’s counts and the last scan result; new Settings, Integrity scan and Activity log screens.
- Suite notice reworded.
0.1.0
- Initial scaffold: admin Dashboard, settings, privacy policy text, personal data exporter and eraser hooks, opt-in uninstall cleanup, translation template.