Title: Digiter Security Lite Author: digiterorg Published: November 2, 2026 Last modified: November 2, 2026 --- Search plugins ![](https://ps.w.org/digiter-security-lite/assets/banner-772x250.png?rev=3779641) ![](https://ps.w.org/digiter-security-lite/assets/icon-256x256.png?rev=3779641) # Digiter Security Lite By [digiterorg](https://profiles.wordpress.org/digiterorg/) [Download](https://downloads.wordpress.org/plugin/digiter-security-lite.1.0.0.zip) * [Details](https://wordpress.org/plugins/digiter-security-lite/#description) * [Reviews](https://wordpress.org/plugins/digiter-security-lite/#reviews) * [Installation](https://wordpress.org/plugins/digiter-security-lite/#installation) * [Development](https://wordpress.org/plugins/digiter-security-lite/#developers) [Support](https://wordpress.org/support/plugin/digiter-security-lite/) ## Description [Website: digiter.org](https://digiter.org/) | [Full version / Shop](https://digiter.org/shop/?product=digiter-security-ultimate) Digiter Security Lite adds practical local protections and checks to single-site WordPress. All bundled features are free, without a license, account, trial period or external service. **Included free** * Optional login throttling: five failed password sign-ins from a direct IP connection within 15 minutes trigger a 15-minute cooldown. A successful sign-in clears that connection’s counter. * Executable filename protection for WordPress upload and sideload handlers, including double extensions such as file.php.jpg and server configuration filenames. * Review of HTTPS URL configuration, WordPress debug display, built-in file editor settings and login counter storage. * Administrator-controlled SHA-256 baseline for seven fixed files in the WordPress root, with explicit comparisons showing changed, added, removed, skipped or unchanged files. * Optional Full version shop link and manual installation instructions on the plugin screen and Plugins list. No telemetry, remote assets, private updater, remote code installation, advertising on public pages or threat-feed connection is included. **Login protection and recovery** Login throttling is off until an administrator enables it. It uses only the server- provided REMOTE_ADDR. It ignores X-Forwarded-For and other forwarded headers. Shared networks and reverse proxies can share a counter; enable it only when your server supplies the correct direct visitor address. An invalid or missing address does not trigger throttling. A database failure also fails open rather than blocking every visitor; confirm that Login storage is available. The throttle covers password sign-ins that use WordPress’s authenticate filter. Existing sessions, application passwords, alternative authentication that bypasses this filter, direct server access and distributed attacks using many addresses are outside its scope. It does not rate-limit every HTTP request. A request already being processed when a cooldown is set can complete. Cooldowns do not extend when a blocked sign-in is retried. An administrator can reset cooldowns from the plugin screen. If locked out, wait 15 minutes or rename the digiter-security-lite directory under wp-content/plugins using your hosting file manager. Restore the folder name and reactivate after regaining access. Test login protection on staging before enabling it on a shared or proxied production site. **Upload protection** The filename guard is on after first activation. It supplements WordPress’s own checks and preserves existing upload errors. It blocks executable extensions including PHP, PHTML, PHAR, CGI, ASP, scripts and executable binaries, including these extensions within a double-extension filename. It also blocks .htaccess, .htpasswd, .user.ini and web.config. It is not a content scanner, quarantine service or server firewall. SFTP, direct filesystem writes, existing files and upload handlers that bypass WordPress filters are not covered. This guard does not grant permission to upload file types otherwise disallowed by WordPress. **Integrity baseline** The fixed root paths are index.php, wp-load.php, wp-settings.php, wp-blog-header. php, wp-config.php, .htaccess and .user.ini. A baseline must be recorded deliberately after verifying these files against trusted originals. It is not automatically refreshed when files change. An unchanged file is not necessarily safe: a baseline made on a compromised site will record the compromised files. The check reads file hashes only. It does not modify, restore, quarantine or display file contents. Files outside the WordPress root (including wp-config.php in a parent directory), symlinks, unreadable files and files larger than 8 MB are excluded. This resource safeguard is not a paid restriction. Comparisons run only when an administrator clicks Compare files now; the last result is timestamped. WordPress updates may legitimately change the baseline files. Review changes before recording a new trusted baseline. **Optional Full version** Use **Buy Full version** in the Plugins list or Security Lite screen to open [Digiter Shop](https://digiter.org/shop/?product=digiter-security-ultimate) directly from WordPress. Select Digiter Security Ultimate and review its current features, price and renewal terms. Complete checkout on digiter.org and follow the order email or Customer Account instructions to download the Full ZIP and license. Back up your site and test on staging. Deactivate Lite, install the Full ZIP through Plugins > Add New > Upload Plugin, activate Full and enter the license in its License screen. Lite settings and baselines are independent and are not imported into Full. The separate Full product provides its own advanced security modules. [Full product documentation](https://digiter.org/digiter-shop-documentation/digiter-security-ultimate/) describes current capabilities and purchase requirements. Those modules are not bundled or locked inside Lite. The commercial screenshot is a clearly identified reference, not a representation of Lite’s included features. Following a shop link is optional and opens the website in your browser. Lite never downloads or installs commercial code. **Privacy and retention** Processing is local. The plugin’s dgsclt_attempts database table stores an HMAC of the direct IP address, failure count and timestamps. It stores no raw IP addresses, usernames, passwords, emails or request bodies. Pseudonymous connection identifiers can still be personal data. Records expire after 24 hours and are deleted when the hourly WordPress cron task executes. Successful sign-in clears the connection’s record. Administrators can clear all records with Reset login cooldowns. Disabling login protection or deactivating the plugin also clears them. Settings, baseline hashes and the last comparison are stored in dgsclt_settings, dgsclt_baseline and dgsclt_comparison. Deactivation preserves these options. Uninstall removes all three options, the plugin table and its scheduled cleanup. No data is sent to Digiter. The optional shop and documentation sites have their own privacy policies. **Compatibility and source** Single-site WordPress 6.6 or later, PHP 8.2 or later, MySQL/MariaDB. Multisite and SQLite are unsupported. The plugin does not edit wp-config.php, .htaccess or other server configuration. Configuration observations are not a certificate test or a guarantee against compromise. Use backups, maintained software and suitable server security alongside these checks. All readable PHP and CSS source is included; no build step or third-party library is required. Original Digiter code and graphics are GPL-2.0-or-later. Screenshot 2 is the unmodified Full-edition screenshot provided by the owner. ## Screenshots [⌊Actual Digiter Security Lite dashboard with local protection settings, configuration review, integrity baseline and an optional Full version purchase guide.⌉⌊Actual Digiter Security Lite dashboard with local protection settings, configuration review, integrity baseline and an optional Full version purchase guide.⌉[ Actual Digiter Security Lite dashboard with local protection settings, configuration review, integrity baseline and an optional Full version purchase guide. [⌊Owner-supplied Full-edition reference: Digiter Security Ultimate dashboard. The threat map, malware scanner, two-factor authentication and advanced modules shown here belong to the separate Full version and are not included in Lite.⌉⌊Owner-supplied Full-edition reference: Digiter Security Ultimate dashboard. The threat map, malware scanner, two-factor authentication and advanced modules shown here belong to the separate Full version and are not included in Lite.⌉[ Owner-supplied Full-edition reference: Digiter Security Ultimate dashboard. The threat map, malware scanner, two-factor authentication and advanced modules shown here belong to the separate Full version and are not included in Lite. ## Installation 1. Install the ZIP through Plugins > Add New > Upload Plugin, then activate it. 2. Open Security Lite. The upload filename guard is enabled; login throttling starts disabled. 3. Review your hosting and proxy configuration before enabling login throttling. 4. Verify the seven root files against trusted originals, record a baseline and compare after relevant changes. ## FAQ ### Is a license or Full purchase required? No. Every feature bundled in Lite works free without a license or account. ### Is this a malware scanner or web application firewall? No. Lite supplies focused login and upload filename protections, configuration observations and a local integrity baseline. It does not inspect all requests or scan the entire website for malware. ### Can I use this behind a reverse proxy? Only enable login throttling if REMOTE_ADDR represents the actual visitor after a trusted server-level configuration. Otherwise leave login throttling off to avoid sharing cooldowns across visitors. Other Lite checks remain available. ### What does a baseline match prove? Only that a file’s bytes match the trusted baseline you recorded. It does not prove the file is malware-free. A missing, skipped or unrecorded file is never reported as a matching file. ### Does Lite install Full automatically? No. Purchase through the optional shop link, then deliberately install the Full ZIP using the normal WordPress upload workflow. Deactivate Lite first. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Digiter Security Lite” is open source software. The following people have contributed to this plugin. Contributors * [ digiterorg ](https://profiles.wordpress.org/digiterorg/) [Translate “Digiter Security Lite” into your language.](https://translate.wordpress.org/projects/wp-plugins/digiter-security-lite) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/digiter-security-lite/), check out the [SVN repository](https://plugins.svn.wordpress.org/digiter-security-lite/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/digiter-security-lite/) by [RSS](https://plugins.trac.wordpress.org/log/digiter-security-lite/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial standalone free release with optional login throttling, executable upload filename protection, configuration checks, local integrity comparisons and Full purchase guidance. ## Meta * Version **1.0.0** * Last updated **16 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.6 or higher ** * Tested up to **7.1.4** * PHP version ** 8.2 or higher ** * Tags * [integrity](https://wordpress.org/plugins/tags/integrity/)[login](https://wordpress.org/plugins/tags/login/) [protection](https://wordpress.org/plugins/tags/protection/)[security](https://wordpress.org/plugins/tags/security/) [uploads](https://wordpress.org/plugins/tags/uploads/) * [Advanced View](https://wordpress.org/plugins/digiter-security-lite/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/digiter-security-lite/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/digiter-security-lite/reviews/) ## Contributors * [ digiterorg ](https://profiles.wordpress.org/digiterorg/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/digiter-security-lite/)