Title: Dwarpal Author: Dwarpal Published: November 7, 2026 Last modified: November 7, 2026 --- Search plugins ![](https://ps.w.org/dwarpal/assets/banner-772x250.png?rev=3789994) ![](https://ps.w.org/dwarpal/assets/icon-256x256.png?rev=3789994) # Dwarpal By [Dwarpal](https://profiles.wordpress.org/dwarpal/) [Download](https://downloads.wordpress.org/plugin/dwarpal.1.2.19.zip) * [Details](https://wordpress.org/plugins/dwarpal/#description) * [Reviews](https://wordpress.org/plugins/dwarpal/#reviews) * [Installation](https://wordpress.org/plugins/dwarpal/#installation) * [Development](https://wordpress.org/plugins/dwarpal/#developers) [Support](https://wordpress.org/support/plugin/dwarpal/) ## Description **Dwarpal** (Dwarpal WP Security Plugin) protects your WordPress site from common threats, including: * **Firewall Protection** – Automatically blocks malicious requests containing SQL injection, XSS, code injection, and directory traversal attempts * **Login Security** – Protects against brute force attacks by limiting login attempts and locking out suspicious IP addresses * **SEO Hack Protection** – Detects Thai/gambling spam, wp-config injectors, and bot cloaking via local User-Agent comparison (no Google scraping) * **Bot View Scanner** – Compares browser vs search-bot responses on your own site; scans wp-config.php and index.php for known malware signatures * **Critical Options Monitor** – Alerts when key WordPress settings (site URL, admin email, registration) are changed—catches takeover and redirect hacks * **Outbound Request Monitor** – Logs outbound HTTP requests from your site to detect backdoors and data exfiltration * **Security Logging** – Comprehensive audit log of all security events for monitoring and analysis * **WordPress Hardening** – Removes WordPress version information, disables XML- RPC, and implements other security best practices * **Malware Scanning** – Scans files for malware and suspicious patterns * **File Integrity Monitoring** – Monitors core files for unauthorized changes * **Two-Factor Authentication** – Adds an extra layer of security to login * **IP Blocking & Whitelisting** – Block malicious IPs and whitelist trusted ones * **Live Traffic Monitoring** – Real-time monitoring of website traffic * **Vulnerability Scanner** – Checks for known vulnerabilities in WordPress core, plugins, and themes * **Threat Defense** – Opt-in signature feed, virtual patches, auto-block reputation, and security digests * **OWASP Coverage Report** – Maps enabled controls to OWASP Top 10 categories ### Features #### Firewall * Real-time request scanning * Pattern-based threat detection * Automatic blocking of malicious requests * Configurable firewall rules #### Login Security * Failed login attempt tracking * IP-based lockout system * Configurable attempt limits * Customizable lockout duration #### Security Logging * Complete audit trail * Event type categorization * IP address tracking * Request URI logging * User agent recording #### WordPress Hardening * WordPress version hiding * XML-RPC disabling * RSD link removal * File editing protection ### External services This plugin can optionally connect to third-party services **only when you enable the related feature** in the plugin settings. Features that call external services are **off by default** unless noted. #### Google Safe Browsing / Transparency Report (blocklist monitoring) * **What it is**: A Google page used to check whether your domain appears to be flagged for unsafe browsing. * **When it is called**: Only when **Blocklist Monitoring** is enabled (disabled by default; requires opt-in). * **What data is sent**: Your site domain (host) is sent as part of the request URL. * **Why**: To help you identify if your domain may be flagged and needs remediation. * **Service provider**: Google. * **Terms**: `https://policies.google.com/terms` * **Privacy**: `https://policies.google.com/privacy` #### ip-api.com (GeoIP country lookup) * **What it is**: A GeoIP service used to map an IP address to a country code. * **When it is called**: Only when **Geo-blocking** is enabled. * **What data is sent**: The visitor IP address is sent to `ip-api.com` to determine the country code. * **Why**: To enforce country-based access restrictions when you enable geo-blocking. * **Service provider**: ip-api.com. * **Terms**: `https://ip-api.com/docs/legal` * **Privacy**: `https://ip-api.com/docs/legal` #### Bot View Scanner (local cloaking detection) * **What it is**: A local scan that requests your own site URLs with different User-Agent headers (normal browser vs search bot) to detect cloaking. * **When it is called**: Only when you click **Run Bot View Scan** or enable ** Daily Bot View Scan** in SEO Protection settings. * **What data is sent**: HTTP requests are made to your own site (`home_url()`). No data is sent to Google or third-party search engines. * **Why**: To detect SEO cloaking and wp-config/index.php injection patterns seen in real server compromises. * **External link**: Google Search Console is linked for manual verification only( opens in your browser; the plugin does not scrape Google). #### WordPress.org API (vulnerability scanner) * **What it is**: Official WordPress.org endpoints for core/plugin version data. * **When it is called**: When you run the vulnerability scanner. * **What data is sent**: Plugin slugs and WordPress version identifiers (standard update API usage). * **Service provider**: WordPress.org. * **Terms**: `https://wordpress.org/about/gpl/` * **Privacy**: `https://wordpress.org/about/privacy/` #### Optional signature feed (Threat Defense) * **What it is**: JSON feed of firewall, malware, and virtual-patch signatures. * **When it is called**: Only when **Signature feed sync** is enabled. If no URL is set, the plugin refreshes from its bundled `data/signatures.json`. If you set a remote URL, that URL is fetched daily (or on demand). * **What data is sent**: A normal HTTPS GET to your configured feed URL. No site visitor data is included. * **Why**: To keep detection rules updatable without waiting for a full plugin release. * **Important**: Leave disabled (default) if you do not want outbound feed requests. #### Optional IP reputation lookup (Threat Defense) * **What it is**: An optional JSON reputation endpoint you configure yourself. * **When it is called**: Only when **local auto-block** and **remote reputation lookup** are both enabled and a reputation URL is set. * **What data is sent**: The visitor IP address as a query parameter. * **Expected response**: JSON such as `{"block":true,"score":90}`. * **Important**: Disabled by default. Do not enable unless you understand and trust the endpoint you configure. #### WordPress.org compliance (storage) Database exports and plugin-generated files are stored only under: ``` wp-content/uploads/dwarpal/ ``` This plugin does **not**: – Copy or modify `wp-config.php` – Write `.htaccess` to `wp-content/` or WordPress core directories – Define `DISALLOW_FILE_EDIT` globally( file editor is disabled via a setting + capability filter) – Call remote files for CSS/JS/images (all assets are bundled) ## Installation 1. Upload the `dwarpal` folder to the `/wp-content/plugins/` directory 2. Activate the plugin through the ‘Plugins’ menu in WordPress 3. Navigate to ‘Dwarpal’ in the WordPress admin menu to configure settings ## FAQ ### What security features does Dwarpal provide? Dwarpal provides firewall protection, login security, security logging, and WordPress hardening features. ### Does Dwarpal affect site performance? Dwarpal is designed to be lightweight and efficient. Security checks are performed early in the WordPress loading process to minimize performance impact. ### Can I customize the firewall rules? Yes, firewall rules can be customized through the admin interface. Additional customization options may be available in future versions. ### How does the login security work? The login security system tracks failed login attempts by IP address. After a configurable number of failed attempts, the IP address is temporarily locked out. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Dwarpal” is open source software. The following people have contributed to this plugin. Contributors * [ Dwarpal ](https://profiles.wordpress.org/dwarpal/) [Translate “Dwarpal” into your language.](https://translate.wordpress.org/projects/wp-plugins/dwarpal) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/dwarpal/), check out the [SVN repository](https://plugins.svn.wordpress.org/dwarpal/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/dwarpal/) by [RSS](https://plugins.trac.wordpress.org/log/dwarpal/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.19 * Requires WordPress 5.3+. Outbound allow-list no longer trips Plugin Check offloading #### 1.2.18 * Plugin Check: nonce and REQUEST_URI sanitization warnings cleared on firewall and traffic logging #### 1.2.17 * Live Traffic screen reads 30 short rows and stops logging once the table is full #### 1.2.16 * Live traffic no longer stores every bot 404, and the traffic screen reads only the latest rows #### 1.2.15 * Firewall no longer blocks a normal page that contains an embed. IP lookups and media previews are not security events #### 1.2.14 * Live traffic and security logs show the server clock #### 1.2.13 * Security log times follow the site clock. Viewing a page is not logged as an SEO hack #### 1.2.12 * Firewall matches SQL injection, XSS, code injection, and directory traversal in the raw URL and in public form posts #### 1.2.11 * Fix: viewing a normal page is no longer logged as an SEO hack attempt #### 1.2.10 * Fix: live traffic records the real HTTP status. Missing pages were stored as 200 #### 1.2.9 * Fix: activation no longer alters existing log tables, which timed out and returned Internal Server Error on large sites #### 1.2.8 * Fix: dashboard and scans no longer run COUNT(*) on the log tables * Fix: HTTP errors, traffic and security logs are trimmed on a schedule (7 or 30 days) * Fix: admin pages, plugin update checks and image requests are not written to the logs #### 1.2.7 * Fix: malware, integrity, vulnerability and update checks no longer start during the first page view after activation #### 1.2.6 * Fix: log tables use InnoDB, and old traffic rows are deleted in small scheduled batches, so page views no longer lock the tables #### 1.2.5 * Activation: database tables created with dbDelta (versioned schema, multisite aware); no output or external requests on activation * Admin CSS/JS load only on Dwarpal screens * File and directory locations resolved with WordPress functions; the plugin no longer deletes core files (readme.html removal option replaced by a server block rule) * Vulnerability scan uses WordPress core update data instead of contacting external servers * Fix: file integrity baseline is built in time-limited batches (no timeout on large or slow sites) * Fix: update alerts and other scheduled tasks load required WordPress admin functions before use * Fix: uninstall now removes plugin tables, options and scheduled events * Fix: PHP warnings on the dashboard and on Firewall / 2FA settings save; 404s no longer logged twice * Fix: “404 Exploit Attempt” is logged only for real 404 responses (admin pages and admin-ajax requests were reported as attacks) #### 1.2.3 * Security: capability checks on all admin screens and pending-user approve/reject * Security: nonce verification on 2FA profile save * Fix: approving a pending user no longer triggers a fatal error #### 1.2.2 * Plugin Check cleanup: text domain set to `dwarpal` to match plugin slug/folder * Removed Google hostname string patterns that falsely triggered Offloading checks * Removed debug error_log(); hardened nonce/sanitize handling and DB query annotations * readme: Tested up to 7.1; shortened short description #### 1.2.1 * Plugin display name set to Dwarpal; description set to Dwarpal WP Security Plugin * WordPress.org review hardening: sanitization, escaping, opt-in external services, uploads-only storage * Text domain remains `dwarpal` to match the directory slug #### 1.2.0 * Threat Defense: opt-in updatable signature/rule feed (bundled or remote JSON) * Virtual patches for known vulnerable plugin request patterns (no file overwrites) * OWASP Top 10 coverage mapping and admin report * Opt-in smarter auto-block with local reputation scoring and optional remote lookup * Daily/weekly security alerting digests (email) #### 1.1.1 * Centralized backup storage under uploads/dwarpal/ via WP_Filesystem * Removed wp-config.php copies and wp-content/.htaccess writes * File editor disable uses capability filter only (no DISALLOW_FILE_EDIT constant) * Hardening PHP-block options are recommendations with copy-paste Apache rules * Backup protection uses firewall rules only (no .htaccess modification) * Fixed remaining text domain strings for plugin slug compliance #### 1.1.0 * Bot View Scanner: local cloaking detection (browser vs bot User-Agent) — replaces non-compliant Google search scraping * SEO signatures from real incidents: eval/base64, web shells, Thai SEO APIs, mass- injection markers * Daily core file scan (wp-config.php, index.php) with admin alerts * Blocklist monitoring remains opt-in (disabled by default) #### 1.0.0 * Initial release * Firewall protection * Login security features * Security logging * WordPress hardening * Admin interface ## Meta * Version **1.2.19** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 5.3 or higher ** * Tested up to **7.1.4** * PHP version ** 7.2 or higher ** * Tags * [brute force protection](https://wordpress.org/plugins/tags/brute-force-protection/) [firewall](https://wordpress.org/plugins/tags/firewall/)[login security](https://wordpress.org/plugins/tags/login-security/) [malware](https://wordpress.org/plugins/tags/malware/)[security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/dwarpal/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/dwarpal/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/dwarpal/reviews/) ## Contributors * [ Dwarpal ](https://profiles.wordpress.org/dwarpal/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/dwarpal/)