Title: MVO Segurança e Proteção Author: MVO Tools Published: October 14, 2026 Last modified: October 15, 2026 --- Search plugins ![](https://ps.w.org/mvo-seguranca-e-protecao/assets/banner-772x250.png?rev=3748381) ![](https://ps.w.org/mvo-seguranca-e-protecao/assets/icon-256x256.png?rev=3748482) # MVO Segurança e Proteção By [MVO Tools](https://profiles.wordpress.org/mvotools/) [Download](https://downloads.wordpress.org/plugin/mvo-seguranca-e-protecao.1.0.2.zip) * [Details](https://wordpress.org/plugins/mvo-seguranca-e-protecao/#description) * [Reviews](https://wordpress.org/plugins/mvo-seguranca-e-protecao/#reviews) * [Installation](https://wordpress.org/plugins/mvo-seguranca-e-protecao/#installation) * [Development](https://wordpress.org/plugins/mvo-seguranca-e-protecao/#developers) [Support](https://wordpress.org/support/plugin/mvo-seguranca-e-protecao/) ## Description MVO Segurança e Proteção is a modular WordPress security suite developed by MVO Soluções, part of the MVO Tools plugin family. Enable only the protections you need. The plugin provides login security, hardening, attack prevention, on-demand vulnerability and malware-indicator checks, encrypted quarantine, integrity monitoring, and local security auditing. Key features: * Two-factor authentication (TOTP) compatible with Google Authenticator and one- time recovery codes. * Optional XML-RPC blocking. * Prevention of executable file uploads and execution rules for the uploads directory. * Reduced username enumeration and less revealing login errors. * Directory listing protection. * Temporary IP-based blocking against brute-force login attempts. * On-demand vulnerability and suspicious-file scanner. * Encrypted quarantine and manual deletion of eligible suspicious files. * Restricted automatic recovery for non-executable media and documents in the uploads directory. * File integrity baselines and comparisons. * Write-permission hardening for application code directories. * Application Password and administrative session controls. * Locally stored security event log. * Sensitive-file protection and security HTTP headers. * Conservative application firewall rules for high-confidence attack patterns. The scanner runs only when an administrator explicitly starts it. The plugin does not perform expensive continuous malware scans in the background. Heuristic findings are not conclusive evidence of malware. ### Modules #### 01. Two-factor authentication (2FA) Adds a second authentication step with Google Authenticator or any compatible TOTP app. Each user enrolls individually and receives one-time recovery codes. TOTP secrets are encrypted where Sodium or OpenSSL is available. #### 02. Disable XML-RPC Blocks xmlrpc.php, disables XML-RPC methods, and removes discovery hints such as X-Pingback and RSD. This module is optional because some legacy integrations rely on XML-RPC. #### 03. Prevent code execution in Uploads Rejects executable file types during the WordPress upload process. On Apache/LiteSpeed, it also creates managed .htaccess rules to deny web access to executable files under the public uploads directory. #### 04. Login and user enumeration Makes failed login messages less revealing, restricts common public author enumeration requests, limits public user listing via the REST API, and removes the public user sitemap. #### 05. Directory browsing On Apache/LiteSpeed, adds managed rules to prevent visitors from listing files in directories without an index file. #### 06. IP blocking Tracks authentication failures per IP address and temporarily blocks addresses that exceed a configurable threshold. Password and 2FA failures contribute to the same counter. Administrators can configure the limits, lookback window, duration, and trusted IPs. #### 07. Vulnerabilities and quarantine Provides administrator-initiated checks of core integrity, suspicious files, installed plugins/themes, administrator accounts, and security settings. Eligible suspicious files may be placed in encrypted quarantine or deleted only after explicit administrator action. Quarantine payloads are stored inside the WordPress uploads directory in a plugin- specific folder, using non-executable encrypted .bxsq files. The directory includes Apache/IIS access-denial rules; on Nginx, additional server rules may be needed to prevent direct downloads of encrypted payloads. The encryption key is kept in WordPress options. Quarantine files are preserved on uninstall to avoid accidental data loss. Automatic restoration is limited to non-executable media/document extensions within the uploads directory and rejects PHP markers. Suspicious PHP files, other executable code, and files outside uploads cannot be rewritten to their original paths by this plugin. Recover trusted originals from a backup or reinstall the affected WordPress core, plugin, or theme. Existing encrypted quarantine items from earlier releases are copied to the new location when possible, leaving legacy copies untouched for safety. The module can also create an integrity baseline and later compare newly added, changed, or removed code files. #### 08. File permissions Reduces write permissions in WordPress code directories while preserving operational exceptions for uploads, identified caches, and quarantine. Includes a configurable maintenance window for updates and blocks editing plugin/theme code through the WordPress admin while protection is active. This is an additional hardening layer, not a replacement for proper operating system permissions or updates. #### 09. Credentials and sessions Allows administrators to disable WordPress Application Passwords, inspect and revoke existing credentials, and end administrative sessions. #### 10. Security log Stores events such as logins, failures, user and plugin changes, updates, IP blocks, quarantine actions, and security setting changes locally. Retention is limited, and passwords, TOTP secrets, and authentication tokens are not logged. #### 11. Sensitive files On Apache/LiteSpeed, blocks web access to recognizable sensitive files and configuration backups, such as .env, .git, database dumps, logs, and certain archive names. #### 12. Security headers Adds conservative headers including X-Content-Type-Options, framing protection, and Referrer-Policy. HSTS and Permissions-Policy are optional. #### 13. MVO firewall Checks request URLs and query strings for high-confidence traversal, SQL injection, explicit XSS, and sensitive-file probing patterns. This version intentionally does not inspect POST bodies to minimize false positives and interference with checkouts and forms. ### Privacy MVO Segurança e Proteção stores only the local data needed for its security features, such as settings, audit events, temporary IP blocks, integrity hashes, and encrypted quarantine metadata. It does not transmit this data to MVO Soluções or include proprietary tracking or telemetry. When the WordPress core checksum feature is used during a manual integrity check, the official WordPress implementation may contact WordPress. org to obtain checksums for the installed version. ## Installation 1. In your WordPress dashboard, open Plugins > Add New Plugin > Upload Plugin. 2. Select the MVO Segurança e Proteção ZIP file and install it. 3. Activate the plugin. 4. Open MVO Tools > MVO Segurança e Proteção. 5. Review the modules and enable only the protections suitable for your hosting environment. 6. Whenever possible, test filesystem permissions and .htaccess-dependent modules in a staging environment before applying them to production. ## FAQ ### Does the plugin scan continuously? No. The vulnerability and malware-indicator scanner is started manually by an administrator and runs on demand. ### Does the plugin remove malware automatically? No. Eligible files are quarantined or permanently deleted only after an explicit administrator action. Quarantine is generally recommended before permanent deletion. ### Can I restore quarantined PHP files automatically? No. For security and directory compliance, automatic restoration is limited to permitted media/document files inside uploads. Restore other files from a trusted backup or reinstall their legitimate package. ### Is quarantine deleted when I uninstall the plugin? No. Encrypted quarantine files are intentionally preserved to reduce the chance of losing isolated files by accidentally uninstalling the plugin. The database encryption key must also be preserved to decrypt them. ### Can I use email-based 2FA? No. The 2FA module uses TOTP apps, including Google Authenticator and compatible alternatives. ### Do the .htaccess modules work on Nginx? Managed .htaccess rules require Apache or LiteSpeed. Nginx requires equivalent server configuration; the plugin does not claim to enforce unsupported .htaccess rules. Encrypted quarantine blobs may need an additional Nginx deny rule to prevent public downloads. ### Will the File Permissions module prevent every malicious change? No. It adds a filesystem-hardening layer, but it cannot replace correct ownership, ACLs, hosting isolation, updates, or independent backups. ### Does the plugin send information to MVO Soluções? No. This plugin has no proprietary telemetry and does not transmit security logs, IP addresses, files, or scan results to MVO. WordPress may request checksums from WordPress.org when performing a manual core integrity check. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “MVO Segurança e Proteção” is open source software. The following people have contributed to this plugin. Contributors * [ MVO Tools ](https://profiles.wordpress.org/mvotools/) [Translate “MVO Segurança e Proteção” into your language.](https://translate.wordpress.org/projects/wp-plugins/mvo-seguranca-e-protecao) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/mvo-seguranca-e-protecao/), check out the [SVN repository](https://plugins.svn.wordpress.org/mvo-seguranca-e-protecao/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/mvo-seguranca-e-protecao/) by [RSS](https://plugins.trac.wordpress.org/log/mvo-seguranca-e-protecao/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.2 * Shortened the directory summary to comply with the WordPress.org 150-character limit. * Prepared public presentation assets and documentation improvements. #### 1.0.1 * Translated plugin metadata and directory documentation into English. * Updated contributor and version metadata, and replaced legacy JavaScript globals. * Moved new encrypted quarantine storage into the plugin-specific uploads directory. * Added read-only legacy storage migration and restricted automatic restoration to non-executable uploads media and documents. * Removed unnecessary translation domain loading and polished legacy-brand labels. #### 1.0.0 * First public release. * Introduced 13 independent security and hardening modules. * Added TOTP 2FA, attack prevention, on-demand scanner, encrypted quarantine, integrity monitoring, file permissions, security logs, sensitive-file protection, security headers, and firewall. ## Meta * Version **1.0.2** * Last updated **24 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [Brute Force](https://wordpress.org/plugins/tags/brute-force/)[firewall](https://wordpress.org/plugins/tags/firewall/) [malware scanner](https://wordpress.org/plugins/tags/malware-scanner/)[security](https://wordpress.org/plugins/tags/security/) [two factor authentication](https://wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://wordpress.org/plugins/mvo-seguranca-e-protecao/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/mvo-seguranca-e-protecao/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/mvo-seguranca-e-protecao/reviews/) ## Contributors * [ MVO Tools ](https://profiles.wordpress.org/mvotools/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/mvo-seguranca-e-protecao/)