Title: NeverLast Security Lite Author: neverlast Published: October 16, 2026 Last modified: October 16, 2026 --- Search plugins ![](https://ps.w.org/neverlast-security-lite/assets/icon-256x256.png?rev=3751026) # NeverLast Security Lite By [neverlast](https://profiles.wordpress.org/neverlast/) [Download](https://downloads.wordpress.org/plugin/neverlast-security-lite.1.2.7.zip) * [Details](https://wordpress.org/plugins/neverlast-security-lite/#description) * [Reviews](https://wordpress.org/plugins/neverlast-security-lite/#reviews) * [Installation](https://wordpress.org/plugins/neverlast-security-lite/#installation) * [Development](https://wordpress.org/plugins/neverlast-security-lite/#developers) [Support](https://wordpress.org/support/plugin/neverlast-security-lite/) ## Description NeverLast Security Lite is a complete, standalone security plugin. It runs inside your site: no account, no licence key, no telemetry, and no feature locked behind an upgrade. #### What it does * **Firewall** – inspects requests for common SQL injection, XSS, path traversal, file inclusion, command injection, Log4Shell and Shellshock shapes, in Monitor, Balanced or Strict mode. * **Upload protection** – rejects executable uploads, smuggled server-control files and images that carry code, and holds uploads it cannot fully inspect. * **Login security** – attempt limits and lockouts, generic login errors, author- enumeration and REST user protection, XML-RPC and Application Password controls. * **Two-factor authentication** – optional TOTP for administrators with encrypted secrets and one-use recovery codes. * **Emergency controls** – end every session or freeze logins, with an optional secret-protected emergency link in login alerts. * **Health check** – a prioritized score with plain-language recommendations. * **Integrity monitoring** – an approved local baseline of your files, resumable comparison for large sites, uploads review, and optional verification against WordPress.org checksums. * **Quarantine you decide** – a suspicious upload is held as an authenticated encrypted, non-executable copy until you download it as evidence or delete it. Nothing is deleted automatically. * **Activity log** – bounded retention, masked IP addresses, CSV and JSON export, and throttled email alerts. * **Security headers** – baseline browser headers and optional CSP Report-Only diagnostics. #### What it does not do Lite runs inside WordPress, so it cannot protect anything served before WordPress loads and it does not replace web-server, hosting, CDN or backup controls. It does not scan database content, it logs but does not block the creation of administrator accounts, and it never repairs files automatically. An integrity baseline shows what changed since you approved it; it does not prove the approved state was clean. Single-site installations only. No security product can guarantee a site is free of vulnerabilities. Keep WordPress, PHP, plugins and themes updated, use least privilege, and keep tested off-site backups. Support and security contact: nss@neverlast.ro ### External services NeverLast Security Lite never sends site content, credentials, visitor records or telemetry, and never contacts NeverLast. Every connection to another service is off until you turn it on: #### Official crawler IP lists – off by default Only when you enable a provider under Protection, WP-Cron downloads its public IP list once a day so that provider’s genuine crawler is not counted against the optional anonymous rate limit. The request carries your server’s IP address and a plugin user agent that does not include your site’s address; nothing else is sent. * DuckDuckGo: https://duckduckgo.com/duckduckbot.json – privacy https://duckduckgo. com/privacy/ * Ahrefs: https://api.ahrefs.com/v3/public/crawler-ip-ranges – terms https://ahrefs. com/legal/terms, privacy https://ahrefs.com/legal/privacy-policy * UptimeRobot: https://cdn.uptimerobot.com/api/IPv4andIPv6.txt – terms https:// uptimerobot.com/terms/, privacy https://uptimerobot.com/privacy/ #### WordPress.org checksums – off by default Only when you enable “Verify changed core and plugin files with WordPress.org checksums” under Protection, a comparison that finds changed, added or missing WordPress core or plugin files downloads the official checksums for that release, to tell a genuine update apart from tampering. Core checksums come from https://api.wordpress.org/ core/checksums/1.0/ with the WordPress version and locale; plugin checksums come from https://downloads.wordpress.org/plugin-checksums/ with the plugin slug and version. Requests carry your server’s IP address and a plugin user agent without your site’s address, and results are cached for six hours. While this is off, files are compared with your approved baseline only. WordPress.org privacy policy: https:// wordpress.org/about/privacy/ #### Your own site The Directory listing health check requests your own uploads address to see whether the server returns a file index. Optional crawler verification uses your server’s DNS resolver; no verification API is contacted. ### Privacy Security events are stored in your WordPress database with a masked IP address, a salted one-way IP hash, the request method and path, and bounded redacted context. Passwords, cookies, authorization headers, nonces, secrets and recovery codes are never logged. The activity log keeps seven days by default. Email alerts use your site’s own mail configuration and go to the WordPress administration email unless you set another address. Throttled critical alerts are on by default; administrator- login alerts and the weekly summary are sent only when enabled. A quarantined file is held under an access-restricted neverlast-security-lite/quarantine directory in your configured uploads folder with authenticated AES-256-GCM encryption and its original SHA-256. Apache/IIS access-control files are included; nginx and other web servers should still explicitly deny direct HTTP access. Decryption uses the WordPress authentication salts, so export retained evidence before rotating or replacing those salts. On upgrade, previous Base64 evidence is checked and re- encrypted when migrated from wp-content/.nlssl-quarantine; originals are kept if migration fails. Direct restoration of executable evidence is disabled; download it for offline analysis or permanently delete it. Evidence survives ordinary uninstall; enabling “Delete Lite data on uninstall” removes held data along with settings and tables. ## Screenshots [[ [[ [[ [[ [[ [[ [[ ## Installation 1. Install through Plugins > Add New, or upload the ZIP, then activate. Protective defaults apply at once: the firewall in Balanced mode, XML-RPC and Application Passwords disabled, public REST user endpoints hidden, author enumeration blocked and the dashboard code editor disabled. 2. Open NeverLast Security > Protection. If Jetpack, the WordPress mobile apps or another service needs XML-RPC or an Application Password, untick the matching control. Start in Monitor if you are unsure about compatibility, then move to Balanced. 3. Run the Health Check and work through the prioritized items. 4. Review your installed files, then create the first integrity baseline. 5. Enroll each administrator in TOTP and store the recovery codes offline. ## FAQ ### Is Lite a restricted version of a paid product? No. Lite is complete on its own, with its own code, settings and database tables. Nothing is locked, trial-limited or downloaded at runtime. ### Which firewall mode should I use? Monitor records matching requests without blocking. Balanced blocks high-confidence matches and suits most sites after a period of observation. Strict blocks at a lower threshold; test forms, checkout and custom APIs before enabling it. ### Why does a comparison report differences after I update a plugin? Your baseline describes the versions you approved. After an update, review the reported package changes and, if they are what you installed, create a new baseline. ### Does a clean comparison prove there is no malware? No. It shows that the monitored files match the baseline you approved. It cannot see logic flaws, database content or files outside its scope. ### What happens to a quarantined file? It is removed from uploads and held as an encrypted copy until you choose to download it as evidence or delete it permanently. Direct restoration of suspicious files has been disabled to prevent executable files being reintroduced. If something outside NeverLast Security removes the held copy, for example host antivirus, the entry is reported as missing rather than silently disappearing. ### How do I recover if my authenticator is unavailable? Use an unused recovery code, or ask another administrator to reset your TOTP. Store recovery codes offline before rotating AUTH_KEY or AUTH_SALT, because existing TOTP secrets cannot be decrypted afterwards. ### How do I lift an Emergency Login Freeze? Reset an administrator password through the normal WordPress flow, wait for the freeze to expire, or define NLSSL_DISABLE_LOGIN_FREEZE as true in wp-config.php as an offline override, and remove it afterwards. ### Does uninstall remove my data? Only if “Delete Lite data on uninstall” was enabled first. Deactivation never deletes security data. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “NeverLast Security Lite” is open source software. The following people have contributed to this plugin. Contributors * [ neverlast ](https://profiles.wordpress.org/neverlast/) * [ lajea87 ](https://profiles.wordpress.org/lajea87/) [Translate “NeverLast Security Lite” into your language.](https://translate.wordpress.org/projects/wp-plugins/neverlast-security-lite) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/neverlast-security-lite/), check out the [SVN repository](https://plugins.svn.wordpress.org/neverlast-security-lite/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/neverlast-security-lite/) by [RSS](https://plugins.trac.wordpress.org/log/neverlast-security-lite/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.7 * Uses WordPress filesystem abstractions for evidence permissions, writable-folder checks, and nonrecursive uninstall cleanup. Retains bounded encrypted streaming for safety with an explicitly documented PHP_CodeSniffer exception. Operations fail closed when private permissions cannot be enforced. #### 1.2.6 * WordPress.org prereview remediation: configured uploads quarantine storage with legacy evidence encryption and migration, portable findings paths, no direct executable restoration, restricted dashboard notices, and corrected privacy URL. #### 1.2.5 * Fixed: a request body sent with GET, or under a Content-Type the firewall did not list (WordPress still reads “application/json,” as JSON), was not inspected. Every body is now inspected; binary files are left to the upload guard. * Fixed: data deletion on uninstall left the quarantine .htaccess and failed storage probes behind. #### 1.2.4 * Fixed: a baseline or comparison that runs in several steps could check a folder twice or skip a file when files were added or removed meanwhile, for example the .maintenance file WordPress writes during an update. The comparison then stopped with a storage error or reported an existing file as deleted. Each folder now resumes after the last file name it checked. #### 1.2.3 * Fixed: on WordPress 6.6, quarantine removed a file from uploads but discarded the held copy and reported that nothing was quarantined. Deletions are now confirmed on disk. * The emergency response page loads its styles through the WordPress style API. The complete history is in changelog.txt inside the plugin folder. ## Meta * Version **1.2.7** * Last updated **14 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.6 or higher ** * Tested up to **7.1.3** * PHP version ** 8.1 or higher ** * Tags * [File Integrity](https://wordpress.org/plugins/tags/file-integrity/)[firewall](https://wordpress.org/plugins/tags/firewall/) [login security](https://wordpress.org/plugins/tags/login-security/)[security](https://wordpress.org/plugins/tags/security/) [two factor authentication](https://wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://wordpress.org/plugins/neverlast-security-lite/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/neverlast-security-lite/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/neverlast-security-lite/reviews/) ## Contributors * [ neverlast ](https://profiles.wordpress.org/neverlast/) * [ lajea87 ](https://profiles.wordpress.org/lajea87/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/neverlast-security-lite/)