Title: Owl Security Author: Owlgorithm Labs Published: July 30, 2026 Last modified: July 30, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/owl-security.svg) # Owl Security By [Owlgorithm Labs](https://profiles.wordpress.org/owlgorithmlabs/) [Download](https://downloads.wordpress.org/plugin/owl-security.1.12.0.zip) * [Details](https://wordpress.org/plugins/owl-security/#description) * [Reviews](https://wordpress.org/plugins/owl-security/#reviews) * [Installation](https://wordpress.org/plugins/owl-security/#installation) * [Development](https://wordpress.org/plugins/owl-security/#developers) [Support](https://wordpress.org/support/plugin/owl-security/) ## Description Owl Security brings practical WordPress protection and recovery tools into one responsive administration screen. The Free build works without a license, does not perform remote entitlement checks, and keeps its security features available locally. Free capabilities include: * Live risk score and security status overview. * Brute-force protection, login rate limiting, login alerts, built-in math CAPTCHA and honeypot protection. * Optional Google reCAPTCHA v2/v3 or Cloudflare Turnstile when an administrator selects and configures one of those providers. * RFC 6238 TOTP two-factor authentication and recovery controls. * Malware signature scanning and administrator-requested WordPress core checksum verification. * Reversible quarantine with path and symlink safety checks. * Firewall rules for high-confidence SQL injection, cross-site scripting, command execution, traversal, abusive bots, endpoint abuse, and request rate limiting. * Comment and registration anti-spam controls. * Activity logging for security-relevant WordPress events without storing passwords or submitted form bodies. * File-integrity baselines, file-permission checks, upload MIME validation, and upload-directory execution protection. * Manual protected backups, downloads, restore checks, and recovery tools available in the Free build. * Reversible hardening for the file editor, XML-RPC, directory browsing, version output, author enumeration, and anonymous REST access. * Manual reports, CSV/PDF exports, and a bounded debug-log viewer. * Multisite-aware activation, deactivation, and uninstall behavior. Owl Security does not silently enable commercial vulnerability, CAPTCHA, password- breach, GeoIP, reputation, AI, or uptime services. Optional providers remain inactive until the administrator chooses the related feature and supplies any required credentials. ### External services and privacy Owl Security can contact the services listed below. Optional services remain disabled until an administrator enables the related feature and, where required, enters credentials. #### WordPress.org Core Checksums API What it is: The official WordPress.org service that returns file checksums for a specific WordPress release. When data is sent: Only when an administrator runs a malware scan with WordPress core verification enabled. Data sent: The installed WordPress version and locale are sent in the request URL. The request User-Agent also contains the Owl Security version and the site’s home URL. No site content, users, passwords, form submissions, or database records are sent. Service information: https://wordpress.org/about/ Privacy: https://wordpress.org/ about/privacy/ #### WPScan Vulnerability Database API What it is: An optional vulnerability-information service operated by Automattic. When data is sent: Only after an administrator enables vulnerability intelligence, enters a WPScan API token, and runs or loads a vulnerability scan. Data sent: The WPScan API token is sent in the Authorization header, and the plugin or theme slug is sent in the request URL. The request User-Agent contains the Owl Security version and the site’s home URL. Installed component versions are compared locally against the returned records. Site content, users, passwords, and form submissions are not sent. Terms: https://wpscan.com/terms/ Privacy: https://automattic.com/privacy/ #### Have I Been Pwned Pwned Passwords API What it is: An optional compromised-password lookup service. When data is sent: Only when compromised-password checking is enabled and WordPress validates a password during a supported password or login flow. Data sent: Only the first five characters of an uppercase SHA-1 hash are sent through the k-anonymity range API. The raw password and the complete hash never leave the site. The request User-Agent contains only the Owl Security version. API information: https://haveibeenpwned.com/API/v3#PwnedPasswords Terms: https:// haveibeenpwned.com/TermsOfUse Privacy: https://haveibeenpwned.com/Privacy #### Google reCAPTCHA What it is: An optional third-party CAPTCHA provider. When data is sent: Only when an administrator selects reCAPTCHA v2 or v3, saves valid provider credentials, and a protected form is submitted. Data sent: The configured secret key, the provider response token, and the visitor IP address are sent server-side to Google’s siteverify endpoint. Google’s browser script may also receive browser, device, network, and interaction data under Google’s policies. Built-in Math and Honeypot modes do not contact Google. Terms: https://policies.google.com/terms Privacy: https://policies.google.com/privacy #### Cloudflare Turnstile What it is: An optional third-party CAPTCHA provider. When data is sent: Only when an administrator selects Turnstile, saves valid provider credentials, and a protected form is submitted. Data sent: The configured secret key, the provider response token, and the visitor IP address are sent server-side to Cloudflare’s siteverify endpoint. Cloudflare’s browser script may also receive browser, device, network, and interaction data under Cloudflare’s policies. Built-in Math and Honeypot modes do not contact Cloudflare. Terms: https://www.cloudflare.com/website-terms/ Privacy: https://www.cloudflare. com/privacypolicy/ Email reports and login notices use the WordPress site’s configured wp_mail() transport. Owl Security does not operate that mail service. Administrators can disable IP logging or enable IP anonymization. Request query values and submitted form bodies are not stored in the request log. ## Installation 1. Upload the `owl-security` folder to `/wp-content/plugins/`, or upload the ZIP through Plugins > Add New > Upload Plugin. 2. Activate Owl Security. 3. Open Owl Security from the WordPress administration menu. 4. Review Login Protection, Firewall, File & Upload, Backup, and Hardening settings before enabling restrictive controls. 5. Create and download a known-good backup before performing restore or filesystem- hardening operations. No npm, Composer, or other build step is required after upload. ## FAQ ### Does the Free build require a license? No. The Free build has no license field and does not contact a licensing service. ### Does Owl Security send data automatically? It does not silently enable optional third-party services. Official WordPress core checksums are requested only as part of an administrator-requested scan. WPScan, Pwned Passwords, reCAPTCHA, and Turnstile require an administrator to enable or configure the related feature. ### Can I keep CAPTCHA completely local? Yes. Use the built-in math CAPTCHA and honeypot instead of a third-party CAPTCHA provider. ### What does the Pwned Passwords check send? Only the first five characters of a SHA-1 password hash. The original password and complete hash stay on the WordPress site. ### Can quarantine permanently delete a file? Quarantine is reversible. Eligible files are moved into a protected directory and their original paths are recorded. WordPress core files and Owl Security’s own active files are protected from automatic quarantine. ### What backup file is created without ZipArchive? Owl Security creates a protected `.sql.gz` database-only backup and deletes the temporary raw SQL export. If neither ZipArchive nor zlib is available, backup creation fails clearly instead of retaining a standalone SQL file. ### Is restore risk-free? No restore tool is risk-free. Keep an off-site backup and test major restore operations on staging first. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Owl Security” is open source software. The following people have contributed to this plugin. Contributors * [ Owlgorithm Labs ](https://profiles.wordpress.org/owlgorithmlabs/) [Translate “Owl Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/owl-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/owl-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/owl-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/owl-security/) by [RSS](https://plugins.trac.wordpress.org/log/owl-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.12.0 * Physically excluded trusted-device token and Pro login-risk execution modules from the WordPress.org package; Free two-factor authentication always requires its normal second factor. * Added a package audit that rejects direct Pro execution gates or upgrade-error paths in Free-shipped PHP. * Added protected `.sql.gz` database-only backup fallback and automatic deletion of the temporary raw SQL export. * Made backup archive and restore paths support renamed or relocated WordPress content directories through manifest metadata. * Reverified external-service disclosures, path handling, identifier prefixing, PHP syntax, JavaScript syntax, and the Free/Pro packaging boundary. #### 1.10.1 * Added a strict Free/Pro build boundary while preserving the shared plugin slug, options, tables, and data. * Made the Free administration interface independent from license activation. * Added a WordPress.org-focused external-services disclosure and GPL-2.0 license file. * Isolated Pro-only integrity and uninstall licensing code from the Free package boundary. * Switched Free third-party server requests to `wp_safe_remote_get()` or `wp_safe_remote_post()` with explicit timeouts. ## Meta * Version **1.12.0** * Last updated **3 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.0.2** * PHP version ** 7.4 or higher ** * Tags * [backup](https://wordpress.org/plugins/tags/backup/)[firewall](https://wordpress.org/plugins/tags/firewall/) [malware scanner](https://wordpress.org/plugins/tags/malware-scanner/)[security](https://wordpress.org/plugins/tags/security/) [two factor authentication](https://wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://wordpress.org/plugins/owl-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/owl-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/owl-security/reviews/) ## Contributors * [ Owlgorithm Labs ](https://profiles.wordpress.org/owlgorithmlabs/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/owl-security/)