Description

Papy3D Security Guard is a modular WordPress security suite. Protections are disabled by default and can be enabled independently.

Early login protection, local CAPTCHA, lockouts, honeypots and IPv4/IPv6/CIDR controls.
Local WAF with observation, balanced and strict modes, plus delegation to Papy3D WAF when installed.
TOTP, recovery codes, login alerts, forced password resets and session controls.
WordPress hardening, sensitive-file checks, core integrity verification and bounded security logs.
Incremental heuristic malware/backdoor scanner with explicit exceptions, encrypted quarantine and WP-CLI support.
File-permission, HTTPS, trusted-proxy and mixed-content diagnostics.
Optional Wordfence Intelligence synchronization followed by offline vulnerability checks.
GDPR controls, centralized alerts and secret-free JSON settings transfer.

CAPTCHA, TOTP and normal malware scans remain local. External requests occur only for explicitly enabled or requested features documented below.

Data and privacy

Settings are stored in WordPress options. The encryption master key is stored separately as a non-autoloaded option or multisite network option. Early-guard runtime state contains bounded counters, timestamps and truncated HMAC identifiers rather than plaintext usernames, passwords or CAPTCHA answers. Local WAF events may contain time, IP address, HMAC identifier, method, path without query string, rule identifiers, severity, action, bounded redacted excerpts, payload hash and user agent. Cookies, authorization headers, complete passwords and complete request bodies are not stored.

TOTP data is encrypted or hashed in user metadata. Repeated-login/TOTP counters are HMAC-keyed and expiring. Username blacklist and honeypot reports can store detected IP addresses, bounded identifiers, counters and timestamps. Login and sensitive-action alerts may include IP address and user agent in email sent through the site’s configured mail system. No analytics, external CAPTCHA, remote QR-code or remote authentication service is used.

External services

External services are contacted only for optional features or explicit administrator actions.

Trusted proxy IP-list sources

When an administrator refreshes a selected provider, or enables the daily refresh, the plugin can request public network lists from Cloudflare, QUIC.cloud, bunny.net, Fastly or Imperva. No site URL, user, visitor IP, content or plugin configuration is sent by the plugin. Providers receive normal HTTPS connection metadata, the server source IP and a generic user agent. Sucuri ranges are bundled locally and StackPath is treated as discontinued.

Cloudflare lists: https://www.cloudflare.com/ips-v4/ and https://www.cloudflare.com/ips-v6/ ; privacy: https://www.cloudflare.com/privacypolicy/ ; terms: https://www.cloudflare.com/policies/terms/
QUIC.cloud: https://www.quic.cloud/ips-all ; privacy: https://www.quic.cloud/privacy-policy/ ; terms: https://www.quic.cloud/terms-of-use/
bunny.net: https://bunnycdn.com/api/system/edgeserverlist and https://bunnycdn.com/api/system/edgeserverlist/IPv6 ; privacy: https://bunny.net/privacy/ ; terms: https://bunny.net/tos/
Fastly: https://api.fastly.com/public-ip-list ; privacy: https://www.fastly.com/privacy ; terms: https://www.fastly.com/terms
Imperva: https://my.imperva.com/api/integration/v1/ips ; privacy: https://www.imperva.com/trust-center/privacy-statement/ ; terms: https://www.imperva.com/legal/website-terms-of-use/
Sucuri source documentation: https://docs.sucuri.net/website-firewall/troubleshooting/same-ip-for-all-users/

Wordfence Intelligence

Used only when an administrator synchronizes/tests the vulnerability feed or enables daily WP-Cron synchronization. Endpoint: https://www.wordfence.com/api/intelligence/v3/vulnerabilities/scanner. The API key is sent as a Bearer token. The site URL and installed inventory are not sent; the complete feed is downloaded and analyzed locally.

Terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Privacy: https://www.wordfence.com/privacy-policy/
API documentation: https://www.wordfence.com/help/wordfence-intelligence/v3-accessing-and-consuming-the-vulnerability-data-feed/

WordPress.org services

Optional core integrity verification uses WordPress core’s checksum service and sends the installed WordPress version and locale. Optional plugin/theme comparison is triggered only by an explicit administrator action and downloads the exact WordPress.org package for the identified slug/version to a temporary file, compares the selected file locally, then deletes the archive.

Privacy: https://wordpress.org/about/privacy/
License: https://wordpress.org/about/license/

PayPal

The optional Support tab contains a standard PayPal donation form. No remote PayPal script or image is embedded and nothing is submitted automatically. When the administrator clicks the support button, the selected amount, EUR currency, donation description, recipient account and normal HTTPS metadata are sent directly to PayPal.

Terms: https://www.paypal.com/us/legalhub/useragreement-full
Privacy: https://www.paypal.com/us/legalhub/privacy-full

Security

Test security changes on staging where possible and retain SFTP/SSH access for recovery. Keep WordPress, PHP and the plugin updated.

Plugin identifiers and companion integration

Security Guard is autonomous and uses the plugin-specific p3dsg_ / P3DSG_ prefix for its own classes, hooks, options, transients, menu slug and assets. It does not bundle or register a shared administration hub. The p3dwaf_integration_v1_status filter is owned by the optional companion Papy3D WAF plugin; Security Guard only consumes that external public hook when the companion plugin is installed.

Installation

Upload the ZIP from Plugins > Add New Plugin.
Activate the plugin.
Open Security Guard in the WordPress administration menu.
Configure each protection before enabling it.
Keep the installed directory name as papy3d-security-guard.

FAQ

How can I recover from an administrator lockout?: Temporarily add define( 'PAPY3D_SECURITY_BYPASS', true ); to wp-config.php, sign in, correct the configuration, then remove the constant immediately. It suspends Security Guard protections, including the pre-WordPress guard.
How does the pre-WordPress login guard work?: The optional guard uses PHP auto_prepend_file to count credential submissions before WordPress loads and can require a short-lived signed local CAPTCHA during reinforced mode. Because WordPress has not bootstrapped yet, the challenge uses its own expiring HMAC-signed nonce bound to the client IP and user agent; that nonce is verified before the submitted CAPTCHA answer is read. It does not inspect or store passwords or usernames. The stable loader is stored under the plugin-owned directory returned by wp_upload_dir() so plugin updates do not remove a path that PHP workers may still cache. Mutable configuration and runtime state are protected under the same plugin-owned uploads tree. The plugin never replaces an unknown third-party auto_prepend_file directive.
How are TOTP secrets and the Wordfence API key protected?: They use authenticated encryption with a dedicated versioned random master key stored in the WordPress database. The option is non-autoloaded on single-site and network-scoped on multisite. Historical formats are migrated without rotating the key.
What are the local WAF limits?: The local WAF runs inside WordPress. It can reject application attacks but cannot stop traffic before PHP, protect files served directly by the web server, or absorb volumetric denial-of-service attacks. Administrators are not blocked by the local WAF while authenticated.
How are quarantined files protected?: After explicit administrator confirmation, a source file is streamed into an authenticated-encryption container under wp_upload_dir()/papy3d-security-guard/quarantine. Plaintext hash and size are verified before removal and again during restoration. Existing destination files are never overwritten.
How does vulnerability synchronization work?: The optional Wordfence Intelligence module sends the configured API key only to the official Scanner Feed endpoint in an Authorization Bearer header. The complete feed is imported locally; installed components are then checked offline. A conservative local delay prevents excessive synchronization attempts.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Papy3D Security Guard” is open source software. The following people have contributed to this plugin.

papy3d

Translate “Papy3D Security Guard” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

2.0.10

Replace the administration header PNG with the supplied AVIF banner.
Preserve the existing 1454×500 display dimensions and admin layout.

2.0.9

Update the WordPress.org compatibility metadata to Tested up to: 7.1.
No functional or security code changes.

2.0.8

Correct the WordPress plugin author display name from Papy3D to the canonical WordPress.org account name papy3d.
Keep product, package and Papy 3D Factory branding unchanged.

2.0.7

Remove the deprecated imagedestroy() call from the Early Guard CAPTCHA image response. PHP 8+ automatically releases GD image objects, so CAPTCHA output and validation remain unchanged.

2.0.6

Fix the Security Guard WAF connector target validation for current Papy3D WAF releases whose stable loader is stored under wp_upload_dir()/papy3d-waf/.
Keep the historical wp-content/papy3d-waf-loader.php target accepted only for bounded backward-compatible migration/rollback while still rejecting every unrelated loader path.

2.0.5

Fix local CAPTCHA rendering after transient challenge encryption moved to the t2s: / t2o: formats; the CAPTCHA parser now accepts and decrypts current transient tokens while preserving compatibility with previous token formats.

2.0.4

Remove the final generated $_SERVER['SCRIPT_FILENAME'] references from the Early Guard loader. Direct-execution detection now relies only on PHP execution context via get_included_files(), without request superglobals.

2.0.3

Apply WordPress Coding Standards formatting and PHPDoc corrections across the PHP source after the final PHPCS review; no security or functional behavior is changed.

2.0.2

Remove the remaining pre-WordPress direct $_SERVER fallback reported by Plugin Check; Early Guard now uses sanitized filter_input() with a sanitized environment fallback.