{"id":319217,"date":"2026-06-26T14:08:24","date_gmt":"2026-06-26T14:08:24","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/shieldguard-security\/"},"modified":"2026-06-26T14:08:05","modified_gmt":"2026-06-26T14:08:05","slug":"aria-security-suite","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/aria-security-suite\/","author":15728675,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.2.5","stable_tag":"1.2.5","tested":"6.7.5","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Aria Security Suite","header_author":"Alireza Aminzadeh, syeedalireza","header_description":"Enterprise security client: API-signed requests, WAF offload, IDS, integrity, remote logging.","assets_banners_color":"021b45","last_updated":"2026-06-26 14:08:05","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/aryait.net\/","header_plugin_uri":"https:\/\/ariacoder.ir\/aria-security-suite-wordpress\/","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":39,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.2.5":{"tag":"1.2.5","author":"syeedalireza","date":"2026-06-26 14:08:05"}},"upgrade_notice":{"1.2.5":"<p>First WordPress.org release. All cloud and external service features remain opt-in by default.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3587349,"resolution":"128x128","location":"assets","locale":"","width":128,"height":131},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3587349,"resolution":"256x256","location":"assets","locale":"","width":256,"height":261}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3587349,"resolution":"1544x500","location":"assets","locale":"","width":1554,"height":354},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3587349,"resolution":"772x250","location":"assets","locale":"","width":772,"height":249}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.5"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Security dashboard with grade score and threat overview","2":"Onboarding wizard \u2014 3-step setup","3":"Live traffic monitoring panel","4":"Firewall and Cloudflare settings","5":"Session manager \u2014 active devices list"}},"plugin_section":[262246],"plugin_tags":[1174,602,55021,600,9217],"plugin_category":[38,54],"plugin_contributors":[253123],"plugin_business_model":[],"class_list":["post-319217","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-firewall","plugin_tags-login","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-syeedalireza","plugin_committers-syeedalireza"],"banners":{"banner":"https:\/\/ps.w.org\/aria-security-suite\/assets\/banner-772x250.png?rev=3587349","banner_2x":"https:\/\/ps.w.org\/aria-security-suite\/assets\/banner-1544x500.png?rev=3587349","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/aria-security-suite\/assets\/icon-128x128.png?rev=3587349","icon_2x":"https:\/\/ps.w.org\/aria-security-suite\/assets\/icon-256x256.png?rev=3587349","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p><strong>Aria Security Suite<\/strong> is a modular, production-ready security plugin for WordPress. It delivers enterprise-level protection layers that work <strong>standalone on your server<\/strong> \u2014 and can optionally connect to your own <strong>Enterprise Security API<\/strong> for centralized WAF decisions, integrity checks, and reporting.<\/p>\n\n<p>Built with clean PHP architecture (PSR-4), a modern AJAX admin experience, and privacy-first defaults: <strong>no outbound calls until you configure and enable each feature.<\/strong><\/p>\n\n<h4>Why Aria Security Suite?<\/h4>\n\n<ul>\n<li><strong>All-in-one protection<\/strong> \u2014 firewall, login hardening, malware scanning, honeypots, session control, and live traffic monitoring in one plugin.<\/li>\n<li><strong>Zero performance penalty<\/strong> \u2014 heavy scans and log sync run in the background via WP-Cron or Action Scheduler.<\/li>\n<li><strong>Privacy by design<\/strong> \u2014 cloud API, Cloudflare, geo lookups, vulnerability scanning, and webhooks are <strong>opt-in only<\/strong>.<\/li>\n<li><strong>Actionable security score<\/strong> \u2014 grades your site A\u2013F with clear recommendations.<\/li>\n<li><strong>Developer-friendly<\/strong> \u2014 modular codebase, REST API endpoints, HMAC-signed API client, and GPL-licensed.<\/li>\n<\/ul>\n\n<h4>Setup &amp; Dashboard<\/h4>\n\n<ul>\n<li><strong>3-step Onboarding Wizard<\/strong> \u2014 choose Basic, Medium, or Strict presets in seconds.<\/li>\n<li><strong>Security Grade Score (0\u2013100)<\/strong> \u2014 real-time posture analysis with actionable tips.<\/li>\n<li><strong>Dashboard Widget &amp; Admin Bar<\/strong> \u2014 security status at a glance from any admin screen.<\/li>\n<li><strong>Modern AJAX UI<\/strong> \u2014 fast, reload-free settings with responsive design.<\/li>\n<\/ul>\n\n<h4>Login &amp; Authentication<\/h4>\n\n<ul>\n<li><strong>Hide Login Page<\/strong> \u2014 replace <code>wp-login.php<\/code> with a custom secret URL.<\/li>\n<li><strong>Passwordless Login (Magic Links)<\/strong> \u2014 secure email-based one-time login tokens.<\/li>\n<li><strong>Two-Factor Authentication (2FA)<\/strong> \u2014 API-integrated second factor for admin accounts.<\/li>\n<li><strong>Session Manager<\/strong> \u2014 view and remotely destroy active sessions across devices.<\/li>\n<li><strong>Device Fingerprinting<\/strong> \u2014 recognize trusted admin devices.<\/li>\n<li><strong>Brute-Force Protection<\/strong> \u2014 rate limiting and automatic IP bans on failed logins.<\/li>\n<\/ul>\n\n<h4>Firewall &amp; Network (WAF)<\/h4>\n\n<ul>\n<li><strong>Web Application Firewall<\/strong> \u2014 local rules plus optional offload to Enterprise API.<\/li>\n<li><strong>Cloudflare Integration<\/strong> \u2014 push banned IPs to Cloudflare edge firewall (CDN level).<\/li>\n<li><strong>Geo-Blocking<\/strong> \u2014 block traffic by country with 24-hour local IP cache.<\/li>\n<li><strong>PHP Execution Blocker<\/strong> \u2014 prevent PHP execution in <code>uploads<\/code> via <code>.htaccess<\/code> \/ <code>web.config<\/code>.<\/li>\n<li><strong>User-Agent Filtering<\/strong> \u2014 block known malicious bots and scanners.<\/li>\n<li><strong>XML-RPC Control<\/strong> \u2014 disable <code>xmlrpc.php<\/code> to stop pingback and brute-force vectors.<\/li>\n<\/ul>\n\n<h4>Scanners &amp; Integrity<\/h4>\n\n<ul>\n<li><strong>Heuristic Malware Scanner<\/strong> \u2014 background scan for suspicious patterns (<code>eval<\/code>, <code>base64_decode<\/code>, obfuscated code).<\/li>\n<li><strong>File Integrity Monitor<\/strong> \u2014 detect unauthorized changes to core WordPress files.<\/li>\n<li><strong>Hash Scanner<\/strong> \u2014 verify file hashes against known-good baselines.<\/li>\n<li><strong>Vulnerability Scanner<\/strong> \u2014 optional cloud comparison of installed plugin versions (explicit opt-in).<\/li>\n<\/ul>\n\n<h4>Spam &amp; Intrusion Prevention<\/h4>\n\n<ul>\n<li><strong>Invisible Honeypots<\/strong> \u2014 registration, comments, login, and Contact Form 7 \u2014 no CAPTCHA needed.<\/li>\n<li><strong>Behavioral Analysis<\/strong> \u2014 detect anomalous request patterns.<\/li>\n<li><strong>Global Ban Sync<\/strong> \u2014 share ban lists when connected to Enterprise API.<\/li>\n<\/ul>\n\n<h4>Monitoring, Logging &amp; Alerts<\/h4>\n\n<ul>\n<li><strong>Live Traffic Monitoring<\/strong> \u2014 real-time request log with IP, path, status codes, and user-agents (Wordfence-style).<\/li>\n<li><strong>SQL Query Analyzer<\/strong> \u2014 surface slow or suspicious database queries.<\/li>\n<li><strong>Log Rotation<\/strong> \u2014 automatic cleanup with configurable retention.<\/li>\n<li><strong>Webhooks<\/strong> \u2014 instant alerts to <strong>Slack<\/strong>, <strong>Telegram<\/strong>, or custom JSON endpoints.<\/li>\n<li><strong>Central Reporting<\/strong> \u2014 signed log export to your Enterprise API.<\/li>\n<li><strong>Encrypted Backup Requests<\/strong> \u2014 trigger cloud backups from the admin panel.<\/li>\n<\/ul>\n\n<h4>Hardening &amp; Headers<\/h4>\n\n<ul>\n<li><strong>Security Headers<\/strong> \u2014 CSP, X-Frame-Options, X-Content-Type-Options, and more.<\/li>\n<li><strong>Table Prefix Advisor<\/strong> \u2014 guidance for safer database prefixes.<\/li>\n<li><strong>Crypto Vault<\/strong> \u2014 secure storage for API secrets and sensitive options.<\/li>\n<\/ul>\n\n<h4>Optional Enterprise API<\/h4>\n\n<p>Connect your own API endpoint for WAF offload, heartbeat health checks, hash verification, ban reporting, quota lookups, and vulnerability intelligence. Credentials are stored encrypted; every request is signed with <strong>HMAC-SHA256<\/strong>.<\/p>\n\n<p><strong>Developers:<\/strong> <a href=\"https:\/\/github.com\/alireza-aminzadeh\">Alireza Aminazdeh<\/a> \u00b7 <a href=\"https:\/\/profiles.wordpress.org\/syeedalireza\/\">syeedalireza<\/a><br \/>\n<strong>Websites:<\/strong> <a href=\"https:\/\/aryait.net\/\">aryait.net<\/a> \u00b7 <a href=\"https:\/\/ariacoder.ir\/\">ariacoder.ir<\/a><\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin may connect to third-party or external services <strong>only when you explicitly enable and configure the related feature<\/strong>. No outbound tracking or data collection occurs by default.<\/p>\n\n<h4>Enterprise Security API (optional)<\/h4>\n\n<p>When you enter an API Base URL, Site ID, and Secret Key under <strong>API &amp; Connection<\/strong>, the plugin can send signed requests to your configured Enterprise Security API for features such as WAF decisions, heartbeat health checks, hash integrity verification, ban reporting, quota lookups, and (if opted in) vulnerability scanning.<\/p>\n\n<p><strong>Data sent:<\/strong> Request metadata (IP, path, HTTP method, user-agent, query parameter names), security event logs, file hashes, and\u2014only when the Vulnerability Scanner opt-in is enabled\u2014installed plugin slugs and versions.<\/p>\n\n<p><strong>When:<\/strong> Only after credentials are saved and the relevant feature is turned on. Heartbeat runs on WP-Cron when the API is configured. Plugin inventory is sent only when the Vulnerability Scanner opt-in is enabled.<\/p>\n\n<p><strong>Service provider:<\/strong> Your own Enterprise Security API endpoint (URL you provide). You are responsible for that service's terms and privacy policy.<\/p>\n\n<h4>Cloudflare API (optional)<\/h4>\n\n<p>When <strong>Cloudflare integration<\/strong> is enabled and you provide a Zone ID and API token, the plugin calls the Cloudflare API to create firewall access rules that block malicious IP addresses at the CDN edge.<\/p>\n\n<p><strong>Data sent:<\/strong> IP addresses of blocked visitors and a short note identifying the block source.<\/p>\n\n<p><strong>When:<\/strong> Only after you enable Cloudflare integration and supply credentials, and only when a local security rule triggers an IP ban.<\/p>\n\n<p><strong>Service provider:<\/strong> Cloudflare, Inc. \u2014 <a href=\"https:\/\/www.cloudflare.com\/website-terms\/\">Terms of Use<\/a>, <a href=\"https:\/\/www.cloudflare.com\/privacypolicy\/\">Privacy Policy<\/a>.<\/p>\n\n<h4>ip-api.com (optional)<\/h4>\n\n<p>When <strong>Geo-Blocking<\/strong> is enabled and you configure blocked countries, the plugin queries ip-api.com to resolve a visitor's country code from their IP address.<\/p>\n\n<p><strong>Data sent:<\/strong> The visitor's IP address.<\/p>\n\n<p><strong>When:<\/strong> Only when Geo-Blocking is enabled, a country block list is configured, and the country for an IP is not already cached locally (results are cached for 24 hours).<\/p>\n\n<p><strong>Service provider:<\/strong> ip-api.com \u2014 <a href=\"http:\/\/ip-api.com\/docs\/legal\">Terms &amp; Legal<\/a>, <a href=\"http:\/\/ip-api.com\/docs\/legal\">Privacy Policy<\/a>.<\/p>\n\n<h4>User-configured webhooks (optional)<\/h4>\n\n<p>When you add Slack, Telegram, or generic webhook URLs under <strong>Alerts &amp; Notifications<\/strong>, the plugin POSTs JSON alert payloads to those URLs when security events occur.<\/p>\n\n<p><strong>Data sent:<\/strong> Alert severity, message text, and contextual fields (e.g., IP address, event type).<\/p>\n\n<p><strong>When:<\/strong> Only after you save a webhook URL and a qualifying security event fires.<\/p>\n\n<p><strong>Service provider:<\/strong> The third-party service behind the URL you provide (e.g., Slack, Telegram). See their respective terms and privacy policies.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>aria-security-suite<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Complete the <strong>Onboarding Wizard<\/strong> (opens automatically on first activation).<\/li>\n<li>Review your <strong>Security Score<\/strong> on the dashboard and apply recommended fixes.<\/li>\n<li><em>(Optional)<\/em> Enter API Base URL, Site ID, and Secret Key under <strong>Connection &amp; API<\/strong> for cloud features.<\/li>\n<\/ol>\n\n<h4>MU-Plugin early load (optional)<\/h4>\n\n<p>Copy <code>extras\/aria-security-suite-mu-loader.php<\/code> to <code>wp-content\/mu-plugins\/<\/code> to load protection before regular plugins. Do not activate the plugin twice.<\/p>\n\n<h4>Action Scheduler (recommended)<\/h4>\n\n<p>For more reliable background jobs than WP-Cron alone:<\/p>\n\n<pre><code>composer require woocommerce\/action-scheduler\n<\/code><\/pre>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20slow%20down%20my%20site%3F\"><h3>Does this plugin slow down my site?<\/h3><\/dt>\n<dd><p>No. Malware scanning, log synchronization, and integrity checks run in the background using WP-Cron or Action Scheduler. Your front-end TTFB is unaffected.<\/p><\/dd>\n<dt id=\"is%20my%20data%20sent%20anywhere%20without%20permission%3F\"><h3>Is my data sent anywhere without permission?<\/h3><\/dt>\n<dd><p>No. Remote API calls, vulnerability scanning, Cloudflare blocking, geo lookups, and webhooks are all <strong>opt-in<\/strong> and remain off until you configure and enable them.<\/p><\/dd>\n<dt id=\"how%20does%20cloudflare%20integration%20work%3F\"><h3>How does Cloudflare integration work?<\/h3><\/dt>\n<dd><p>When the local firewall detects a malicious IP (brute-force, honeypot trigger, etc.), it can automatically push a block rule to Cloudflare \u2014 but only if you have enabled integration and provided API credentials.<\/p><\/dd>\n<dt id=\"what%20if%20i%20forget%20my%20hidden%20login%20url%3F\"><h3>What if I forget my hidden login URL?<\/h3><\/dt>\n<dd><p>Rename the plugin folder via FTP\/SFTP to disable it, or look up the <code>ariasesu_hide_login_slug<\/code> option in the <code>wp_options<\/code> table.<\/p><\/dd>\n<dt id=\"does%20it%20work%20without%20the%20enterprise%20api%3F\"><h3>Does it work without the Enterprise API?<\/h3><\/dt>\n<dd><p>Yes. Firewall, hide login, honeypots, malware scanner, session manager, traffic monitoring, and most features work fully standalone.<\/p><\/dd>\n<dt id=\"is%20it%20compatible%20with%20multisite%3F\"><h3>Is it compatible with multisite?<\/h3><\/dt>\n<dd><p>The plugin is designed for single-site installs. Multisite support may be added in a future release.<\/p><\/dd>\n<dt id=\"how%20is%20the%20security%20score%20calculated%3F\"><h3>How is the Security Score calculated?<\/h3><\/dt>\n<dd><p>The score analyzes enabled protections (2FA, hide login, headers, firewall rules, etc.) and known misconfigurations, then maps the result to a letter grade A\u2013F.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.2.5<\/h4>\n\n<ul>\n<li>Initial public release on WordPress.org Plugin Directory.<\/li>\n<li>Updated readme and documentation for repository guidelines.<\/li>\n<li>Tested up to WordPress 6.7.<\/li>\n<\/ul>\n\n<h4>1.2.4<\/h4>\n\n<ul>\n<li>Updated: Tested up to WordPress 6.7.<\/li>\n<\/ul>\n\n<h4>1.2.3<\/h4>\n\n<ul>\n<li>Fixed: Vulnerability scanner no longer phones home unless API is configured and the feature is explicitly opted in (off by default).<\/li>\n<li>Fixed: Removed writing <code>.htaccess<\/code> into <code>wp-includes<\/code> (WordPress.org policy).<\/li>\n<li>Fixed: Input sanitization for <code>$_SERVER<\/code> and admin proxy header settings.<\/li>\n<li>Fixed: Correct WordPress directory APIs (<code>WP_PLUGIN_DIR<\/code>, <code>get_theme_root()<\/code>, <code>wp_upload_dir()<\/code>).<\/li>\n<li>Added: <code>composer.json<\/code> included in plugin distribution package.<\/li>\n<li>Added: External services documentation in readme.<\/li>\n<li>Added: Dedicated honeypot login stylesheet (no inline CSS).<\/li>\n<li>Improved: API client refuses requests when credentials are not configured.<\/li>\n<li>Improved: Admin and front-end UI styles moved from inline markup to enqueued CSS files.<\/li>\n<\/ul>\n\n<h4>1.2.2<\/h4>\n\n<ul>\n<li>Fixed: WordPress Plugin Check compliance \u2014 database queries now use safe table-name concatenation instead of interpolated placeholders.<\/li>\n<li>Fixed: Global variable prefixes in uninstall routine aligned with plugin naming conventions.<\/li>\n<li>Improved: Distribution packaging excludes development-only files.<\/li>\n<\/ul>\n\n<h4>1.2.1<\/h4>\n\n<ul>\n<li>Maintenance and stability improvements.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Added: Live Traffic Monitoring dashboard.<\/li>\n<li>Added: Security Score grading system.<\/li>\n<li>Added: Dashboard Widget and Admin Bar integration.<\/li>\n<li>Added: AJAX-based 3-step Onboarding Wizard.<\/li>\n<li>Added: Hide Login Page, Passwordless login, Session Management.<\/li>\n<li>Added: Heuristic Malware Scanner, Cloudflare integration, Geo-blocking.<\/li>\n<li>Added: PHP execution blocking in uploads, Contact Form 7 honeypot.<\/li>\n<li>Updated: Modern AJAX admin UI.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Initial release of the Enterprise API Client.<\/li>\n<li>WAF offload, HMAC signing, Hash scanner, Remote Logging.<\/li>\n<\/ul>","raw_excerpt":"Enterprise-grade WordPress security: WAF, malware scanner, hide login, 2FA, live traffic monitoring, and optional cloud API.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/319217","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=319217"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/syeedalireza"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=319217"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=319217"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=319217"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=319217"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=319217"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=319217"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}