Housekeeping release: privacy-first EU positioning in the readme, no functional changes. Out of the box the plugin still makes no outbound calls \u2014 every external service stays opt-in and off by default.<\/p>","0.6.0":"
Adds custom login URL, honeypot anti-bot, and CSP support. Read the FAQ on lockout-recovery before enabling the custom login URL.<\/p>","0.5.0":"
Adds full user-activity audit trail. Old log entries are unaffected; new events start being recorded immediately after upgrade.<\/p>","0.4.0":"
Adds the plugin\/theme\/core vulnerability scanner. ONE outbound HTTP call per installed component per day, to Brainwerk's EU vulnerability API (shieldforge-intel.brainwerk.at). Disable in Settings if you require fully air-gapped operation.<\/p>","0.3.0":"
Adds TOTP two-factor authentication. Existing users keep working unchanged; admins can opt into 2FA on their profile page.<\/p>","0.2.0":"
Adds the file-integrity monitor and malware-pattern scanner. The first baseline build runs at the next scheduled cron (03:30) or on demand from the Scanner tab.<\/p>","0.1.0":"
First public release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3629833,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3629833,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3629571,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3629571,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.14.4"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3629613,"resolution":"1","location":"assets","locale":"","width":1388,"height":1458},"screenshot-10.png":{"filename":"screenshot-10.png","revision":3629613,"resolution":"10","location":"assets","locale":"","width":2560,"height":3552},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3629613,"resolution":"2","location":"assets","locale":"","width":2560,"height":4482},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3629613,"resolution":"3","location":"assets","locale":"","width":2560,"height":3200},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3629613,"resolution":"4","location":"assets","locale":"","width":2560,"height":1978},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3629613,"resolution":"5","location":"assets","locale":"","width":2560,"height":3386},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3629613,"resolution":"6","location":"assets","locale":"","width":2560,"height":4324},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3629613,"resolution":"7","location":"assets","locale":"","width":2560,"height":3424},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3629613,"resolution":"8","location":"assets","locale":"","width":2560,"height":5226},"screenshot-9.png":{"filename":"screenshot-9.png","revision":3629613,"resolution":"9","location":"assets","locale":"","width":1524,"height":3424}},"screenshots":{"1":"Dashboard widget \u2014 threat-score header, action items, 24h stat grid with trend arrows, system-status strip, top attackers + targeted users, recent events.","2":"Scanner tab \u2014 file-integrity baseline status, run-now controls, findings table with re-baseline \/ whitelist actions, code-snippet preview for malware-pattern hits.","3":"Vulnerabilities tab \u2014 per-component listing of known CVEs, CVSS scores, fixed-in versions, links to CVE \/ EUVD advisories, active-vs-inactive flagging.","4":"2FA tab \u2014 module enable, force-by-role policy, per-user enrollment status with rescue-disable for lost-device recovery.","5":"Audit tab \u2014 who-changed-what timeline with per-event-type renderer, filter dropdown, 7-day distribution badges.","6":"Hardening+ tab \u2014 custom login URL with live-preview + lockout-recovery hint, honeypot anti-bot toggles, per-header security toggles incl. CSP report-only mode.","7":"Anomaly tab \u2014 Z-score model, per-user baseline status, recent anomalies with explainable context.","8":"Logs tab \u2014 searchable activity log with quick block \/ unblock actions.","9":"Notifications \u2014 daily digest preview with threat score and ASCII heatmap.","10":"Privacy \/ GDPR \u2014 anonymization, pseudonymization, retention, privacy-policy snippet generator."}},"plugin_section":[262246],"plugin_tags":[2439,55021,600,9217,139069],"plugin_category":[54],"plugin_contributors":[268198],"plugin_business_model":[],"class_list":["post-334812","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-brute-force","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor","plugin_tags-vulnerability-scanner","plugin_category-security-and-spam-protection","plugin_contributors-brainwerk","plugin_committers-brainwerk"],"banners":{"banner":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/banner-772x250.png?rev=3629571","banner_2x":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/banner-1544x500.png?rev=3629571","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/icon-128x128.png?rev=3629833","icon_2x":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/icon-256x256.png?rev=3629833","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-1.png?rev=3629613","caption":"Dashboard widget \u2014 threat-score header, action items, 24h stat grid with trend arrows, system-status strip, top attackers + targeted users, recent events."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-2.png?rev=3629613","caption":"Scanner tab \u2014 file-integrity baseline status, run-now controls, findings table with re-baseline \/ whitelist actions, code-snippet preview for malware-pattern hits."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-3.png?rev=3629613","caption":"Vulnerabilities tab \u2014 per-component listing of known CVEs, CVSS scores, fixed-in versions, links to CVE \/ EUVD advisories, active-vs-inactive flagging."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-4.png?rev=3629613","caption":"2FA tab \u2014 module enable, force-by-role policy, per-user enrollment status with rescue-disable for lost-device recovery."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-5.png?rev=3629613","caption":"Audit tab \u2014 who-changed-what timeline with per-event-type renderer, filter dropdown, 7-day distribution badges."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-6.png?rev=3629613","caption":"Hardening+ tab \u2014 custom login URL with live-preview + lockout-recovery hint, honeypot anti-bot toggles, per-header security toggles incl. CSP report-only mode."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-7.png?rev=3629613","caption":"Anomaly tab \u2014 Z-score model, per-user baseline status, recent anomalies with explainable context."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-8.png?rev=3629613","caption":"Logs tab \u2014 searchable activity log with quick block \/ unblock actions."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-9.png?rev=3629613","caption":"Notifications \u2014 daily digest preview with threat score and ASCII heatmap."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-10.png?rev=3629613","caption":"Privacy \/ GDPR \u2014 anonymization, pseudonymization, retention, privacy-policy snippet generator."}],"raw_content":"\n
WordPress security that protects your site \u2014 without selling out you or your visitors.<\/strong><\/p>\n\n Brainwerk Security Suite is a modern, lightweight security plugin that keeps 100 % of your security data on your own server<\/strong>. No third-party cookies. No Google reCAPTCHA. No silent phone-home. Just clear, honest protection \u2014 2FA, brute-force defense, file-integrity monitoring, a vulnerability scanner and a full audit trail \u2014 with privacy treated as a first-class feature, not an afterthought, and Multisite supported from day one.<\/p>\n\n Brainwerk Security Suite is the European answer for privacy-first WordPress security \u2014 the solution built in the EU, for the EU.<\/strong><\/p>\n\n Engineered in the EU, to EU standards, with privacy-by-design built into every log line<\/strong> \u2014 never bolted on afterwards. Out of the box the plugin makes no<\/strong> outbound calls at all, so your security data never leaves your infrastructure and you stay in control of your users' trust.<\/p>\n\n Login & accounts<\/strong><\/p>\n\n File integrity & malware<\/strong><\/p>\n\n Vulnerability scanner<\/strong><\/p>\n\n Hardening<\/strong><\/p>\n\n Detection<\/strong><\/p>\n\n Admin experience<\/strong><\/p>\n\n Privacy & GDPR<\/strong><\/p>\n\n The Pro tier (a separate companion plugin) adds:<\/p>\n\n Die europ\u00e4ische Antwort f\u00fcr datenschutzfreundliche WordPress-Security \u2014 die L\u00f6sung aus der EU f\u00fcr die EU.<\/strong><\/p>\n\n Brainwerk Security Suite ist die schlanke, moderne Security-Suite f\u00fcr WordPress, die 100 % deiner Security-Daten auf deinem eigenen Server<\/strong> beh\u00e4lt. Keine Tracking-Cookies, kein Google reCAPTCHA, kein stilles Phone-Home \u2014 nur ehrlicher Schutz und volle Kontrolle. Datenschutz ist Kernfunktion, nicht nachtr\u00e4gliches Extra, und Multisite ist von Anfang an mitgedacht.<\/p>\n\n The plugin makes no automatic outbound calls until you opt in. The one you are most likely to enable is the vulnerability scanner, which \u2014 once switched on \u2014 queries an EU-hosted vulnerability API (default Several opt-in<\/strong> features contact external services only after you enable them \u2014 see the External services<\/strong> section below for the full list, the exact data sent, and how to turn each off.<\/p>\n\n All Brainwerk Security Suite data is deleted on plugin uninstall (DB tables dropped, options removed, user-meta wiped, transients purged). The configurable log retention is enforced by a daily cron.<\/p>\n\n This plugin can connect to the external services listed below. Every one of them is opt-in and off by default<\/strong> \u2014 out of the box the plugin contacts nothing. Each can be disabled again at any time, and the vulnerability endpoint can be re-pointed at a self-hosted mirror.<\/p>\n\n 1. Brainwerk Vulnerability API \u2014 2. Brainwerk Threat Network (sensor) \u2014 3. Have I Been Pwned (Pwned Passwords) \u2014 4. hCaptcha \/ Cloudflare Turnstile (optional captcha) \u2014 5. WordPress.org (core checksums & repository integrity) \u2014 Brainwerk Security Suite ships with safe defaults \u2014 no configuration is required to get baseline protection, and out of the box it makes no outbound calls at all. The vulnerability scanner (the one feature that contacts an external API) is off by default; enable it under Vulnerabilities \u2192 Settings<\/strong> if you want daily CVE lookups.<\/p>\n\n\n Not until you ask it to. Out of the box the plugin makes no<\/strong> automatic outbound calls. Every integration that can reach an external service is opt-in and off by default:<\/p>\n\n Each is documented in full in the External services<\/strong> section below.<\/p>\n\n The core local features (file-integrity monitor, malware-pattern scan, brute-force protection, audit log, 2FA, honeypot, anomaly detection, security headers) make no outbound calls.<\/p><\/dd>\n It is built to support your GDPR obligations: IP anonymization, configurable retention, and a published data map are on by default, and the admin includes copy-paste-ready text for your privacy policy. Full legal compliance always depends on how you run your whole site, so treat these as strong technical building blocks rather than legal advice.<\/p><\/dd>\n Yes. Network-activate it and configure once at the network level; per-site overrides are supported.<\/p><\/dd>\n Use one of the 8 recovery codes generated when you enrolled. If you also lost those, an administrator with Add this line to Then visit \ud83c\uddea\ud83c\uddfa Made in Europe. Made for Europe.<\/h4>\n\n
\n
Free features \u2014 defense in depth<\/h4>\n\n
\n
\n
eval(base64_decode(...))<\/code>, webshell signatures (c99\/r57\/WSO\/b374k), inline wp_insert_user(role=admin)<\/code>, preg_replace \/e<\/code>, remote include via URL \u2014 runs only against deltas, not full corpus, so it stays cheap.<\/li>\n<\/ul>\n\n\n
shieldforge-intel.brainwerk.at<\/code>), which aggregates public sources (wpvulnerability.net, EUVD). No API key. The endpoint is configurable \u2014 point it at a self-hosted mirror. See External services<\/strong> below for exactly what is sent.<\/li>\n\n
\n
.env<\/code>, wp-config.bak<\/code>, xmlrpc.php<\/code> and friends).<\/li>\n\n
\n
Go Pro<\/h4>\n\n
\n
\ud83c\uddea\ud83c\uddfa Auf Deutsch \u2014 kurz & knapp<\/h4>\n\n
\n
Privacy Policy<\/h3>\n\n
Data stored in your WordPress database (never leaves the server)<\/h4>\n\n
\n
[changed]<\/code> markers for sensitive fields).<\/li>\nData sent to external services<\/h4>\n\n
https:\/\/shieldforge-intel.brainwerk.at\/<\/code>) once per day. It is off by default; the endpoint is configurable and the feature can be disabled again at any time.<\/p>\n\n\n
GET \/v1\/vulns\/plugin\/contact-form-7\/<\/code>.<\/li>\nshieldforge-intel.brainwerk.at<\/code> is Brainwerk's own EU-hosted API that aggregates public vulnerability data (wpvulnerability.net, EUVD).<\/li>\nLifecycle<\/h4>\n\n
External services<\/h3>\n\n
https:\/\/shieldforge-intel.brainwerk.at\/<\/code> \u2014 OPT-IN, default OFF<\/strong><\/p>\n\n\n
GET \/v1\/vulns\/plugin\/contact-form-7\/<\/code>). No site URL, no domain, no admin email, no IP, no user data, no content, no settings.<\/li>\nshieldforge-intel.brainwerk.at<\/code> is Brainwerk's own EU-hosted API that aggregates public vulnerability data (wpvulnerability.net \u2014 a community mirror of WPScan \/ Patchstack \u2014 and the EU Vulnerability Database, EUVD). Operated by Stefan Kogelgruber \/ Brainwerk (EU). Privacy: https:\/\/brainwerk.at\/privacy<\/a><\/li>\n<\/ul>\n\nhttps:\/\/shieldforge-intel.brainwerk.at\/<\/code> \u2014 OPT-IN, default OFF<\/strong><\/p>\n\n\n
https:\/\/api.pwnedpasswords.com\/<\/code> \u2014 OPT-IN, default OFF<\/strong><\/p>\n\n\n
https:\/\/hcaptcha.com\/<\/code>, https:\/\/challenges.cloudflare.com\/<\/code> \u2014 OPT-IN, default OFF<\/strong><\/p>\n\n\n
https:\/\/api.wordpress.org\/<\/code>, https:\/\/downloads.wordpress.org\/<\/code> \u2014 OPT-IN \/ on demand<\/strong><\/p>\n\n\n
\n
brainwerk-security-suite<\/code> folder to \/wp-content\/plugins\/<\/code> or install via the WordPress plugin uploader.<\/li>\n\n
Does Brainwerk Security Suite call any external service?<\/h3><\/dt>\n
\n
https:\/\/shieldforge-intel.brainwerk.at\/<\/code>) once per day for the slug + version of each installed component. Nothing else (no site URL, no admin email, no IP, no user data) is sent, and you can point it at a self-hosted mirror under Brainwerk Security Suite \u2192 Vulnerabilities \u2192 Settings<\/strong>.<\/li>\nIs the plugin GDPR-compliant out of the box?<\/h3><\/dt>\n
Does it work on Multisite?<\/h3><\/dt>\n
I lost my 2FA device. How do I get back in?<\/h3><\/dt>\n
manage_network_options<\/code> capability can disable 2FA for any user under Brainwerk Security Suite \u2192 2FA \u2192 Users with 2FA configured \u2192 Rescue: disable<\/strong>.<\/p><\/dd>\nI enabled the custom login URL and locked myself out. How do I recover?<\/h3><\/dt>\n
wp-config.php<\/code> (above the \"That's all\" comment):<\/p>\n\ndefine('SHIELDFORGE_LOGIN_RESCUE', 'choose-a-long-random-secret');\n<\/code><\/pre>\n\nhttps:\/\/your-site\/wp-login.php?shieldforge_rescue=choose-a-long-random-secret<\/code> to bypass the 404 and reach the standard login.<\/p><\/dd>\n