FPX Security Guard Pro<\/a> adds daily File Change Detection with malware-injection alerts \u2014 a background scanning service, hosted and sold separately from this free plugin.<\/p>\n\nAll features can be toggled individually from Settings \u2192 FPX Security Guard. A lockout log shows the last 20 blocked login attempts.<\/p>\n\n
External Services<\/h3>\n\n
This plugin's optional Country Block<\/strong> feature (disabled by default) uses the free geo-location service ip-api.com to determine the country of a visitor's IP address.<\/p>\n\n\n- What is sent:<\/strong> Only the visitor's IP address is sent to ip-api.com, and only when the Country Block feature is manually enabled by the site administrator and a visitor's country is not already cached.<\/li>\n
- When:<\/strong> On the first request from a given IP; the result is cached locally for 24 hours, so repeat visitors trigger no external calls.<\/li>\n
- No other data<\/strong> (no personal info, no site data) is ever transmitted.<\/li>\n<\/ul>\n\n
Service provider: ip-api.com \u2014 Terms: https:\/\/ip-api.com\/docs\/legal \u2014 Privacy: https:\/\/ip-api.com\/docs\/legal<\/p>\n\n
If the Country Block feature is disabled (the default), the plugin makes no external requests whatsoever.<\/p>\n\n
Does rate limiting slow down my site?<\/h4>\n\n
Rate limiting tracks each visitor's request count using WordPress's core Transients API. If your host has a persistent object cache (Redis\/Memcached), this data is stored there with no database writes at all. Without one, it falls back to the options table like any request-level counter \u2014 the tracked data expires within seconds, so it never accumulates.<\/p>\n\n\n
\n- Upload the
fpx-security-guard<\/code> folder to \/wp-content\/plugins\/<\/code>, or upload the zip via Plugins \u2192 Add New \u2192 Upload Plugin.<\/li>\n- Activate the plugin through the Plugins menu.<\/li>\n
- Configure options under Settings \u2192 FPX Security Guard.<\/li>\n<\/ol>\n\n\n
\nI'm locked out of two-factor authentication. How do I get back in?<\/h3><\/dt>\nThere are three rescue paths, in order of ease:<\/p>\n\n
\n- Recovery codes<\/strong> \u2014 enter one of your saved one-time recovery codes in the Authentication Code field on the login screen.<\/li>\n
- Ask an administrator<\/strong> \u2014 any admin can open Users \u2192 your profile and reset your 2FA with one click. You can then log in with just your password and set 2FA up again.<\/li>\n
- Server access (site owners)<\/strong> \u2014 add this line to your wp-config.php file:
define( 'FPXSG_DISABLE_2FA', true );<\/code> \u2014 this temporarily bypasses 2FA for all logins. Log in, reset your 2FA from your profile, then REMOVE the line again. Because it requires file access, only someone who controls the server can use it.<\/li>\n<\/ol><\/dd>\nWill this conflict with other security plugins?<\/h3><\/dt>\nAvoid running multiple firewall\/login-limit plugins at once \u2014 features may overlap.<\/p><\/dd>\n
I use Jetpack or a mobile app to publish.<\/h3><\/dt>\nDisable the \"Disable XML-RPC\" option in settings.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.0<\/h4>\n\n\n- Initial release.<\/li>\n
- Login protection: per-IP attempt limits, lockouts, honeypot, generic error messages.<\/li>\n
- Two-Factor Authentication (TOTP): QR-code setup, recovery codes, low-code warnings, works offline.<\/li>\n
- DDoS\/flood protection via per-IP rate limiting.<\/li>\n
- Firewall: malicious query blocking and modern security headers.<\/li>\n
- Country blocking (optional, via ip-api.com with local caching).<\/li>\n
- Comment spam protection: honeypot and link limits.<\/li>\n
- Hardening: XML-RPC off, file editor off, version hiding, user-enumeration blocking.<\/li>\n
- Bundled QRCode.js by davidshimjs (MIT license, GPL-compatible) for local QR rendering.<\/li>\n<\/ul>","raw_excerpt":"Complete security suite for WordPress \u2014 login protection, firewall headers, info hiding, and hardening.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/335885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=335885"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/mamuniu06"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=335885"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=335885"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=335885"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=335885"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=335885"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=335885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}