Addresses Plugin Check filesystem warnings while keeping encrypted quarantine evidence streamed in bounded chunks. Evidence permission failures now stop quarantine without deleting the source.<\/p>","1.2.6":"
Moves held evidence to encrypted, uploads-based quarantine storage with safe legacy migration. Direct restoration from the admin interface is removed. Export retained evidence before rotating site authentication salts.<\/p>","1.2.5":"
Closes a firewall gap: a hostile request body sent with GET, or under an unlisted or unusual Content-Type, was not inspected. Recommended for all sites.<\/p>","1.2.4":"
Fixes comparisons that stopped with a storage error, or reported an existing file as deleted, when files changed during the scan. Recommended for all sites.<\/p>","1.2.3":"
Fixes quarantine on WordPress 6.6, where a quarantined file was removed without keeping the held copy. Recommended for all sites.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3751026,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3751026,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.7"],"block_files":[],"assets_screenshots":{"screenshot-1.jpg":{"filename":"screenshot-1.jpg","revision":3751026,"resolution":"1","location":"assets","locale":"","width":1440,"height":1000},"screenshot-2.jpg":{"filename":"screenshot-2.jpg","revision":3751026,"resolution":"2","location":"assets","locale":"","width":1425,"height":990},"screenshot-3.jpg":{"filename":"screenshot-3.jpg","revision":3751026,"resolution":"3","location":"assets","locale":"","width":1425,"height":990},"screenshot-4.jpg":{"filename":"screenshot-4.jpg","revision":3751026,"resolution":"4","location":"assets","locale":"","width":1440,"height":1000},"screenshot-5.jpg":{"filename":"screenshot-5.jpg","revision":3751026,"resolution":"5","location":"assets","locale":"","width":1425,"height":990},"screenshot-6.jpg":{"filename":"screenshot-6.jpg","revision":3751026,"resolution":"6","location":"assets","locale":"","width":1440,"height":1000},"screenshot-7.jpg":{"filename":"screenshot-7.jpg","revision":3751026,"resolution":"7","location":"assets","locale":"","width":1440,"height":1000}},"screenshots":[]},"plugin_section":[],"plugin_tags":[168808,1174,1229,600,1909],"plugin_category":[54],"plugin_contributors":[287159,287158],"plugin_business_model":[],"class_list":["post-384803","plugin","type-plugin","status-publish","hentry","plugin_tags-file-integrity","plugin_tags-firewall","plugin_tags-login-security","plugin_tags-security","plugin_tags-two-factor-authentication","plugin_category-security-and-spam-protection","plugin_contributors-lajea87","plugin_contributors-neverlast","plugin_committers-neverlast"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/icon-128x128.png?rev=3751026","icon_2x":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/icon-256x256.png?rev=3751026","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/screenshot-1.jpg?rev=3751026","caption":""},{"src":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/screenshot-2.jpg?rev=3751026","caption":""},{"src":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/screenshot-3.jpg?rev=3751026","caption":""},{"src":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/screenshot-4.jpg?rev=3751026","caption":""},{"src":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/screenshot-5.jpg?rev=3751026","caption":""},{"src":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/screenshot-6.jpg?rev=3751026","caption":""},{"src":"https:\/\/ps.w.org\/neverlast-security-lite\/assets\/screenshot-7.jpg?rev=3751026","caption":""}],"raw_content":"\n
NeverLast Security Lite is a complete, standalone security plugin. It runs inside your site: no account, no licence key, no telemetry, and no feature locked behind an upgrade.<\/p>\n\n
Lite runs inside WordPress, so it cannot protect anything served before WordPress loads and it does not replace web-server, hosting, CDN or backup controls. It does not scan database content, it logs but does not block the creation of administrator accounts, and it never repairs files automatically. An integrity baseline shows what changed since you approved it; it does not prove the approved state was clean. Single-site installations only.<\/p>\n\n
No security product can guarantee a site is free of vulnerabilities. Keep WordPress, PHP, plugins and themes updated, use least privilege, and keep tested off-site backups.<\/p>\n\n
Support and security contact: nss@neverlast.ro<\/p>\n\n
NeverLast Security Lite never sends site content, credentials, visitor records or telemetry, and never contacts NeverLast. Every connection to another service is off until you turn it on:<\/p>\n\n
Only when you enable a provider under Protection, WP-Cron downloads its public IP list once a day so that provider's genuine crawler is not counted against the optional anonymous rate limit. The request carries your server's IP address and a plugin user agent that does not include your site's address; nothing else is sent.<\/p>\n\n
Only when you enable \"Verify changed core and plugin files with WordPress.org checksums\" under Protection, a comparison that finds changed, added or missing WordPress core or plugin files downloads the official checksums for that release, to tell a genuine update apart from tampering. Core checksums come from https:\/\/api.wordpress.org\/core\/checksums\/1.0\/ with the WordPress version and locale; plugin checksums come from https:\/\/downloads.wordpress.org\/plugin-checksums\/ with the plugin slug and version. Requests carry your server's IP address and a plugin user agent without your site's address, and results are cached for six hours. While this is off, files are compared with your approved baseline only. WordPress.org privacy policy: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n
The Directory listing health check requests your own uploads address to see whether the server returns a file index. Optional crawler verification uses your server's DNS resolver; no verification API is contacted.<\/p>\n\n
Security events are stored in your WordPress database with a masked IP address, a salted one-way IP hash, the request method and path, and bounded redacted context. Passwords, cookies, authorization headers, nonces, secrets and recovery codes are never logged. The activity log keeps seven days by default. Email alerts use your site's own mail configuration and go to the WordPress administration email unless you set another address. Throttled critical alerts are on by default; administrator-login alerts and the weekly summary are sent only when enabled.<\/p>\n\n
A quarantined file is held under an access-restricted neverlast-security-lite\/quarantine directory in your configured uploads folder with authenticated AES-256-GCM encryption and its original SHA-256. Apache\/IIS access-control files are included; nginx and other web servers should still explicitly deny direct HTTP access. Decryption uses the WordPress authentication salts, so export retained evidence before rotating or replacing those salts. On upgrade, previous Base64 evidence is checked and re-encrypted when migrated from wp-content\/.nlssl-quarantine; originals are kept if migration fails. Direct restoration of executable evidence is disabled; download it for offline analysis or permanently delete it. Evidence survives ordinary uninstall; enabling \"Delete Lite data on uninstall\" removes held data along with settings and tables.<\/p>\n\n\n
No. Lite is complete on its own, with its own code, settings and database tables. Nothing is locked, trial-limited or downloaded at runtime.<\/p><\/dd>\n
Monitor records matching requests without blocking. Balanced blocks high-confidence matches and suits most sites after a period of observation. Strict blocks at a lower threshold; test forms, checkout and custom APIs before enabling it.<\/p><\/dd>\n
Your baseline describes the versions you approved. After an update, review the reported package changes and, if they are what you installed, create a new baseline.<\/p><\/dd>\n
No. It shows that the monitored files match the baseline you approved. It cannot see logic flaws, database content or files outside its scope.<\/p><\/dd>\n
It is removed from uploads and held as an encrypted copy until you choose to download it as evidence or delete it permanently. Direct restoration of suspicious files has been disabled to prevent executable files being reintroduced. If something outside NeverLast Security removes the held copy, for example host antivirus, the entry is reported as missing rather than silently disappearing.<\/p><\/dd>\n