Back up first. Tightens malformed-input handling. Existing settings, logs and 2FA are preserved. WordPress.org approval remains a separate manual review.<\/p>","2.2.0":"
Back up first. File recovery requires enrolled 2FA. Legacy path-only exceptions are inactive; recreate exact field\/action scopes. Large upload checks are bounded samples, not full malware scans. Existing settings, logs and 2FA are retained.<\/p>","2.1.0":"
Keep an independent site backup. Existing settings\/2FA are retained. Extended firewall starts in learning mode; administrator 2FA policy and external advisory lookups require setup\/consent. Recovery never runs automatically.<\/p>","1.5.0":"
Faster full scans and author updated to Satrim Technologies. Settings, audit history and 2FA enrollment are retained.<\/p>","1.4.0":"
Back up and test on staging. Requires WordPress 6.7+ and PHP 7.4+. An older running scan restarts with the new automatic engine. Enroll 2FA separately for each account.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3761440,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3761440,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3761440,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3761440,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.2.9"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3761440,"resolution":"1","location":"assets","locale":"","width":960,"height":693},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3761440,"resolution":"2","location":"assets","locale":"","width":960,"height":693},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3761440,"resolution":"3","location":"assets","locale":"","width":960,"height":693},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3761440,"resolution":"4","location":"assets","locale":"","width":960,"height":693},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3761440,"resolution":"5","location":"assets","locale":"","width":960,"height":693},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3761440,"resolution":"6","location":"assets","locale":"","width":772,"height":1000},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3761440,"resolution":"7","location":"assets","locale":"","width":960,"height":693},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3761440,"resolution":"8","location":"assets","locale":"","width":960,"height":693},"screenshot-9.png":{"filename":"screenshot-9.png","revision":3761440,"resolution":"9","location":"assets","locale":"","width":960,"height":693}},"screenshots":{"1":"Security overview with recorded activity charts, live scan counters and completed-scan history. Labelled demonstration records.","2":"Automatic scanner showing progress, findings and coverage information, without a manual batch button.","3":"Protection settings for administrator-only publishing, uploads, request filtering, integrations and alerts.","4":"Searchable and filterable activity log with labelled demonstration events.","5":"Two-factor authentication enrollment and account protection controls.","6":"WordPress-style View details with local banner and information tabs.","7":"Advanced protection: firewall learning, 2FA policy, consent and scan resources.","8":"Vulnerability inventory: advisory matches, installed versions and coverage notices.","9":"Findings and encrypted recovery: severity, review actions and reversible file operations."}},"plugin_section":[],"plugin_tags":[1174,1229,55021,600,1909],"plugin_category":[54],"plugin_contributors":[],"plugin_business_model":[],"class_list":["post-389073","plugin","type-plugin","status-publish","hentry","plugin_tags-firewall","plugin_tags-login-security","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor-authentication","plugin_category-security-and-spam-protection","plugin_committers-satrimtechnologies"],"banners":{"banner":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/banner-772x250.png?rev=3761440","banner_2x":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/banner-1544x500.png?rev=3761440","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/icon-128x128.png?rev=3761440","icon_2x":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/icon-256x256.png?rev=3761440","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-1.png?rev=3761440","caption":"Security overview with recorded activity charts, live scan counters and completed-scan history. Labelled demonstration records."},{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-2.png?rev=3761440","caption":"Automatic scanner showing progress, findings and coverage information, without a manual batch button."},{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-3.png?rev=3761440","caption":"Protection settings for administrator-only publishing, uploads, request filtering, integrations and alerts."},{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-4.png?rev=3761440","caption":"Searchable and filterable activity log with labelled demonstration events."},{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-5.png?rev=3761440","caption":"Two-factor authentication enrollment and account protection controls."},{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-6.png?rev=3761440","caption":"WordPress-style View details with local banner and information tabs."},{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-7.png?rev=3761440","caption":"Advanced protection: firewall learning, 2FA policy, consent and scan resources."},{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-8.png?rev=3761440","caption":"Vulnerability inventory: advisory matches, installed versions and coverage notices."},{"src":"https:\/\/ps.w.org\/kryqova-web-security\/assets\/screenshot-9.png?rev=3761440","caption":"Findings and encrypted recovery: severity, review actions and reversible file operations."}],"raw_content":"\n
KRYQOVA provides local security controls and visibility for single-site WordPress installations.<\/p>\n\n
Editorial locking is opt-in on new installs; existing settings are retained. It targets posts, pages and WordPress\/Elementor templates, while cron\/CLI jobs and cleanup remain trusted. Products, orders, custom community\/course types, comments and attachments are outside this restriction. Trusted administrator actions, direct database writes and compromised runtime code are outside its enforcement boundary.<\/p>\n\n
No plugin prevents every attack or proves a site malware-free. Keep software updated and maintain off-site backups and a host\/CDN firewall. This plugin does not provide comprehensive exploit signatures, IP reputation, edge\/DDoS mitigation, automatic repair or inspection of every third-party database table. Its local heuristic rules require review and ongoing updates.<\/p>\n\n
A first scan is scheduled after activation, followed by full scans on the saved schedule (daily by default; hourly\/twice-daily can be selected). Work is divided internally to respect hosting request limits, but it continues automatically; there is no manual batch button. While an administrator keeps the dashboard open, authenticated background requests advance the scan and refresh results. WP-Cron continues the scan with site traffic. For unattended operation on a low-traffic site or with DISABLE_WP_CRON, configure a server cron to invoke wp-cron.php.<\/p>\n\n
All readable regular files under the WordPress root are streamed without a fixed file-count, directory-entry or file-size quota. The scan excludes symlinks, locations outside that root and live SQLite databases. Unreadable, removed or changing files, database errors and unavailable core checksums are reported as incomplete coverage. Core and component checksums stream file bytes for all readable sizes without loading entire files into PHP memory. A single hash operation can exceed the cooperative time budget on very large or slow files. A running site can change while it is scanned. Pattern matching cannot detect every unknown or obfuscated payload. The scanner never deletes or repairs files. Separate recovery actions require administrator permission, nonce, current password, an enrolled second factor and explicit confirmation.<\/p>\n\n
Open the 2FA section, enter your current password and begin setup. Scan the locally generated QR code or add the displayed manual setup key to a time-based authenticator account, then confirm a six-digit code. Save the ten recovery codes offline; they are shown once and each works once. Disabling 2FA or regenerating recovery codes requires both your current password and a valid authenticator\/recovery code. Existing other sessions are revoked on enrollment. Application-password authentication is unavailable for enrolled accounts.<\/p>\n\n
OpenSSL AES-256-GCM support is required for encrypted 2FA secrets. If unavailable, enrollment is disabled with an explanation. Secrets are encrypted using WordPress authentication salts; changing those salts requires recovery-code login and re-enrollment. Keep recovery codes before rotating salts.<\/p>\n\n
Additional body rules default to learning mode, logging rule labels rather than blocking. Inspect your own login, forms, WooCommerce checkout and integrations before choosing Blocking in Advanced protection. Mode\/policy changes require your current password and an enrolled second factor. Bodies are bounded to 128 KiB \/ 2,000 inspected values, exact password fields are excluded; token\/nonce fields are inspected, administrator editor requests bypass additional rules, and multipart file contents use the existing upload checks. These are selected local heuristics, not a maintained global exploit-intelligence firewall.<\/p>\n\n
Connection login throttling keeps its existing eight-attempt transient window and also uses atomic database counters: eight failed attempts per source per fixed 15-minute bucket and account counters are observations only and never deny authentication across connections. Boundaries reset the atomic counters; the existing rolling transient still applies. Proxy client IPs may be configured at the web server or through explicit trusted-proxy CIDRs and a selected forwarded header in Advanced protection. Headers from untrusted peers are ignored; X-Forwarded-For is walked right to left, never blindly trusting the first value. Optional login\/REST request-rate observations flag above 120 requests per source per fixed minute. They block only in Blocking mode.<\/p>\n\n
WordPress installer ZIPs require the exact upload workflow, capability, nonce and validated archive paths. Ordinary PHP, executable script and active document extensions are denied. Plain-text\/CSV code examples are allowed. Other allowed files receive bounded head\/tail inspection (up to 1 MiB each); large files are not rejected solely at 32 MiB. Sampling is not a full malware scan and cannot rule out content between the samples. WordPress MIME\/type checks and hosting limits still apply.<\/p>\n\n
Findings & recovery provides severity, location, recommended action and per-report acknowledged\/false-positive review labels. These labels do not suppress detection or prove remediation. File changes are never automatic. Only an exact path from the latest findings is eligible; quarantine is limited to regular uploads files and rejects symlinks and traversal. A committed AES-256-GCM encrypted original is stored in a dedicated chunk table (legacy option copies remain readable) before removing or overwriting the active file. Core repair fetches an official released-version source file and verifies its official checksum before writing. Replacement failures retain the original recovery copy. Restore verifies ciphertext\/authentication and refuses to overwrite unrelated newer files.<\/p>\n\n
Portable recovery export requires a separate 16\u2013256 character passphrase and re-encrypts originals with PBKDF2-HMAC-SHA256 (210,000 rounds) and AES-256-GCM. Keep the export and passphrase off-site. The included offline-recovery-reader.py.txt requires Python 3 with cryptography; it extracts numbered .bin files for offline review and never executes or restores them. Old copies without authenticated metadata retain legacy compatibility; new copies authenticate the path and recovery metadata.<\/p>\n\n
Limits: 10 MiB per recovery file, 20 saved files and 50 MiB original bytes total. Copies are not exposed as public web files. WordPress authentication salt rotation invalidates them; maintain independent backups first. Plugin Delete preserves data by default; explicit permanent removal deletes recovery copies; restore or independently back up required files before uninstalling. Restoring a quarantined file can restore malicious code. Only do it after reviewing the original. Premium\/custom plugin\/theme repair and database cleanup are manual developer\/host tasks.<\/p>\n\n
A manually established local baseline trusts plugin\/theme hashes from a completed full scan, after the administrator confirms those files are clean. Future changed, added and missing files are findings. A partial scan cannot establish a new trusted baseline. This is change detection, not certification of the baseline. Cached official plugin checksums provide vendor comparison where available. Themes\/custom components without official checksums remain explicitly unverified.<\/p>\n\n
Audit logs contain event time, user ID, short sanitized details and a keyed hash of the connection IP. Retention is 30 days with daily cleanup. Scan reports contain paths and finding categories; the most recent 14 scan summaries and indexed evidence sets are retained, plus the trusted baseline and active scan. Reports embed at most 500 findings; Findings & recovery searches all retained findings for the latest scan. Activity searches and JSON exports include all retained events. Job state stores paths and offsets, never source file contents. Authenticator secrets are encrypted; recovery codes are password-hashed. Deactivation keeps settings and evidence; With explicit permanent-removal opt-in, WordPress Delete removes this plugin's settings, tables, authenticator records and temporary data and encrypted recovery copies. It does not perform additional filesystem changes during uninstall; previously quarantined files remain absent until explicitly restored.<\/p>\n\n
Scans retain their trigger and initiating user across background workers. Failed-login observations are limited to one per connection per minute, with separate lockout events; other security layers may reject requests before WordPress emits the login hook. Readiness warns about common overlapping security plugins and explains component-integrity\/2FA\/cron setup. Optional public-user privacy restricts logged-out users REST endpoints and numeric author-ID lookups; it is off by default. Upload PHP location alone is a review signal, while suspicious execution content is evaluated separately. See OPERATOR-GUIDE.txt.<\/p>\n\n
Firewall exceptions expire after seven days, match one body rule, exact field, POST path, AJAX action and REST route (where applicable), and do not disable upload checks, rate limits or URL protection. Administrator login-source history stores up to ten keyed hashes per account. A new connection is a review signal, not proof of compromise. Test email uses the configured administrator email and is limited to once per five minutes.<\/p>\n\n
Human-readable JavaScript and CSS source is included in assets\/. The shipped files are used directly; no compilation, bundling or minification step is required. Edit these files directly to modify the plugin. The local QR generator in assets\/vendor\/qrcode.js retains its author, license and source information; see assets\/vendor\/LICENSE.txt.<\/p>\n\n
Core integrity and repair networking is disabled by default on new installs and upgrades. An administrator must explicitly enable \"Allow external core verification and repair downloads\" in Advanced protection and save the nonce-protected settings form. Disabling it stops future core requests. Local scans continue with incomplete core verification reported. After opt-in, core integrity scans retrieve official checksum data from https:\/\/api.wordpress.org\/core\/checksums\/1.0\/ using the WordPress safe HTTP API. The request includes WordPress version and locale. No files, audit logs, passwords, recovery codes or 2FA secrets are uploaded. See https:\/\/wordpress.org\/about\/privacy\/ for WordPress.org privacy information. Optional component intelligence is disabled until the administrator consents. It requests https:\/\/www.wpvulnerability.net\/core\/{version}\/, \/plugin\/{slug}\/ and \/theme\/{slug}\/. The WordPress version and installed component slugs, plus the server connection IP and normal HTTP metadata, are disclosed. No source files, database content, logs or credentials are uploaded. Privacy: https:\/\/www.wpvulnerability.com\/privacy\/ ; service documentation\/terms: https:\/\/www.wpvulnerability.com\/ and https:\/\/docs.wpvulnerability.com\/ . Responses are cached up to six hours; failed\/unknown\/range-unsupported responses are coverage notices. A historical report is not proof the current component version remains safe.<\/p>\n\n
With the same consent, official plugin hashes are fetched from https:\/\/downloads.wordpress.org\/plugin-checksums\/{slug}\/{version}.json and cached up to a day. This discloses plugin slug\/version to WordPress.org. Core-file repair service (core.svn.wordpress.org): core recovery explicitly requested by an administrator downloads from https:\/\/core.svn.wordpress.org\/tags\/{installed-version}\/{relative-file} and verifies official core checksums before writing. The repair request discloses the installed WordPress version, relative core-file path, server connection IP and standard HTTP metadata to WordPress.org; it does not upload the local file. This request requires the separate core verification\/repair opt-in as well as administrator confirmation of the repair. Component-intelligence consent does not enable core requests. WordPress.org privacy: https:\/\/wordpress.org\/about\/privacy\/ ; service information: https:\/\/wordpress.org\/about\/ . Source and hashes are trusted over HTTPS; custom\/localized builds may not have a matching replacement and are refused.<\/p>\n\n
Dashboard scripts, QR generation, charts, banners and screenshots are bundled locally; no remote scripts are loaded into the interface. No telemetry is sent. Core-file repair retrieves official replacement files only for an explicitly confirmed repair.<\/p>\n\n\n
This directory package uses kryqova-web-security. If upgrading a legacy cybersentrix installation, back up first and deactivate it before activating this package. Do not delete the inactive legacy copy through WordPress: its uninstall routine shares storage and can erase the new copy's saved data. Settings and logs are retained on normal upgrades. Earlier branded packages are imported into separate storage and disabled during activation. Verify imported records before deleting inactive older packages. An earlier in-progress scan is restarted with the new engine.<\/p>\n\n\n
No. Scan work continues through WP-Cron and the authenticated dashboard worker. A complete readable site-root scan can span many automatic requests on a large site. Skipped paths and incomplete verification remain visible.<\/p><\/dd>\n
Yes. The dashboard worker updates counters and reloads the completed report and scan history when a scan finishes. Background scans are also shown when the dashboard is next loaded. If you have unsaved settings, save them before refreshing.<\/p><\/dd>\n
It checks conservative URL patterns such as traversal, executable wrappers, null bytes and sensitive-file probes after WordPress loads. Login limits reduce repeated password attempts. Use a host\/CDN firewall for edge filtering and broader threat intelligence.<\/p><\/dd>\n
No. The current package supports single-site WordPress.<\/p><\/dd>\n
No. It is enabled per account after the owner verifies an authenticator. Users can access their own 2FA enrollment page from their profile. Administrators should enroll every privileged account separately.<\/p><\/dd>\n
Use an unused recovery code or wait for a login lockout to expire. If needed, a hosting administrator can rename wp-content\/plugins\/kryqova-web-security to disable the plugin. There is no public unauthenticated bypass URL.<\/p><\/dd>\n
No. Directory publication needs a real WordPress.org account, submission, manual review and an assigned repository. The local View details window and included screenshots work without a public listing.<\/p><\/dd>\n\n<\/dl>\n\n\n
Retain software upload correction and existing integrity verification.<\/p><\/li>\n
Fix legitimate administrator theme\/plugin ZIP uploads with nonce, capability and archive validation.<\/p><\/li>\n
Keep ordinary media upload script protection enabled.<\/p><\/li>\n
Remove duplicate banner title; retain the native WordPress heading.<\/p><\/li>\n
Renamed to KRYQOVA Web Security with refreshed branding and screenshots.<\/p><\/li>\n
Preserved existing plugin settings, logs and 2FA enrollment.<\/p><\/li>\n
Expanded code heuristics and bounded native database-content scanning.<\/p><\/li>\n