Balui Security Suite, by Balui Digital, protects WordPress sites without dozens of screens. Everything is configured from one modern dashboard with light and dark themes, ready to be translated. It is designed for site owners without technical knowledge: the defaults are safe and every option explains what it does.<\/p>\n\n
Balui Security Suite Pro<\/a> is a separate plugin that includes everything above and adds a firewall with country blocking, CAPTCHA services from external providers (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA, Friendly Captcha, MTCaptcha), a Content-Security-Policy assistant with automatic nonces for an A+ grade, passkeys, magic links, temporary access, two-step verification required by role, password expiry and history, session control, an integrity scan, vulnerability alerts, activity log export to CSV, weekly reports, WooCommerce \"My account \u203a Security\", multisite and support. When you install it, it replaces this plugin and keeps all your settings. This plugin is complete on its own and never needs Pro to work.<\/p>\n\n Balui Security Suite only connects to other services for the features below. Nothing is sent to Balui Digital.<\/p>\n\n The plugin includes these open-source libraries, unmodified. Their readable source code is public:<\/p>\n\n The rest of the CSS and JavaScript is not minified.<\/p>\n\n\n On Apache and LiteSpeed the hardening measures marked \"server\" are written to .htaccess (in the site root and in the uploads folder), inside a block marked \"Balui Security Suite\". Four of them are on by default: no directory listing, PHP blocked in uploads, sensitive files and readme.html\/license.txt blocked. You can turn each one off in Hardening, and the block is removed when the plugin is deleted.<\/p>\n\n Emergency switches for wp-config.php: Add Yes. Two-step verification, the login attempt limit, the password policy and the CAPTCHA also work on the WooCommerce \"My account\" login, registration and checkout.<\/p><\/dd>\n Filters: They are kept. Pro uses the same settings and turns this plugin off when it is activated.<\/p><\/dd>\n\n<\/dl>\n\n\nExternal services<\/h3>\n\n
\n
Third-party libraries<\/h3>\n\n
\n
assets\/altcha.min.js<\/code>), MIT license. Source: github.com\/altcha-org\/altcha<\/a>, file dist\/altcha.i18n.umd.js<\/code> of the npm package altcha<\/code>.<\/li>\nassets\/qrcode.js<\/code>), MIT license. Source: github.com\/kazuhikoarase\/qrcode-generator<\/a>, file dist\/qrcode.js<\/code> of the npm package qrcode-generator<\/code>.<\/li>\nassets\/fonts\/<\/code>), SIL Open Font License 1.1 (assets\/fonts\/OFL.txt<\/code>). Source: github.com\/vercel\/geist-font<\/a>.<\/li>\n<\/ul>\n\n\n
BALUI_SECURITY_2FA_OFF<\/code> (second step only), BALUI_SECURITY_LOGIN_URL_OFF<\/code> (custom login URL) and BALUI_SECURITY_OFF<\/code> (whole plugin).<\/p>\n\n\n\n
I locked myself out. What do I do?<\/h3><\/dt>\n
define( 'BALUI_SECURITY_2FA_OFF', true );<\/code> to wp-config.php to skip the second step, or define( 'BALUI_SECURITY_OFF', true );<\/code> to turn the whole plugin off. You can also rename the plugin folder by FTP.<\/p><\/dd>\nDoes it work with WooCommerce?<\/h3><\/dt>\n
Are there hooks for developers?<\/h3><\/dt>\n
bsnt_capability<\/code> (capability needed to manage the plugin, default manage_options<\/code>), bsnt_allow_without_second_step<\/code> (return true to let a given user sign in through XML-RPC or the REST API with the normal password, for example a service account), bsnt_totp_issuer<\/code> (name shown in the authenticator app), bsnt_static_headers<\/code> (security headers sent), bsnt_csp_skip<\/code> and bsnt_csp_directives<\/code> (pages without Content-Security-Policy, and the directives sent), bsnt_send_mail<\/code> (send the plugin's emails with your own mailer). Actions: bsnt_event<\/code> (every activity log event), bsnt_lockout<\/code>, bsnt_tfa_reset<\/code> and bsnt_settings_updated<\/code>.<\/p><\/dd>\nWhat happens to my settings if I move to Balui Security Suite Pro?<\/h3><\/dt>\n
1.8.2<\/h4>\n\n
\n
1.8.1<\/h4>\n\n
\n
1.8.0<\/h4>\n\n
\n
1.7.0<\/h4>\n\n
\n
1.6.2<\/h4>\n\n
\n
1.6.1<\/h4>\n\n
\n
1.6.0<\/h4>\n\n
\n