{"id":393651,"date":"2026-11-07T11:28:02","date_gmt":"2026-11-07T11:28:02","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/gemsecurity\/"},"modified":"2026-11-07T11:34:45","modified_gmt":"2026-11-07T11:34:45","slug":"gemsecurity","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/gemsecurity\/","author":20964119,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.2.2","stable_tag":"1.2.2","tested":"7.1.4","requires":"6.4","requires_php":"7.4","requires_plugins":null,"header_name":"GemSecurity","header_author":"Kodezen","header_description":"All-in-one WordPress security dashboard \u2014 firewall, login protection, malware scanner, and activity logs.","assets_banners_color":"c1dec9","last_updated":"2026-11-07 11:34:45","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/imrantushar\/gemsecurity","header_author_uri":"https:\/\/kodezen.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":126,"num_ratings":0,"support_threads":1,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.2.2":{"tag":"1.2.2","author":"kodezen","date":"2026-11-07 11:34:45","revision":3789461}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3790569,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3790569,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3790569,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[1174,595,600,2056,1909],"plugin_category":[54],"plugin_contributors":[223170,177102],"plugin_business_model":[],"class_list":["post-393651","plugin","type-plugin","status-publish","hentry","plugin_tags-firewall","plugin_tags-recaptcha","plugin_tags-security","plugin_tags-social-login","plugin_tags-two-factor-authentication","plugin_category-security-and-spam-protection","plugin_contributors-kodezen","plugin_contributors-tusharimran","plugin_committers-kodezen"],"banners":{"banner":"https:\/\/ps.w.org\/gemsecurity\/assets\/banner-772x250.png?rev=3790569","banner_2x":"https:\/\/ps.w.org\/gemsecurity\/assets\/banner-1544x500.png?rev=3790569","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/gemsecurity\/assets\/icon-256x256.png?rev=3790569","icon_2x":"https:\/\/ps.w.org\/gemsecurity\/assets\/icon-256x256.png?rev=3790569","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p><strong>GemSecurity<\/strong> is an all-in-one WordPress security plugin: a web application firewall, login protection, two-factor authentication, social login, reCAPTCHA \/ hCaptcha \/ Cloudflare Turnstile, a malware and vulnerability scanner, and a full activity log, all in one fast single-page dashboard.<\/p>\n\n<p>Every feature lives in a module you can switch on or off. A module that is off loads no code, so you only pay for what you use. A live security score tells you what still needs attention, and every page has a built-in \"?\" guide.<\/p>\n\n<h4>Why GemSecurity?<\/h4>\n\n<ul>\n<li>One plugin instead of five: security, firewall, 2FA, social login and CAPTCHA together<\/li>\n<li>Lightweight and modular: disabled modules load nothing<\/li>\n<li>Safe by default: administrators are never locked out by the firewall, risky options start off<\/li>\n<li>Setup wizard and in-plugin help for every page<\/li>\n<li>Light and dark admin theme<\/li>\n<\/ul>\n\n<h4>Firewall &amp; WAF (Web Application Firewall)<\/h4>\n\n<ul>\n<li>Blocks SQL injection (SQLi), cross-site scripting (XSS), local file inclusion (LFI) and remote code execution (RCE) requests<\/li>\n<li>IP blocklist with CIDR range support, plus an IP safelist that is never blocked or rate-limited<\/li>\n<li>Request rate limiting and 404-flood throttling<\/li>\n<li>Bad-bot and AI-crawler blocking, with search-engine bot verification<\/li>\n<li>Site-wide file upload switch (Media, REST, sideload and XML-RPC)<\/li>\n<li>Your own IP is refused in the blocklist so you cannot lock yourself out<\/li>\n<\/ul>\n\n<h4>Hardening<\/h4>\n\n<ul>\n<li>Disable XML-RPC and the theme\/plugin file editor<\/li>\n<li>Stop author and REST API user enumeration<\/li>\n<li>Hide the WordPress version<\/li>\n<li>Application password governance and max-age<\/li>\n<li>Generic login error messages<\/li>\n<li>Optional protection of wp-config.php, debug.log and wp-admin\/includes via .htaccess<\/li>\n<\/ul>\n\n<h4>Security headers<\/h4>\n\n<ul>\n<li>X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy<\/li>\n<li>HSTS (Strict-Transport-Security) and Content-Security-Policy (CSP)<\/li>\n<li>Headers are added to REST API responses too<\/li>\n<\/ul>\n\n<h4>Login security &amp; brute-force protection<\/h4>\n\n<ul>\n<li>Limit login attempts with configurable brute-force lockouts<\/li>\n<li>Custom login URL (hide \/ rename wp-login.php) with a public page picker and wp-config.php kill switch<\/li>\n<li>Session limits, idle timeout and absolute admin session timeout<\/li>\n<li>Admin-login email alerts<\/li>\n<li>Login lockdown mode<\/li>\n<li>Force logout and forced password resets by role, on demand or on a schedule<\/li>\n<\/ul>\n\n<h4>reCAPTCHA, hCaptcha &amp; Cloudflare Turnstile<\/h4>\n\n<ul>\n<li>Google reCAPTCHA v2 and v3, hCaptcha and Cloudflare Turnstile<\/li>\n<li>Protects login, registration and lost-password forms<\/li>\n<li>\"Verify keys\" test with the real widget before you save<\/li>\n<li>A wrong secret key never locks everyone out; the problem is logged instead<\/li>\n<\/ul>\n\n<h4>Two-Factor Authentication (2FA)<\/h4>\n\n<ul>\n<li>Authenticator app (TOTP) with QR code: Google Authenticator, Authy, Microsoft Authenticator and others<\/li>\n<li>Email one-time codes (OTP)<\/li>\n<li>One-time backup codes<\/li>\n<li>Enforce 2FA per role, or for all roles<\/li>\n<li>Works with front-end login forms, not only wp-login.php<\/li>\n<li>2FA secrets encrypted with AES-256-GCM<\/li>\n<\/ul>\n\n<h4>Social login<\/h4>\n\n<ul>\n<li>One-click sign in with Google, Facebook, GitHub and X (Twitter)<\/li>\n<li>Choose the role for new social accounts<\/li>\n<li>Buttons appear only after a provider's keys are verified; broken providers switch off and alert you<\/li>\n<li>Social sign-ins go through Admin Guard<\/li>\n<\/ul>\n\n<h4>Magic login (passwordless)<\/h4>\n\n<ul>\n<li>Users can request a one-time sign-in link by email from the login form<\/li>\n<li>Rate-limited, and the link only works in the browser that requested it<\/li>\n<\/ul>\n\n<h4>Password policy<\/h4>\n\n<ul>\n<li>Minimum strength and length rules<\/li>\n<li>Breached-password check with Have I Been Pwned (only a partial hash is sent)<\/li>\n<li>Password rotation: force resets for passwords older than a set number of days<\/li>\n<\/ul>\n\n<h4>Admin Guard<\/h4>\n\n<ul>\n<li>Administrator whitelist with automatic removal of rogue \/ unapproved admins<\/li>\n<li>Hidden-admin detection<\/li>\n<li>Preview who would be removed before anything happens<\/li>\n<\/ul>\n\n<h4>Temporary access<\/h4>\n\n<ul>\n<li>Give an existing user a higher role for a limited time; their old role comes back automatically<\/li>\n<\/ul>\n\n<h4>Plugin Guard &amp; supply-chain protection<\/h4>\n\n<ul>\n<li>Verifies every plugin against official WordPress.org checksums<\/li>\n<li>Trust list for premium, custom, theme and must-use plugins<\/li>\n<li>Optional enforcement stops untrusted plugins before they load<\/li>\n<li>Install Lock: block zip uploads, all installs or every file change, with a logged 15-minute timed unlock<\/li>\n<li>Plugin lock: a separate unlock password plus emailed code guards deactivating GemSecurity<\/li>\n<\/ul>\n\n<h4>Upload Shield<\/h4>\n\n<ul>\n<li>Refuses PHP and other executable files on every upload path<\/li>\n<li>Detects PHP hidden in images and scripted SVG<\/li>\n<li>Writes no-execute rules to uploads\/.htaccess, with a live PHP-execution test and an nginx snippet<\/li>\n<li>Bans the IP behind a refused executable upload<\/li>\n<\/ul>\n\n<h4>Malware &amp; vulnerability scanner<\/h4>\n\n<ul>\n<li>WordPress core file integrity check against official checksums<\/li>\n<li>Compare a flagged core file line by line with the WordPress.org original<\/li>\n<li>Uploads malware \/ PHP pattern scan<\/li>\n<li>Suspicious .htaccess rule detection with one-click quarantine<\/li>\n<li>Known-vulnerability scanner for WordPress core, plugins and themes<\/li>\n<li>File-change detection and link scanner<\/li>\n<li>Mark reviewed files as safe; they are reported again if they change<\/li>\n<li>Code &amp; database finder to search the whole install and database<\/li>\n<\/ul>\n\n<h4>Anti-spam<\/h4>\n\n<ul>\n<li>Frictionless bot checks on comments and registration (no CAPTCHA needed)<\/li>\n<li>Comment honeypot and heuristic spam filtering<\/li>\n<\/ul>\n\n<h4>API security<\/h4>\n\n<ul>\n<li>REST API rate limiting<\/li>\n<li>Application password controls<\/li>\n<\/ul>\n\n<h4>Activity log (audit log)<\/h4>\n\n<ul>\n<li>Logs logins, user changes, role changes, plugin\/theme changes, settings and content edits<\/li>\n<li>Field-level diff for edits to live posts, with a link to the revision<\/li>\n<li>SEO meta, template and featured image changes<\/li>\n<li>Records how each event arrived (admin, REST, XML-RPC, AJAX, WP-CLI, cron), user agent and session<\/li>\n<li>Filter by user or post, retention settings and CSV export<\/li>\n<\/ul>\n\n<h4>Alerts &amp; notifications<\/h4>\n\n<ul>\n<li>Email, Slack, Telegram and generic webhook alerts<\/li>\n<li>Alerts include the IP's city, region, country and network<\/li>\n<li>Daily report of administrators and active plugins, highlighting changes<\/li>\n<li>Alert when GemSecurity is deactivated<\/li>\n<li>Test buttons for every channel<\/li>\n<\/ul>\n\n<h4>Compliance &amp; SIEM<\/h4>\n\n<ul>\n<li>Send security events to your own SIEM collector or webhook<\/li>\n<\/ul>\n\n<h4>Security dashboard<\/h4>\n\n<ul>\n<li>Live security score with grade and trends<\/li>\n<li>\"What needs your attention\" list linking straight to each fix<\/li>\n<li>Module manager to turn features on and off without reloading<\/li>\n<li>First-run setup wizard with protection levels<\/li>\n<\/ul>\n\n<h4>Works with GemBackup (optional)<\/h4>\n\n<p>GemSecurity does not create backups itself. If the separate GemBackup plugin is active, GemSecurity can ask it for a backup before plugin\/theme\/core updates and can start a restore of its latest backup from the Incident Response page.<\/p>\n\n<h4>GemSecurity Pro<\/h4>\n\n<p>GemSecurity Pro is a separate add-on plugin for sites that need active threat defense and malware cleanup. None of its code is in this free plugin; everything listed above stays free.<\/p>\n\n<ul>\n<li><strong>Threat Defense<\/strong> \u2013 escalating auto-bans for repeat attackers, a full ban ledger and a curated bad-bot blocklist<\/li>\n<li><strong>Virtual patching<\/strong> \u2013 CVE-targeted firewall rules that block known exploits for your installed plugin and theme versions, even before a fix is released<\/li>\n<li><strong>Country blocking (geolocation)<\/strong> \u2013 allow or block countries for the whole site or just the login page<\/li>\n<li><strong>Signature malware scanner<\/strong> \u2013 deep malware detection with one-click quarantine and restore<\/li>\n<li><strong>Database injection scan<\/strong> \u2013 finds spam links, hidden scripts and backdoors stored in posts, options and other tables<\/li>\n<li><strong>Plugin &amp; theme integrity<\/strong> \u2013 compares every file with the original from WordPress.org<\/li>\n<li><strong>Core repair<\/strong> \u2013 reinstalls WordPress core and removes files that core does not ship, so implants do not survive a reinstall<\/li>\n<li><strong>File-change baseline<\/strong> \u2013 records a known-good snapshot and alerts on any added, changed or deleted file<\/li>\n<li><strong>Post-hack recovery toolkit &amp; Incident Response<\/strong> \u2013 step-by-step cleanup, reset salts, sessions and passwords, restore quarantined files<\/li>\n<li><strong>Payment page integrity (PCI DSS 4.0)<\/strong> \u2013 watches the scripts loaded on checkout pages and flags card-skimmer injections<\/li>\n<li><strong>Uptime &amp; domain monitoring<\/strong> \u2013 site uptime, SSL\/TLS certificate expiry, DNS changes and SPF\/DKIM\/DMARC email health<\/li>\n<li><strong>New-device login alerts<\/strong> \u2013 emails users when an unrecognised device signs in, plus emergency one-time login links<\/li>\n<li><strong>Hardening pack<\/strong> \u2013 extra one-click hardening rules<\/li>\n<li><strong>Auto-update enforcement<\/strong> \u2013 keep chosen plugins, themes and core updated automatically<\/li>\n<li><strong>Settings import \/ export<\/strong> \u2013 copy your security setup between sites<\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>GemSecurity connects to the services below only for the feature named, and only after you turn that feature on. On a default install the only requests made are to WordPress.org (official checksums and plugin information, used to verify core, plugin and theme files). Every other service below is contacted only after you switch that feature on, including the vulnerability scan, which is off by default.<\/p>\n\n<h4>CAPTCHA (Login &amp; Access \u2192 CAPTCHA)<\/h4>\n\n<p>When CAPTCHA is enabled, the provider's script loads on the login, registration and lost-password forms, and the CAPTCHA response token plus the visitor's IP address are sent to the provider to verify each submission.<\/p>\n\n<ul>\n<li>Google reCAPTCHA \u2014 <a href=\"https:\/\/policies.google.com\/terms\">Terms<\/a>, <a href=\"https:\/\/policies.google.com\/privacy\">Privacy<\/a><\/li>\n<li>hCaptcha \u2014 <a href=\"https:\/\/www.hcaptcha.com\/terms\">Terms<\/a>, <a href=\"https:\/\/www.hcaptcha.com\/privacy\">Privacy<\/a><\/li>\n<li>Cloudflare Turnstile \u2014 <a href=\"https:\/\/www.cloudflare.com\/website-terms\/\">Terms<\/a>, <a href=\"https:\/\/www.cloudflare.com\/privacypolicy\/\">Privacy<\/a><\/li>\n<\/ul>\n\n<h4>Social login (Login &amp; Access \u2192 Social Login)<\/h4>\n\n<p>When a visitor signs in with a provider, the OAuth authorization code is sent to that provider and the user's name, email and avatar are returned to your site.<\/p>\n\n<ul>\n<li>Google \u2014 <a href=\"https:\/\/policies.google.com\/terms\">Terms<\/a>, <a href=\"https:\/\/policies.google.com\/privacy\">Privacy<\/a><\/li>\n<li>Facebook (Meta) \u2014 <a href=\"https:\/\/www.facebook.com\/terms.php\">Terms<\/a>, <a href=\"https:\/\/www.facebook.com\/privacy\/policy\/\">Privacy<\/a><\/li>\n<li>GitHub \u2014 <a href=\"https:\/\/docs.github.com\/en\/site-policy\/github-terms\/github-terms-of-service\">Terms<\/a>, <a href=\"https:\/\/docs.github.com\/en\/site-policy\/privacy-policies\/github-general-privacy-statement\">Privacy<\/a><\/li>\n<li>X (Twitter) \u2014 <a href=\"https:\/\/x.com\/en\/tos\">Terms<\/a>, <a href=\"https:\/\/x.com\/en\/privacy\">Privacy<\/a><\/li>\n<\/ul>\n\n<h4>Vulnerability scanner<\/h4>\n\n<p>The slug and version of each installed plugin and theme, and your WordPress version, are sent to the WPVulnerability API (www.wpvulnerability.net) to look up known vulnerabilities. <a href=\"https:\/\/www.wpvulnerability.com\/license\/\">License<\/a>, <a href=\"https:\/\/www.wpvulnerability.com\/privacy\/\">Privacy<\/a><\/p>\n\n<h4>Plugin and file integrity checks<\/h4>\n\n<p>Plugin\/theme slugs and versions are sent to WordPress.org to fetch official checksums, package details and original files for comparison. When you open a flagged core file in the Scanner, that file is downloaded from core.svn.wordpress.org (your WordPress version and the file path are sent) and accepted only if it matches the official checksum. <a href=\"https:\/\/wordpress.org\/about\/domains\/\">Terms<\/a>, <a href=\"https:\/\/wordpress.org\/about\/privacy\/\">Privacy<\/a><\/p>\n\n<h4>Breached-password check (Password Policy)<\/h4>\n\n<p>When enabled, the first 5 characters of the SHA-1 hash of a new password are sent to Have I Been Pwned (api.pwnedpasswords.com), also when you press \"Test connection\". The password itself never leaves your site. <a href=\"https:\/\/haveibeenpwned.com\/Privacy\">Terms and privacy<\/a><\/p>\n\n<h4>IP location lookup (Plugin Guard alerts)<\/h4>\n\n<p>When Plugin Guard blocks an executable upload or an untrusted plugin, the IP address of the visitor involved is sent over HTTPS to ipapi.co to add a country and city to the security alert. The GemSecurity Pro add-on uses the same lookup for its country access control. No lookup is made when your CDN already supplies the country. <a href=\"https:\/\/ipapi.co\/terms\/\">Terms<\/a>, <a href=\"https:\/\/ipapi.co\/privacy\/\">Privacy<\/a><\/p>\n\n<h4>Alerts (Notifications)<\/h4>\n\n<p>When you add a Slack webhook or Telegram bot, security alert text (event, user, IP address and time) is sent to that channel.<\/p>\n\n<ul>\n<li>Slack \u2014 <a href=\"https:\/\/slack.com\/terms-of-service\">Terms<\/a>, <a href=\"https:\/\/slack.com\/trust\/privacy\/privacy-policy\">Privacy<\/a><\/li>\n<li>Telegram \u2014 <a href=\"https:\/\/telegram.org\/tos\">Terms<\/a>, <a href=\"https:\/\/telegram.org\/privacy\">Privacy<\/a><\/li>\n<\/ul>\n\n<h4>Generic webhook and SIEM collector (Notifications, Settings \u2192 Compliance &amp; SIEM)<\/h4>\n\n<p>Only if you enter your own webhook or collector URL, security events (event name, severity, message, user, IP address and time) are sent to that URL. The destination is chosen and operated by you, so its terms and privacy policy are your own.<\/p>\n\n<h4>Site monitoring (Monitoring module)<\/h4>\n\n<p>Uptime, TLS-certificate, DNS, SPF and DMARC checks are made against your own site and domain. DNS lookups use your server's resolver; no data about your site is sent to GemSecurity or Kodezen.<\/p>\n\n<h4>Usage insights (opt-in)<\/h4>\n\n<p>Only if you accept the opt-in notice, GemSecurity sends usage data to Kodezen at store.kodezen.com. This includes your site URL and name, the admin's name and email, the server IP, WordPress, PHP, database and server versions, the site language, active theme, and active and inactive plugins. If you choose to give feedback when deactivating, that feedback is sent too. Nothing is sent if you decline. <a href=\"https:\/\/kodezen.com\/terms-and-conditions\/\">Terms<\/a>, <a href=\"https:\/\/kodezen.com\/privacy-policy\/\">Privacy<\/a><\/p>\n\n<h3>Source code and libraries<\/h3>\n\n<p>The malware and firewall signatures in the PHP code are stored hex-encoded and decoded with <code>GemSecurity\\Helper::sig()<\/code>. They are detection patterns (data), not code, and are encoded only so that antivirus tools do not flag the plugin itself for containing the same strings as the malware it looks for.<\/p>\n\n<p>The admin JavaScript in <code>assets\/build\/<\/code> is compiled. Its human-readable source is included in the <code>dev_gemsecurity\/<\/code> folder and is also public on GitHub: <a href=\"https:\/\/github.com\/imrantushar\/gemsecurity\">github.com\/imrantushar\/gemsecurity<\/a>.<\/p>\n\n<p>To rebuild it, run <code>npm install<\/code> and then <code>npm run build<\/code>. To build the full release zip, run <code>npm run dist<\/code>. It installs missing packages and then builds the JS, translation template and zip.<\/p>\n\n<p>GemSecurity bundles these open-source libraries:<\/p>\n\n<ul>\n<li><a href=\"https:\/\/github.com\/reduxjs\/redux-toolkit\">Redux Toolkit<\/a>, <a href=\"https:\/\/github.com\/reduxjs\/redux\">Redux<\/a> and <a href=\"https:\/\/github.com\/reduxjs\/react-redux\">React Redux<\/a> \u2014 MIT<\/li>\n<li><a href=\"https:\/\/github.com\/remix-run\/react-router\">React Router<\/a> \u2014 MIT<\/li>\n<li><a href=\"https:\/\/github.com\/JedWatson\/react-select\">React Select<\/a> and <a href=\"https:\/\/github.com\/emotion-js\/emotion\">Emotion<\/a> \u2014 MIT<\/li>\n<li><a href=\"https:\/\/github.com\/axios\/axios\">Axios<\/a> \u2014 MIT<\/li>\n<li><a href=\"https:\/\/github.com\/zpao\/qrcode.react\">qrcode.react<\/a> \u2014 ISC<\/li>\n<li><a href=\"https:\/\/store.kodezen.com\/\">StoreEngine WordPress SDK<\/a> \u2014 GPL-3.0-or-later<\/li>\n<\/ul>\n\n<p>React and WordPress packages are loaded from WordPress core, not bundled.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>gemsecurity<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install through Plugins \u2192 Add New.<\/li>\n<li>Activate the plugin through the Plugins menu in WordPress.<\/li>\n<li>Open the GemSecurity menu and review the dashboard; enable the protections you want.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"where%20do%20i%20start%3F\"><h3>Where do I start?<\/h3><\/dt>\n<dd><p>Open GemSecurity \u2192 Modules and turn on the areas your site needs, then work through Firewall, Login Security and Scanner \u2014 they cover the most common attacks. Every page has a \"?\" button in the top bar that explains what that page does, how to set it up, and what to watch out for.<\/p><\/dd>\n<dt id=\"there%20are%20a%20lot%20of%20settings.%20is%20there%20documentation%20inside%20the%20plugin%3F\"><h3>There are a lot of settings. Is there documentation inside the plugin?<\/h3><\/dt>\n<dd><p>Yes. The \"?\" button in the top bar opens a guide for the page you are on: a short summary, what the feature actually does once enabled, numbered setup steps, and the caveats worth knowing before you switch something on.<\/p><\/dd>\n<dt id=\"what%20does%20turning%20a%20module%20off%20actually%20do%3F\"><h3>What does turning a module off actually do?<\/h3><\/dt>\n<dd><p>A module that is off loads none of its code, registers no REST routes and shows no menu entry \u2014 so features you do not use cost nothing. Its settings are kept, so switching it back on restores your configuration exactly as it was. Menu entries appear and disappear as you toggle, without reloading the page.<\/p><\/dd>\n<dt id=\"which%20files%20does%20gemsecurity%20change%3F\"><h3>Which files does GemSecurity change?<\/h3><\/dt>\n<dd><p>Only when you switch the matching feature on, and only through WordPress's own helpers: Upload Shield adds deny rules to <code>wp-content\/uploads\/.htaccess<\/code>, and \"Protect wp-config.php and error logs\" (off by default) adds a marked block to the site's root <code>.htaccess<\/code> that blocks web access to <code>wp-config.php<\/code>, <code>debug.log<\/code> and <code>wp-admin\/includes<\/code>. Turning either off removes only its own block. Nothing is written to WordPress core, plugin, theme or must-use folders, and quarantined files are kept in the database and can only be restored, as non-executable files, to the uploads folder.<\/p><\/dd>\n<dt id=\"will%20the%20firewall%20lock%20me%20out%3F\"><h3>Will the firewall lock me out?<\/h3><\/dt>\n<dd><p>No. Logged-in administrators are never blocked by the IP blocklist or auto-bans, and aggressive options default to off so you can opt in deliberately.<\/p><\/dd>\n<dt id=\"which%20settings%20could%20break%20my%20site%20if%20i%20enable%20them%20carelessly%3F\"><h3>Which settings could break my site if I enable them carelessly?<\/h3><\/dt>\n<dd><p>The ones the in-plugin guides call out: a custom login URL (save the new address first), an admin IP allowlist on a dynamic home connection, an enforced Content-Security-Policy, HSTS preload, and country blocking applied to the whole site rather than just the login. Each of those is explained in the help drawer on its own page.<\/p><\/dd>\n<dt id=\"does%20it%20work%20without%20gemsecurity%20pro%3F\"><h3>Does it work without GemSecurity Pro?<\/h3><\/dt>\n<dd><p>Yes. Everything described above works in the free plugin. Pro adds active threat protection, malware remediation and scale features.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.2.2 - 05\/11\/2026<\/h4>\n\n<ul>\n<li>Fixed - The admin-bar styles are now added through WordPress's style functions instead of a <code>&lt;style&gt;<\/code> tag printed in the page head.<\/li>\n<li>Changed - Updated the bundled StoreEngine SDK to 1.6.3. Its notices and license page now add their CSS and JS through WordPress's style and script functions.<\/li>\n<\/ul>\n\n<h4>1.2.1 - 03\/11\/2026<\/h4>\n\n<ul>\n<li>Fixed - Two-factor code checks are now handled one at a time per user, so several codes sent in parallel can no longer get extra guesses. A code is only accepted from the sign-in form itself, not from the address bar.<\/li>\n<li>Fixed - IP lists no longer treat a malformed range such as <code>1.2.3.4\/abc<\/code> as \"every address\". Ranges are checked when you save and when they are matched.<\/li>\n<li>Fixed - Alert webhooks (Slack and generic) must be http(s) addresses that are not on your own network or loopback, and are sent with WordPress's safe request function. The text of alert emails is now escaped, and the Telegram bot token is checked for the right format.<\/li>\n<li>Changed - Quarantine restore only puts back non-executable files in the uploads folder. PHP and other scripts, <code>.htaccess<\/code>, <code>.user.ini<\/code>, <code>web.config<\/code> and <code>php.ini<\/code> stay quarantined and must be reinstalled from their original source.<\/li>\n<li>Changed - Paths to WordPress core folders no longer rely on the <code>WPINC<\/code> and <code>WP_LANG_DIR<\/code> constants.<\/li>\n<li>Changed - Search terms in the Code &amp; database finder are limited to 500 characters.<\/li>\n<li>Changed - Every Temporary Access route now declares its own capability check.<\/li>\n<li>Added - The FAQ lists which files the plugin changes and when.<\/li>\n<\/ul>\n\n<h4>1.2.0 - 01\/11\/2026<\/h4>\n\n<ul>\n<li>Changed - Temporary Access now gives an existing user a role for a limited time and puts their previous role back when it ends. It no longer creates accounts or sign-in links.<\/li>\n<li>Changed - GemSecurity no longer writes to WordPress core, plugin, theme or must-use folders. Quarantine restores only to the uploads folder, and the core-file restore and chmod \"Fix\" buttons are gone; the core-file popup and permission audit remain read-only.<\/li>\n<li>Added - Magic Login: users can ask for a one-time sign-in link by email from the login form.<\/li>\n<li>Added - Plugin lock: a separate unlock password plus an emailed one-time code, not tied to any user account. It guards deactivating or deleting GemSecurity, turning the lock off and switching modules off, and while locked it blocks installing, uploading and editing code.<\/li>\n<li>Added - IP safelist: safelisted addresses are never blocked, banned or rate-limited, and your own IP is refused in the blocklist so you cannot lock yourself out.<\/li>\n<li>Added - A site-wide file upload switch on the Firewall page and in the admin bar. It blocks Media, REST, sideload and XML-RPC uploads.<\/li>\n<li>Added - Scanner: open a flagged WordPress core file to compare it line by line with the official WordPress.org copy (checksum-verified) and restore the original in one click. The replaced file is kept in quarantine.<\/li>\n<li>Added - Upload Shield bans the IP behind a refused executable upload (administrators and exempt IPs are spared), with a configurable ban length.<\/li>\n<li>Added - Security alerts and the ban list show where an IP is (city, region, country and network).<\/li>\n<li>Added - Alert emails include a \"Request origin\" table.<\/li>\n<li>Added - Two-Factor: an \"All roles\" option for enforced roles.<\/li>\n<li>Added - Social login buttons appear only after a provider's keys pass a check, either \"Test credentials\" or a new \"Verify with a sign-in\" round trip. Changing a key un-verifies it. A provider whose keys are rejected twice in a row is switched off and you are alerted. The Social Login page shows Verified, Not verified or Switched off for each provider.<\/li>\n<li>Added - A \"Plugin lock\" check in the security score.<\/li>\n<li>Fixed - The plugin lock did not stop GemSecurity Pro from being deleted while inactive (WordPress never checks the per-plugin delete capability).<\/li>\n<li>Changed - Magic links and social login now go through Admin Guard.<\/li>\n<li>Changed - The confirm step of magic links only works in the browser that opened the link, so another site cannot sign a visitor in to someone else's account.<\/li>\n<li>Changed - Quarantined files are now stored in the database and removed from disk, instead of being moved into the uploads folder. Files quarantined by earlier versions can still be restored.<\/li>\n<li>Changed - The 2FA encryption key is now kept in the database (or in <code>GEMSECURITY_SECRET_KEY<\/code> in wp-config.php, which is still preferred) instead of a key file. Key files created by earlier versions keep working.<\/li>\n<li>Changed - Plugin, must-use plugin, content and upload folders are always looked up through WordPress, so sites that move them are scanned correctly.<\/li>\n<li>Changed - IP location lookups use HTTPS only (ipapi.co).<\/li>\n<li>Changed - Rate limits (including magic link limits), lockouts, alert throttling and unlock codes are stored in the database, so they keep working on hosts with a broken object cache.<\/li>\n<li>Changed - Long scans are limited to 5 minutes instead of running without a time limit.<\/li>\n<li>Changed - Updated the bundled StoreEngine SDK to 1.6.2. Declining usage tracking now sends nothing, and no promotional notices are loaded.<\/li>\n<li>Changed - Every compiled JavaScript and CSS file names its source file and how to rebuild it.<\/li>\n<li>Fixed - \"Throttle 404 floods\" only logged the flood and never blocked it.<\/li>\n<li>Fixed - Unbanning an IP did not clear its strike count.<\/li>\n<li>Fixed - Permanent bans expired immediately.<\/li>\n<li>Fixed - The 2FA challenge signed out other sessions in the same browser. The challenge now runs before WordPress sets the login cookie.<\/li>\n<li>Fixed - Deleting an unapproved administrator caused PHP warnings from WordPress's new-user email.<\/li>\n<li>Fixed - The Cloudflare Turnstile \"Verify keys\" test never showed the widget.<\/li>\n<li>Fixed - The core-file REST route now checks capabilities on each method, and restoring needs the <code>update_core<\/code> capability.<\/li>\n<\/ul>\n\n<h4>1.1.0 - 19\/10\/2026<\/h4>\n\n<ul>\n<li>Added - Plugin Guard verifies every plugin against WordPress.org checksums with a trust list for premium, custom, theme and must-use plugins. With enforcement on, untrusted plugins are stopped before they load and deactivated, activation and non-.org installs are refused, unknown mu-plugins are quarantined, and a danger alert is sent. Runs from an early mu-plugin loader.<\/li>\n<li>Added - Install Lock blocks zip uploads, all installs, or every file modification for every account, with a logged 15-minute timed unlock.<\/li>\n<li>Added - Upload Shield (on by default) refuses executable files on every upload path, PHP hidden in images and scripted SVG, and writes uploads\/.htaccess deny rules with a live PHP-execution probe and an nginx snippet.<\/li>\n<li>Added - A first-run setup wizard (welcome, protection level, features, alerts, summary) opens once after a fresh activation and is reachable again from the topbar; pre-wizard installs are marked legacy.<\/li>\n<li>Added - The admin menu is grouped into Dashboard, Firewall, Login &amp; Access, Scanning, Logs &amp; Monitoring and Settings. The WordPress sidebar shows one entry per group; existing module URLs keep working.<\/li>\n<li>Added - The audit log records how every event arrived (admin, REST, REST via application password, XML-RPC, AJAX, WP-CLI, cron), the user agent, and a short login session id, via a new <code>gemsecurity\/log_args<\/code> filter.<\/li>\n<li>Added - Edits to live posts log a field-level diff (title, slug, content snippet, excerpt, author, date, parent, password, comments) and link the revision to compare or restore. New outbound links are listed and raise the event to warning.<\/li>\n<li>Added - SEO meta (title and description, canonical, robots, redirect, focus keyword), page template and featured image changes are logged. User creation, role changes (admin promotions at warning) and email or password changes are logged.<\/li>\n<li>Added - The Logs page lets you click a user to see everything they did, see the full history of a post, and expand a details row.<\/li>\n<li>Added - A public page picker for the custom login URL. Logged-out login, lost-password and register links on public pages point at the chosen public page (default: homepage) and the logout link at the homepage, so the secret address is no longer printed to visitors and bots. New filter <code>gemsecurity\/custom_login_public_url<\/code>.<\/li>\n<li>Added - Front-end login forms outside wp-login.php are redirected to the 2FA challenge instead of skipping it. REST endpoints that run their own challenge (such as Academy's <code>\/academy\/v1\/login<\/code>) can opt out via <code>gemsecurity\/2fa_challenge_routes<\/code> and <code>gemsecurity\/2fa_external_challenge<\/code>.<\/li>\n<li>Changed - 2FA seeds are sealed with AES-256-GCM. The key lives in <code>GEMSECURITY_SECRET_KEY<\/code> or a wp-content key file, not the database and not the WordPress salts, so salt rotation can no longer lock users out. Existing seeds are migrated on admin load.<\/li>\n<li>Changed - Password logins that cannot show the 2FA challenge (XML-RPC, HTTP basic auth, REST, AJAX popups) are refused for 2FA users; application passwords still work.<\/li>\n<li>Changed - Security headers are now added to REST responses, served before <code>send_headers<\/code> ever fires; endpoint-set headers are kept.<\/li>\n<li>Changed - Upload Shield's no-exec <code>.htaccess<\/code> now also covers wp-includes (core's wp-tinymce.php and ms-files.php stay allowed), languages and upgrade; removing it leaves other tools' rules byte-for-byte intact.<\/li>\n<li>Changed - Backups move back to the standalone GemBackup plugin. The Backup module, page, REST routes and tables are gone from GemSecurity. When GemBackup is active, the pre-update backup option, Incident Response roll back and the security score's recent-backup check are kept and link to GemBackup. Uninstall no longer drops backup tables, archives or GemBackup's cron events.<\/li>\n<li>Changed - Backup notification settings are removed from the Notifications page; they live in GemBackup's own settings.<\/li>\n<li>Changed - Finder (database and site scan) now searches the whole install (web root, core directories, every theme and stray folders) and more database tables.<\/li>\n<li>Changed - Admin UI adopts the GemCRM color system in light and dark, with border-only surfaces, 8px card radius and 4px buttons and inputs. Hard-coded semantic tints (alerts, badges, breach rows, danger buttons, threat items) use <code>color-mix()<\/code> on tokens so they follow both themes; brand gradients are replaced with solid brand blue.<\/li>\n<li>Fixed - A self-posting front-end login form has no referer, so the 2FA challenge used to send users to the dashboard; it now returns them to the requested URL.<\/li>\n<li>Fixed - <code>\/logs<\/code> never returned the user display name, so the log never showed who did anything (a by-reference loop over an <code>(array)<\/code> cast wrote to a copy).<\/li>\n<\/ul>\n\n<h4>1.0.0 - 28\/09\/2026<\/h4>\n\n<ul>\n<li>Added - CAPTCHA is its own module, with its own page, instead of a card under Login Security. Sites that already use CAPTCHA keep it after the update.<\/li>\n<li>Added - A Notifications page for alert recipients, Slack, Telegram and webhook delivery, and scheduled reports. These used to be on the Settings page.<\/li>\n<li>Added - A daily report email, off by default. It lists every administrator and active plugin, and calls out any that were added or removed since the last report.<\/li>\n<li>Added - An alert when GemSecurity is deactivated, by email and through Slack, Telegram or the webhook when alerts are on. With extended protection on, the mu-plugin also sends a warning when the plugin is switched off without being deactivated normally, for example by editing the database.<\/li>\n<li>Added - Admin Guard removes administrators who are not on the whitelist every hour, and again whenever the whitelist changes. The \"Check for unapproved admins\" button lists who would be removed before anything happens.<\/li>\n<li>Added - Forced password resets, by role. A reset ends every session for those users and emails each of them a WordPress reset link. It can run on demand, or on a schedule for passwords older than a set number of days.<\/li>\n<li>Added - Test buttons for third-party settings, run before you save: CAPTCHA keys (with the real widget), social login app keys, Slack, Telegram, webhook, SIEM, alert email addresses, and the outside services the scanner and geolocation rely on.<\/li>\n<li>Added - The Scanner checks .htaccess files for rules that allow PHP to run or redirect visitors. A malicious file can be quarantined in one click and restored from Incident Response. The site's root .htaccess is reported for hand-editing instead, because it holds the permalink rules.<\/li>\n<li>Added - A file you have reviewed can be marked safe in the Scanner. If the file changes later, it is reported again. Empty \"Silence is golden\" index.php files are no longer reported.<\/li>\n<li>Added - Every item under \"What needs your attention\" on the dashboard links to the page where it is fixed.<\/li>\n<li>Added - A guide for every module in a help drawer, and setup guides beside the fields that need keys from another service.<\/li>\n<li>Added - Social login buttons can ask for a role for new accounts, and the <code>gemsecurity\/social_login\/role_registered<\/code> action fires after such an account is created.<\/li>\n<li>Changed - Each setting now lives on one page. The WAF rules, rate limiting, 404 throttling and bad-bot switches moved to the Firewall page (they were on the Pro-only Threat Defense page), the audit log switches to the Logs page, and the backup settings to the Backup page. Features that existed twice, such as the comment honeypot, the application password switch, quarantine and force logout, are now one. Your settings are carried over on update.<\/li>\n<li>Changed - All emails use one HTML template, and each subject names the site and its domain.<\/li>\n<li>Changed - With a custom login URL, a logged-out visit to wp-admin goes to the home page. If you are locked out, adding <code>define( 'GEMSECURITY_DISABLE_CUSTOM_LOGIN', true );<\/code> to wp-config.php turns the custom login URL off.<\/li>\n<li>Changed - A wrong CAPTCHA secret key no longer locks everyone out of the login form. Verification is skipped and the problem is logged as critical until the key is fixed.<\/li>\n<li>Changed - The Virtual Patch list is titled \"Shields currently active\" and no longer shows red severity badges, so it does not read as a list of problems.<\/li>\n<li>Changed - The StoreEngine license SDK is updated to 1.5.6. It now ships only in GemSecurity, and GemSecurity Pro uses this copy.<\/li>\n<li>Fixed - With a custom login URL, visiting wp-admin while logged out redirected to the secret login address.<\/li>\n<li>Fixed - A custom login URL with spaces or capitals was previewed as one address and served at another. A URL that became empty after cleaning left the switch on while wp-login.php stayed open.<\/li>\n<li>Fixed - A custom login URL broke two-factor and social login sign-ins.<\/li>\n<li>Fixed - A correct two-factor code could send the user back to the login form, and a correct emailed code could be reported as invalid, on hosts whose object cache is not shared between requests. Emailed codes are now limited to five attempts.<\/li>\n<li>Fixed - A failed social login always said \"Sign-in could not be verified\". It now gives the real reason, including the provider's own error.<\/li>\n<li>Fixed - Twitter\/X sign-in stopped working after X retired its twitter.com sign-in addresses, and the credential test reported correct Twitter\/X keys as wrong.<\/li>\n<li>Fixed - The CAPTCHA key test could fail with reCAPTCHA because the widget was drawn before Google's script was ready.<\/li>\n<li>Fixed - Alerts were never emailed, only sent to Slack, Telegram and the webhook.<\/li>\n<li>Fixed - An administrator who was not on the Admin Guard whitelist could still sign in if the account was created outside WordPress's normal user screens.<\/li>\n<li>Fixed - The Scanner reported WordPress core files as malware. After a core update, it showed every core file as modified until the next scan, and it did not scan again after the update when the daily scan was off.<\/li>\n<li>Fixed - Warnings alone could drop the security score to F.<\/li>\n<li>Fixed - Opening the Scanner page froze the admin, so no other menu item could be opened.<\/li>\n<li>Fixed - On a new site, the backup settings showed switches that are on by default as off, and saving that screen would have turned off the snapshot taken before a restore.<\/li>\n<li>Fixed - Switching a module on or off needed a page reload before the menu changed.<\/li>\n<li>Fixed - Virtual Patch, Payment Integrity, Incident Response and Monitoring appeared unlocked without GemSecurity Pro.<\/li>\n<li>Fixed - WordPress 6.7 and later logged a notice on every request because translations were loaded too early.<\/li>\n<\/ul>\n\n<h4>1.0-beta1 - 13\/08\/2026<\/h4>\n\n<p>First public beta. GemSecurity is an all-in-one, registry-driven security suite with a single-page React dashboard, live security score and a toggleable module manager.<\/p>\n\n<ul>\n<li>Added - Firewall &amp; WAF: SQLi\/XSS\/LFI\/RCE request inspection, IP blocklist (CIDR), request rate limiting, 404-flood throttling, bad-bot and AI-crawler blocking, search-bot verification.<\/li>\n<li>Added - Hardening: disable XML-RPC \/ file editor \/ author &amp; REST user enumeration, hide WP version, application-password governance, and security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, CSP).<\/li>\n<li>Added - Login Security: brute-force lockouts, session limits &amp; idle timeout, password policy, custom login URL, admin-login email alerts, magic-link and lockdown.<\/li>\n<li>Added - Two-Factor Authentication: app-based TOTP, email OTP and one-time backup codes with per-role enforcement; login CAPTCHA (reCAPTCHA v2\/v3, hCaptcha, Cloudflare Turnstile).<\/li>\n<li>Added - Social Login: OAuth sign-in with Google, Facebook, GitHub and Twitter\/X.<\/li>\n<li>Added - Admin Guard: rogue-admin auto-remediation, administrator whitelist and hidden-admin detection.<\/li>\n<li>Added - API &amp; Access hardening: REST API rate limiting, application-password max-age, username-enumeration and generic-login-error protection.<\/li>\n<li>Added - Anti-Spam: frictionless bot checks on comments and registration with heuristic filtering.<\/li>\n<li>Added - Scanner: WordPress core file-integrity checks against official checksums, uploads malware\/PHP-pattern scan, file-change detection, link scanning, and known-vulnerability scanning for core\/plugins\/themes.<\/li>\n<li>Added - Activity Logs &amp; real-time Alerts with retention and CSV export.<\/li>\n<li>Added - Backups (these moved to the standalone GemBackup plugin in 1.1.0 and are no longer part of GemSecurity).<\/li>\n<li>Added - Module manager with a live security score and one-page dashboard.<\/li>\n<\/ul>\n\n<p>Active threat defense, virtual patching, geolocation access control, payment-integrity monitoring, incident response, uptime\/TLS monitoring, signature malware remediation &amp; quarantine, database-injection scan, file integrity vs WordPress.org, recovery toolkit, and cloud backup storage with encryption &amp; migration are available in GemSecurity Pro.<\/p>","raw_excerpt":"WordPress security with firewall, malware scanner, 2FA, social login, reCAPTCHA, hCaptcha, Turnstile and activity log in one lightweight plugin.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/393651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=393651"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/kodezen"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=393651"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=393651"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=393651"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=393651"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=393651"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=393651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}