Diamond Sierra Site Defense checks your site once a day and tells you \u2013 in plain English \u2013 what is wrong and how to fix it. Everything below is free, with no account to sign up for, and no firewall rules held back for paying users.<\/p>\n\n
Daily malware scan<\/strong><\/p>\n\n Fixes<\/strong><\/p>\n\n Firewall<\/strong><\/p>\n\n Login protection<\/strong><\/p>\n\n Email alerts<\/strong><\/p>\n\n Hardening<\/strong><\/p>\n\n Also<\/strong><\/p>\n\n Diamond Sierra Site Defense Pro<\/strong><\/p>\n\n An optional add-on for people who clean hacked sites or look after many: one-click database cleanup, \"Fix automatically\", the post-hack recovery kit, protection against stolen login cookies, supply-chain and WooCommerce checkout watches, CVE matching, an alert centre with Slack\/Discord, an activity log and white-labelling. Everything listed above stays free. Details at diamondsierra.com<\/a><\/p>\n\n Diamond Sierra Site Defense connects to these services. Apart from the WordPress.org checks, each one is off until you turn it on.<\/p>\n\n The daily scan uses WP-Cron. On low-traffic sites, a real cron job calling The blocklist check is off by default. To use it, turn on Settings \u2192 Malware scanner \u2192 Google blocklist check<\/strong> and either paste a free Safe Browsing API key from Google Cloud (recommended, it's Google's official API) or tick Check without a key<\/strong> to read the public status from Google's Transparency Report instead.<\/p><\/dd>\n Pick X-Forwarded-For<\/strong>. Site Defense reads that header from the right and takes the first public address, so a visitor can't fake their IP by sending the header themselves. Behind Cloudflare, pick Cloudflare<\/strong> instead.<\/p><\/dd>\n nginx ignores .htaccess files. Add this to your server block:<\/p>\n\n Click Ignore<\/strong>. It stays hidden until that file or content changes.<\/p><\/dd>\n Yes. Run only one firewall \u2013 by default Site Defense steps aside and lets the other plugin handle the firewall and login limits, while it keeps scanning and cleaning. If you'd rather use Site Defense's firewall, switch the other plugin's firewall off and untick \"Step aside for other security plugins\" in Settings.<\/p><\/dd>\n Untick Disable XML-RPC<\/strong> in Settings.<\/p><\/dd>\n With WP-CLI: Type one of your backup codes instead of the 6-digit code. No backup codes? Ask another administrator to click Turn off<\/strong> under Two-factor login on your user profile, run New installs spend their first week in log-only mode so you can spot false alarms \u2013 a contact form or plugin that legitimately sends code-like text. Check the Firewall tab, then click Start blocking now<\/strong>, or wait and it starts on its own.<\/p><\/dd>\n Add No. On a network, renaming the login page would break sign-on across sites, so the feature turns itself off there automatically.<\/p><\/dd>\n Yes \u2013 network-activate it. The firewall, login protection, two-factor login, Turnstile and the activity log protect every site. The scanner, cleanup tools and settings live in the main site's dashboard and are for super admins only, because they work on files shared by the whole network. Settings apply to all sites.<\/p><\/dd>\n Yes. Filters and actions include \n
import()<\/code> calls in files and on the live homepage.<\/li>\n\n
\n
\n
\n
\n
\n
wp site-defense unblock<\/code>, reset-login-url<\/code>, 2fa-reset<\/code>).<\/li>\n<\/ul>\n\nExternal services<\/h3>\n\n
\n
Privacy<\/h3>\n\n
\n
\n
\/wp-content\/plugins\/<\/code> or install the zip from Plugins \u2192 Add New.<\/li>\nwp-cron.php<\/code> every 5 minutes makes sure it always runs on time.<\/p>\n\n\n\n
Do I need a Google API key for the blocklist check?<\/h3><\/dt>\n
My site is behind a load balancer. Which IP setting do I use?<\/h3><\/dt>\n
I use nginx \u2013 is the uploads protection active?<\/h3><\/dt>\n
location ~* \/wp-content\/uploads\/.*\\.php$ { deny all; }\n<\/code><\/pre><\/dd>\nA finding is a false positive. What do I do?<\/h3><\/dt>\n
Can I use it with Wordfence or All-In-One Security?<\/h3><\/dt>\n
I use Jetpack \/ the mobile app<\/h3><\/dt>\n
I locked myself out by the firewall<\/h3><\/dt>\n
wp site-defense unblock <your-ip><\/code>. Without it, add define( 'DSSD_DISABLE_FIREWALL', true );<\/code> to wp-config.php, log in, add your IP under Settings \u2192 Never block these IPs<\/strong>, then remove the line again.<\/p><\/dd>\nI lost my phone and can't get past two-factor login<\/h3><\/dt>\n
wp site-defense 2fa-reset <your-user><\/code>, or add define( 'DSSD_DISABLE_2FA', true );<\/code> to wp-config.php, log in, set it up again, then remove the line.<\/p><\/dd>\nWhy does the firewall say \"Would block (log only)\"?<\/h3><\/dt>\n
I set a custom login URL and can't find it<\/h3><\/dt>\n
define( 'DSSD_DISABLE_LOGIN_URL', true );<\/code> to wp-config.php. wp-login.php works normally again straight away. Log in, check or clear the URL under Settings \u2192 Login protection<\/strong>, then remove the line.<\/p><\/dd>\nDoes the custom login URL work on multisite?<\/h3><\/dt>\n
Does Site Defense work on multisite?<\/h3><\/dt>\n
Can I extend it?<\/h3><\/dt>\n
dssd_signatures<\/code>, dssd_firewall_rules<\/code>, dssd_scan_recurrence<\/code>, dssd_settings_defaults<\/code>, dssd_settings_sanitize<\/code>, dssd_settings_cards<\/code>, dssd_admin_tabs<\/code>, dssd_render_tab_{tab}<\/code>, dssd_brand_name<\/code>, dssd_menu_label<\/code>, dssd_show_branding<\/code>, dssd_import_allowlist<\/code>, dssd_allow_xmlrpc<\/code> and dssd_loaded<\/code>.<\/p><\/dd>\n\n<\/dl>\n\n\n1.0.0<\/h4>\n\n
\n