Title: WPG Shield – Security Firewall Author: Rakesh Raja Published: November 7, 2026 Last modified: November 7, 2026 --- Search plugins ![](https://ps.w.org/wpg-shield-security-firewall/assets/banner-772x250.png?rev= 3789144) ![](https://ps.w.org/wpg-shield-security-firewall/assets/icon-256x256.png?rev=3789144) # WPG Shield – Security Firewall By [Rakesh Raja](https://profiles.wordpress.org/rakeshraja/) [Download](https://downloads.wordpress.org/plugin/wpg-shield-security-firewall.0.1.5.zip) * [Details](https://wordpress.org/plugins/wpg-shield-security-firewall/#description) * [Reviews](https://wordpress.org/plugins/wpg-shield-security-firewall/#reviews) * [Installation](https://wordpress.org/plugins/wpg-shield-security-firewall/#installation) * [Development](https://wordpress.org/plugins/wpg-shield-security-firewall/#developers) [Support](https://wordpress.org/support/plugin/wpg-shield-security-firewall/) ## Description WPG Shield hardens a WordPress site in layers, and then proves each layer is actually working instead of assuming it is. Most security plugins tell you a setting is on. WPG Shield asks the site whether the setting is doing anything. The Server Armor module writes your rules, then probes the live site over HTTP for the exposures those rules are meant to close: a downloadable wp-config.php, readable backups and logs, directory listing, REST and author user enumeration, and xmlrpc. If a host ignores the file, you see it instead of believing you are protected. #### What it does **Firewall (WAF)** Inspects query strings, form bodies and REST JSON for injection and traversal payloads. It runs after WordPress has loaded, so it is not a replacement for a server-level firewall. It deliberately ships in log-only mode first, because a blocking rule that has never been observed against real traffic is how firewalls get uninstalled. Content routes such as the editor, admin-ajax and REST are inspected for injection classes only, so markup you legitimately post is not treated as an attack. REST bodies are read from the request WordPress has already parsed, so saving a post is not interrupted. **Login Fortress** Rate limits and locks out repeated failed logins, and adds real TOTP two-factor authentication (RFC 6238, the same standard Google Authenticator and Authy use). Codes are verified with a drift window, and an accepted code cannot be replayed. **Malware Scanner** Signature and heuristic scanning for webshells, obfuscated payloads and PHP files in the uploads directory. Matches are reported with the file path and signal. Nothing is moved or deleted automatically, so a false positive cannot break the site. **Server Armor** Generates hardened server rules for both Apache and nginx, and checks the live site for the exposures those rules are meant to close rather than trusting that the file is honoured. Rules are written dual-stack so an older Apache or a host without ` mod_authz_core` cannot be turned into a 500 error by the hardening itself. **Config Doctor** Audits wp-config.php and can apply hardening constants for you. Every write is transactional: a timestamped backup is taken first, the result is re-read and verified afterwards, and the original is restored if verification fails. **Integrity Monitor** Baselines your files and reports anything that changes, so you learn about a modified file from your dashboard rather than from your host. Email alerts go to the administrator you choose on the plugin Dashboard, and you tick exactly which alert types are emailed. Only Administrator accounts are offered, the choice is re-validated at send time, and unticked alert types are never sent. **Rogue Admin Guard** Stops privilege escalation to administrator from an unconfirmed session, and asks for a password confirmation before the change is allowed through. **File Guard, Headers, User Policy and Plugin Health Watch** File Guard reports sensitive files and folder permissions that are exposed to the web. Headers sends hardened security headers. User Policy turns off open registration, blocks reserved usernames, stops a user from granting capabilities they do not already hold, and keeps new accounts on a safe default role. Plugin Health Watch flags plugins that are no longer listed on WordPress.org or have gone stale; it does not query a vulnerability database. #### Who this plugin is for Site owners, developers and agencies who manage WordPress sites for clients and need to know that hardening is genuinely in place, not merely switched on. If you are looking for a WordPress firewall, a malware scanner, brute force login protection, two factor authentication, or a way to harden wp-config.php and block user enumeration, this plugin covers all of those in one place. Every module can be enabled on its own, and every module defaults to the least disruptive setting. #### Design principles * **Verify, do not assume.** Hardening that cannot be proven is reported as unverified. * **Nothing destructive by default.** The scanner never deletes or moves files. Uninstall removes settings and logs unless you switch on “keep data on uninstall” first. * **Log before you block.** New rules are observed before they are allowed to reject traffic. * **Portable across stacks.** Apache and nginx are both first-class, because a rule that only works on one host is not a fix. ### External services This plugin does not send data to the author. Integrity Monitor is off by default. When you enable that module and turn on “Verify WordPress core against official checksums”, it requests official WordPress core checksums from `https://api.wordpress.org/core/checksums/1.0/`. The request includes the WordPress version and locale. It does not include account data. Activation never contacts this endpoint. WordPress.org privacy policy: https://wordpress.org/about/ privacy/ Plugin Health Watch does nothing until you opt in on its settings screen. After that it queries `https://api.wordpress.org/plugins/info/1.2/` with the slugs of installed plugins, in batches, to see whether they are listed and when they were last updated. It is an abandonment/staleness check only; it does not query a vulnerability database. It does not send usernames, emails or the site’s content. Server Armor and the dashboard probes request this site’s own URLs (the homepage, login, and a few well-known paths) so a rule is only reported as working when the web server actually enforces it. Those requests stay on your server. ## Screenshots [⌊Dashboard with the live probe results and the status of each protection layer.⌉⌊ Dashboard with the live probe results and the status of each protection layer.⌉[ Dashboard with the live probe results and the status of each protection layer. [⌊Security log with firewall matches recorded from real requests.⌉⌊Security log with firewall matches recorded from real requests.⌉[ Security log with firewall matches recorded from real requests. [⌊Server Armor with the detected server stack and the generated rules.⌉⌊Server Armor with the detected server stack and the generated rules.⌉[ Server Armor with the detected server stack and the generated rules. [⌊Config Doctor auditing the hardening constants in wp-config.php.⌉⌊Config Doctor auditing the hardening constants in wp-config.php.⌉[ Config Doctor auditing the hardening constants in wp-config.php. [⌊Login Fortress with the lockout policy and two-factor coverage.⌉⌊Login Fortress with the lockout policy and two-factor coverage.⌉[ Login Fortress with the lockout policy and two-factor coverage. [⌊File Guard reporting sensitive files and folder permissions.⌉⌊File Guard reporting sensitive files and folder permissions.⌉[ File Guard reporting sensitive files and folder permissions. ## Installation 1. Upload the `wpg-shield-security-firewall` folder to `/wp-content/plugins/`, or install it through Plugins > Add New. 2. Activate the plugin through the Plugins screen in WordPress. 3. Open **WPG Shield** in the admin menu and work through the modules. 4. Start the Firewall in log mode, review what it reports, then switch it to blocking when you are satisfied there are no false positives. ## FAQ ### Does this plugin replace a hosting firewall? No. WPG Shield protects the WordPress layer: requests that reach PHP, the login screen, uploads and admin actions. A web host firewall or a CDN such as Cloudflare protects the network layer in front of that. The two work well together. ### How do I protect my WordPress login from brute force attacks? Login Fortress adds failed-login rate limiting with account lockout, hides the login error messages attackers use to discover valid usernames, blocks user enumeration through the `?author=` parameter, and adds full two-factor authentication. The firewall also inspects login requests for injection payloads. ### Can I add two factor authentication to my WordPress login? Yes. Login Fortress implements RFC 6238 TOTP with HMAC-SHA1, a 30 second period and 6 digit codes, which is the standard Google Authenticator, Authy, 1Password and Microsoft Authenticator use. Codes are accepted with a one-step drift window for clock differences, and each accepted code is burned so it cannot be replayed. ### How do I scan my WordPress site for malware and webshells? Malware Scanner checks WordPress files and the uploads directory for webshells, obfuscated PHP payloads, base64 and gzip decode chains, hidden code markers, and PHP files sitting where PHP files should not be. Matched files are reported with the signal that matched; nothing is moved or deleted, so a false positive cannot take the site down. ### How do I block user enumeration on my WordPress site? Server Armor blocks numeric `?author=` requests from unauthenticated visitors, and Login Fortress hides the “incorrect username or password” error so an attacker cannot tell a valid username from an invalid one. ### Will the WordPress firewall break my site? Not by default. The firewall starts in log mode, so it records what it would block without blocking it. Review every match and switch to blocking mode only when you are satisfied there are no false positives. Routes that legitimately carry HTML, such as the editor and REST API, are exempt from markup patterns but still checked for injection. ### Does it work on nginx as well as Apache? Yes. It detects your server stack and generates the correct rules for each. This matters because nginx does not read `.htaccess` at all. WPG Shield also probes the live site for exposed config files and backups, directory listing and user enumeration, so a rule the server ignores is reported as unverified instead of a green tick. ### Is it safe to let a plugin edit wp-config.php? That is why the write is transactional. WPG Shield takes a timestamped backup first, writes the change, re-reads the file to confirm it still parses and contains the expected block, and restores the original automatically if it does not. It also refuses to touch any file that does not look like a real wp-config.php. ### Does the malware scanner delete or move files? No. Matches are reported only, with the file path and the signal that matched. Review each finding and clean it manually through your host or file manager. Nothing is deleted or moved automatically, so a false positive cannot break the site. ### Where are wp-config and .htaccess backups stored? Inside `wp-content/uploads/wpg-shield-security-firewall/`, resolved at runtime with` wp_upload_dir()` and named after the plugin slug. They are not written beside `wp- config.php`, because a copy there can be downloaded as plain text, and they are not written into `wp-content` directly. The folder carries an `.htaccess` deny rule, an empty `index.html` and a matching nginx `deny all` rule for hosts that ignore`. htaccess`. The plugin writes no PHP file anywhere. ### Is the two-factor authentication compatible with my authenticator app? Yes. It implements RFC 6238 TOTP with HMAC-SHA1, a 30 second period and 6 digits, which is what Google Authenticator, Authy, 1Password and Microsoft Authenticator all use. ### Can I turn off individual modules? Yes. Every module has its own switch. Disabled modules are not even loaded, so they cost nothing. ### Does uninstalling delete my data? Yes. Uninstall removes settings, the log table and related options. Turn on “keep data on uninstall” first if you are restoring a backup and want that history kept. The malware scanner never moved or deleted any file, so there is nothing to restore. ### Will this work on a multisite network? Yes. Activation provisions each site on the network, and uninstall cleans up every site. ### Who receives the security alert emails? Only accounts with the Administrator role can receive security alerts. Pick the recipient on the plugin Dashboard under “Notifications”. Every alert the plugin sends uses that one address, and you tick which types you want: files changed unexpectedly, suspicious code found, brute-force lockout, a new login from an unknown IP, administrator changes and blocked privilege escalation, or a protection check that started failing. Unticked types are never emailed. The plugin re-checks that the chosen account is still an administrator on every send; if it has been demoted or deleted, alerts fall back to the site administration email and the change is written to the security log. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “WPG Shield – Security Firewall” is open source software. The following people have contributed to this plugin. Contributors * [ Rakesh Raja ](https://profiles.wordpress.org/rakeshraja/) [Translate “WPG Shield – Security Firewall” into your language.](https://translate.wordpress.org/projects/wp-plugins/wpg-shield-security-firewall) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/wpg-shield-security-firewall/), check out the [SVN repository](https://plugins.svn.wordpress.org/wpg-shield-security-firewall/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/wpg-shield-security-firewall/) by [RSS](https://plugins.trac.wordpress.org/log/wpg-shield-security-firewall/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.1.5 * Fixed the fatal parse error on PHP 7.4 that stopped File Guard loading after activation on the Recommended preset. * Vulnerability Watch is now Plugin Health Watch and says plainly what it does: it checks WordPress.org listing status and last-update age only, and does not query a vulnerability database. * wp-config and .htaccess backups moved into a protected folder inside `uploads`, created with `wp_upload_dir()`. The plugin no longer writes into `wp-content` directly and no longer creates a PHP file as a directory guard. * The mu-plugin companion is gone. Rogue Admin Guard is a normal module; it no longer writes executable code into `mu-plugins`. * The uploads PHP check is read-only. It no longer writes a test `.php` file into uploads. * File and directory checks use `WP_CONTENT_DIR`-independent helpers (`content_dir()`,` plugins_dir()`, `uploads_dir()`), so custom content directories work. * The nginx snippet derives the Ajax path with `admin_url( 'admin-ajax.php' )` instead of hardcoding `wp-admin/admin-ajax.php`. * Firewall request data is unslashed before inspection; module saves are sanitized before the schema pass. * Removed a duplicate File Guard cron registration that ran the file scan twice per day. #### 0.1.4 * Admin notices are scoped to the screens where they matter (plugin screen, profile screen, Plugins/Updates screens and the dashboard) instead of every admin page, and the block notice clears once the security log has been viewed. Addresses Guideline 11. * New Dashboard “Notifications” panel: one recipient plus per-type checkboxes for every alert the plugin can send (files changed, suspicious code, brute-force lockout, new login IP, administrator changes, failed protection check). Only Administrator accounts are listed, the value is validated on save, the recipient is re-checked on every send, and an unticked alert type is never emailed. * Plugin URI and Author URI are now different live URLs. #### 0.1.3 * Listing title and text domain now match `wpg-shield-security-firewall`. * Plugin URI points to a live URL. * Integrity Monitor core checksum requests are opt-in; activation no longer contacts api.wordpress.org. * Malware scanner is report-only: it never moves executable code or creates a quarantine directory. * File and directory checks resolve paths with WordPress functions instead of hardcoded wp-content paths. #### 0.1.2 * Firewall no longer reads the raw request body, so REST and block-editor saves keep their JSON. REST payloads are inspected after WordPress parses them. * wp-config and .htaccess backups are stored in a protected folder, away from ` wp-config.php`. * Login lockout starts again after the lockout window, instead of locking again on the next failure. * nginx IP restriction no longer replaces the PHP location. * Two-factor pending login is kept in an HttpOnly cookie instead of the URL. * Malware quarantine is off until you turn it on, and even then only request-execution signatures can move a file. Ordinary plugin code is reported and left in place. Scans read a bounded slice of each file. #### 0.1.1 * Login Fortress: real RFC 6238 TOTP verification with drift window and replay protection. * Firewall: request bodies and REST JSON are inspected, and the admin exemption can no longer be spoofed with a query argument. * Server Armor: dual-stack rule generation with live HTTP enforcement probes. * Malware: quarantine never deletes, and core files are refused. * Config Doctor: transactional wp-config.php writes with backup, verification and rollback. #### 0.1.0 * Initial release with firewall, login fortress, malware scanner, server armor, integrity monitoring, file guard, security headers, user policy and plugin health watch. ## Meta * Version **0.1.5** * Last updated **4 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [firewall](https://wordpress.org/plugins/tags/firewall/)[hardening](https://wordpress.org/plugins/tags/hardening/) [malware scanner](https://wordpress.org/plugins/tags/malware-scanner/)[security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/wpg-shield-security-firewall/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/wpg-shield-security-firewall/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/wpg-shield-security-firewall/reviews/) ## Contributors * [ Rakesh Raja ](https://profiles.wordpress.org/rakeshraja/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/wpg-shield-security-firewall/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://wpguru.in/)