Title: FPX Security Guard Author: freepdftxt Published: 12 กรกฎาคม 2026 Last modified: 17 กันยายน 2026 --- Search plugins ![](https://ps.w.org/fpx-security-guard/assets/banner-772x250.png?rev=3698839) ![](https://ps.w.org/fpx-security-guard/assets/icon-256x256.png?rev=3698839) # FPX Security Guard By [freepdftxt](https://profiles.wordpress.org/mamuniu06/) [Download](https://downloads.wordpress.org/plugin/fpx-security-guard.1.4.1.zip) * [Details](https://th.wordpress.org/plugins/fpx-security-guard/#description) * [Reviews](https://th.wordpress.org/plugins/fpx-security-guard/#reviews) * [Installation](https://th.wordpress.org/plugins/fpx-security-guard/#installation) * [Development](https://th.wordpress.org/plugins/fpx-security-guard/#developers) [Support](https://wordpress.org/support/plugin/fpx-security-guard/) ## Description FPX Security Guard closes the openings attackers actually use, and does it without sending your site’s data anywhere. There is no account to create and no cloud dashboard: everything runs on your own server. **What it does** * **Login protection** — limits failed login attempts per IP with a configurable lockout, shows generic errors that leak no hint about which half of the login was wrong, and hides a honeypot field that silently blocks bots. * **Two-factor authentication** — standard TOTP (Google Authenticator, Authy, 1Password and the rest). Users turn it on from their own profile, scan a QR code, and get ten one-time recovery codes. Works entirely offline. * **Firewall** — blocks SQL injection, XSS, path traversal and RCE patterns in the URL, POST body and cookies, plus known scanner tools and direct requests for sensitive files like .env, .git and wp-config.php. * **Rate limiting** — slows down request floods from a single address. * **Security headers** — X-Frame-Options, nosniff, Referrer-Policy, Permissions- Policy, and HSTS on HTTPS. * **CAPTCHA** — optional reCAPTCHA v2 or hCaptcha on the login and comment forms, using your own key pair. * **Hardening** — turns off XML-RPC and the built-in theme/plugin file editor, removes the WordPress version from your pages, and blocks ?author=N enumeration and the public REST users endpoint. * **Comment protection** — honeypot and link limits. * **IP allow and deny lists** — trust or block specific addresses and IPv4 ranges. Allowed addresses bypass every other rule. * **Reverse-proxy support** — if your site sits behind Cloudflare or a load balancer, tell the plugin, and per-IP blocking acts on the visitor’s real address instead of the proxy’s. The settings screen shows you the address it currently sees so you can confirm it. * **Overview** — a checklist where each gap explains what it costs you and, where possible, is fixed with one click, next to a running count of what was actually blocked over the last seven days. On first use, one button switches on the settings suited to a typical site. It deliberately skips anything that could lock you out or interrupt publishing. ### Upgrading to Pro The free plugin keeps attackers out. Pro adds the tools for finding out whether anyone already got in, and for dealing with it: a malware scanner with one-click quarantine, core file integrity checking against WordPress.org’s own checksums, a vulnerability scanner, scheduled scans with email alerts, live traffic monitoring, behavioural threat scoring, country blocking, AbuseIPDB reputation checks, auto- ban, a session manager, an activity log, new-device login alerts, a custom login URL, and an emergency lockdown button that expires on a timer so it can never strand you. Details at https://wp.freepdftxt.com/security-guard/ ### External Services This plugin uses a few optional external services, all disabled unless you explicitly turn them on: **Geo Blocking** (disabled by default) uses the free geo-location service ip-api. com to determine the country of a visitor’s IP address. * **What is sent:** Only the visitor’s IP address, and only when Geo Blocking is manually enabled and a visitor’s country isn’t already cached. * **When:** On the first request from a given IP; the result is cached locally for 24 hours. Service provider: ip-api.com — Terms: https://ip-api.com/docs/legal — Privacy: https:// ip-api.com/docs/legal **Cloud Threat Intelligence** (disabled by default, and inactive until you supply your own API key) checks a visitor’s IP address against AbuseIPDB’s abuse-confidence database. * **What is sent:** Only the visitor’s IP address, sent together with your own AbuseIPDB API key, and only when you’ve entered a key and a visitor’s IP isn’t already cached. * **When:** On the first request from a given IP; the result is cached locally for 24 hours. Service provider: AbuseIPDB — Terms: https://www.abuseipdb.com/legal — Privacy: https://www.abuseipdb.com/legal **Malware Scanner’s VirusTotal cross-check** (disabled by default, and inactive until you supply your own API key) looks up a file’s SHA-256 hash on VirusTotal — a hash, not the file itself. * **What is sent:** Only a SHA-256 hash (a one-way fingerprint that cannot be reversed into the original file) of files already flagged by the local scanner, plus a small sample (up to 15) of recently-modified files, sent together with your own VirusTotal API key. * **When:** Only during a malware scan (manual or scheduled) with this feature enabled and a key configured. * Your actual file content is never uploaded or transmitted anywhere. Service provider: VirusTotal (a Google subsidiary) — Terms: https://support.virustotal. com/hc/en-us/articles/115002145529-Terms-of-Service — Privacy: https://support.virustotal. com/hc/en-us/articles/115002168385-Privacy-Policy **Vulnerability Scanner** and **Core File Integrity Check** read WordPress’s own built-in update-check data and, when you run a scan, query the same official api. wordpress.org endpoints WordPress core itself already uses (the same request the“ Check Again” button on the Updates screen makes, and the public core-checksums endpoint). No plugin-specific data is sent beyond what WordPress core itself already sends for update checks. **CAPTCHA** (disabled by default, and inactive until you choose a provider and enter both keys) shows a bot challenge on the login and/or comment form using either Google reCAPTCHA v2 or hCaptcha, and verifies the response server-side with that provider. * **What is sent:** The visitor’s CAPTCHA response token and IP address, sent to whichever provider (Google or hCaptcha) you’ve configured, only on form submission. * **When:** Only when a visitor submits the login or comment form with CAPTCHA enabled for that form. Service providers: Google reCAPTCHA — Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy · hCaptcha — Terms: https://www.hcaptcha. com/terms — Privacy: https://www.hcaptcha.com/privacy If none of the above features are enabled, the plugin makes no external requests whatsoever. ## Installation 1. Upload the `fpx-security-guard-pro` folder to `/wp-content/plugins/`, or upload the zip via Plugins Add New Upload Plugin. 2. Activate the plugin through the Plugins menu. 3. Configure options under Settings FPX Security Guard. ## FAQ ### I enabled Custom Login URL and now I can’t find my login page. Your new login address is whatever you set as the “Login Slug” under Settings — e.g. yoursite.com/your-slug/. It’s shown right on the settings page once enabled. If you forget it entirely, add `define( 'FPXSG_LOGIN_BYPASS', true );` to wp-config. php to restore normal wp-login.php access, log in, check the slug under Settings, then remove the line. ### I enabled Emergency Lockdown and now I can’t get back in. Three rescue paths, in order of ease: 1. **wp-login.php always works** — the lockdown never blocks the login page itself, so sign in as an administrator and it will let you straight through. 2. **It expires automatically** — every lockdown has a maximum duration (set when you enabled it, up to 72 hours) and turns itself off. 3. **Server access (site owners)** — add this line to your wp-config.php file: `define(' FPXSG_LOCKDOWN_BYPASS', true );` — this immediately lifts the lockdown for everyone. Remove the line once you’re back in. ### I’m locked out of two-factor authentication. How do I get back in? There are three rescue paths, in order of ease: 1. **Recovery codes** — enter one of your saved one-time recovery codes in the Authentication Code field on the login screen. 2. **Ask an administrator** — any admin can open Users your profile and reset your 2FA with one click. You can then log in with just your password and set 2FA up again. 3. **Server access (site owners)** — add this line to your wp-config.php file: `define(' ISG_DISABLE_2FA', true );` — this temporarily bypasses 2FA for all logins. Log in, reset your 2FA from your profile, then REMOVE the line again. Because it requires file access, only someone who controls the server can use it. ### Will this conflict with other security plugins? Avoid running multiple firewall/login-limit plugins at once — features may overlap. ### I use Jetpack or a mobile app to publish. Disable the “Disable XML-RPC” option in settings. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “FPX Security Guard” is open source software. The following people have contributed to this plugin. Contributors * [ freepdftxt ](https://profiles.wordpress.org/mamuniu06/) [Translate “FPX Security Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/fpx-security-guard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/fpx-security-guard/), check out the [SVN repository](https://plugins.svn.wordpress.org/fpx-security-guard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/fpx-security-guard/) by [RSS](https://plugins.trac.wordpress.org/log/fpx-security-guard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.4.1 * Fixed: the admin screen loaded without its stylesheet on some installs. * Fixed: the “See pricing” link pointed at a page that no longer exists. * Changed: clearer notice when an older 1.0.x copy of the plugin is still active. #### 1.4.0 * New: reverse-proxy support. On a site behind Cloudflare or a load balancer, every visitor previously appeared to share the proxy’s IP address, which quietly broke rate limiting, lockouts, auto-ban and geo blocking. Settings “How visitors reach your site” now shows the address the plugin currently sees, so you can confirm it at a glance. Forwarded headers are only trusted once you opt in, and for Cloudflare only when the request genuinely arrives from Cloudflare’s network. * New: first-run setup. One button applies the settings suited to a typical site, skipping anything that could lock you out. * New: the Overview tab now reports what was actually blocked over the last seven days, and every failing check explains the consequence and offers a one-click fix instead of just a red cross. * New: Live Traffic can log errors only, and has a hard ceiling on stored rows so a flood cannot fill your database between hourly cleanups. * Changed: redesigned the admin screens — grouped settings, switch controls, and a sticky save bar. * Changed: “AI Threat Detection” is now “Behavioural Threat Scoring”. The feature is unchanged; the old name overstated what it does. #### 1.3.2 * Live Traffic Monitor: redesigned again in a clean, light modern style (icon-badged stat cards, indigo accent, proper toggle switch, refined table) that fits naturally into wp-admin instead of a dark floating panel. #### 1.3.1 * Live Traffic Monitor: redesigned as a dark “security console” dashboard — live stats strip (unique IPs, error count, logged-in hits), instant filter box, colored status/method badges, country flag emoji, and animated incoming rows. * Security: sensitive query-string values (license keys, passwords, tokens, API keys) are now masked before being stored in — or displayed from — the traffic log. #### 1.3.0 * Malware Scanner: expanded pattern list (more webshell signatures, hex/chr obfuscation, dynamic call-from-request, downloader patterns). * Malware Scanner: optional VirusTotal cross-check — hashes (never file content) of flagged findings and a small sample of recently-modified files are checked against VirusTotal’s antivirus engines. #### 1.2.0 * New: Custom Login URL — hides wp-login.php behind a secret slug. * New: IP Whitelist / Blacklist — trusted IPs bypass all blocking; blacklisted IPs are denied immediately. * New: Auto-Ban Repeat Offenders — automatically bans IPs that repeatedly trip other blocking features. * New: Activity Log — audit trail of settings, user/role, plugin/theme changes, and logins. * New: Core File Integrity Check — verifies core files against official WordPress. org checksums. * New: Security Score Dashboard — one-glance checklist of your site’s security posture (now the default landing tab). * New: Login Notification Emails — optional email on every login, not just new devices. * New: CAPTCHA — optional reCAPTCHA v2 / hCaptcha on login and/or comment forms. #### 1.1.0 * New: Malware Scanner — flags PHP-executable files in uploads and backdoor/obfuscation patterns in plugins/themes, with one-click quarantine. * New: Vulnerability Scanner — checks core/plugin/theme versions, PHP version, debug output, HTTPS, and other hardening gaps. * New: Scheduled Scan — runs both scanners automatically (daily/weekly) with email alerts. * New: Geo Blocking — Country Block now supports an allow-list mode, in addition to block-list. * New: Live Traffic Monitor — real-time request log in wp-admin. * New: AI Threat Detection — local heuristic risk scoring for suspicious requests. * New: Device Fingerprinting — email alert on a never-seen-before login device. * New: Cloud Threat Intelligence — optional AbuseIPDB integration with your own API key. * New: Session Manager — view and force-end active login sessions per user. * New: Emergency Lockdown — one-click, auto-expiring site lockdown with a wp-config. php escape hatch. * Settings page reorganized into tabs: Settings, Malware Scanner, Vulnerability Scanner, Live Traffic, Threat Log, Sessions, Emergency Lockdown. #### 1.0.0 * Initial release. * Login protection: per-IP attempt limits, lockouts, honeypot, generic error messages. * Two-Factor Authentication (TOTP): QR-code setup, recovery codes, low-code warnings, works offline. * DDoS/flood protection via per-IP rate limiting. * Firewall: malicious query blocking and modern security headers. * Country blocking (optional, via ip-api.com with local caching). * Comment spam protection: honeypot and link limits. * Daily critical-file change detection with admin and email alerts. * Hardening: XML-RPC off, file editor off, version hiding, user-enumeration blocking. * Bundled QRCode.js by davidshimjs (MIT license, GPL-compatible) for local QR rendering. ## Meta * Version **1.4.1** * Last updated **1 สัปดาห์ ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.0.6** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/fpx-security-guard/) * Tags * [Brute Force](https://th.wordpress.org/plugins/tags/brute-force/)[firewall](https://th.wordpress.org/plugins/tags/firewall/) [login protection](https://th.wordpress.org/plugins/tags/login-protection/)[malware scan](https://th.wordpress.org/plugins/tags/malware-scan/) [security](https://th.wordpress.org/plugins/tags/security/) * [Advanced View](https://th.wordpress.org/plugins/fpx-security-guard/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/fpx-security-guard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/fpx-security-guard/reviews/) ## Contributors * [ freepdftxt ](https://profiles.wordpress.org/mamuniu06/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/fpx-security-guard/)