Title: WordSec – Malware Scanner & Removal, Web Application Firewall (WAF), and 2FA Author: WordSec Published: 16 กรกฎาคม 2026 Last modified: 1 สิงหาคม 2026 --- Search plugins ![](https://ps.w.org/wordsec/assets/banner-772x250.png?rev=3610464) ![](https://ps.w.org/wordsec/assets/icon-256x256.png?rev=3610464) # WordSec – Malware Scanner & Removal, Web Application Firewall (WAF), and 2FA By [WordSec](https://profiles.wordpress.org/wordsec/) [Download](https://downloads.wordpress.org/plugin/wordsec.1.1.0.zip) * [Details](https://th.wordpress.org/plugins/wordsec/#description) * [Reviews](https://th.wordpress.org/plugins/wordsec/#reviews) * [Installation](https://th.wordpress.org/plugins/wordsec/#installation) * [Development](https://th.wordpress.org/plugins/wordsec/#developers) [Support](https://wordpress.org/support/plugin/wordsec/) ## Description WordSec is a complete WordPress security plugin. Eight modules cover the firewall, malware scanner, login security, live traffic, IP and country blocking, supply-chain intelligence, audit log and alerts, so you block attacks and harden your site from one dashboard instead of installing eight plugins. If your site gets hacked you do not just lose the site. You lose customer trust, your search rankings, and days of work restoring backups. WordSec is built to stop that before it happens, and to help you recover if it already has: the scanner finds the malware, quarantine takes it out of the way, and modified core, plugin and theme files are repaired from their original copies. **Free, and no license key to enter.** WAF firewall rules, malware and file-integrity scanning, brute force protection, two factor authentication, IP and country blocking, the audit log and one-click hardening all run locally on your own server. #### Web Application Firewall (WAF) * Custom rule builder with regex and wildcard matching * Built-in rules for SQL injection, XSS, path traversal, PHP and command injection * Learning and active modes, bot blocking, security headers, rate limiting * 25+ hardening toggles for wp-config access, author enumeration and REST API * Optional Extended Protection: pre-WordPress request inspection (opt-in, fully reversible) #### Malware Scanner and Removal * Malware detection rules across files, the database and scheduled tasks * Core, plugin and theme file-integrity verification via the WordPress.org API * Scheduled scans, one-click quarantine and restore * Malware removal on a hacked site: quarantine a finding, or repair a modified core, plugin or theme file from its original copy #### Login Security, Two-Factor Authentication (2FA) and Brute Force Protection * Role-based two-factor authentication (RFC 6238 TOTP) * reCAPTCHA, hCaptcha and Cloudflare Turnstile, plus a built-in math CAPTCHA * Brute-force protection with progressive lockout, honeypot and login URL rename * Leaked-password checking, session management, custom login page #### Live Traffic * Real-time request logging with bot detection and CSV export * Exclusion filtering by role, IP, country or URI #### IP and Country Blocking * Country and continent allow or block lists * IP and CIDR blocking, temporary or permanent, with allow-list support #### Supply Chain and Threat Intelligence * Reputation scoring and abandoned-plugin detection * Known-vulnerability alerts for core, plugins, themes and PHP * Update-integrity verification with backups and an SBOM inventory #### Audit Log * Activity tracking across 11 object types and 14 actions #### Alarms * 36 alert event types delivered by Email, Telegram or Slack Every feature runs locally with no license key. Optionally, the WordSec service at wordsec.net supplies threat-intelligence data that cannot be produced locally: managed WAF rule sets, the malware signature feed, IP-reputation lists, the GeoIP database and vulnerability records. Connecting is optional and every external service is documented in “External services” below. ### External services WordSec is designed to run locally, and with no license key it makes no outbound requests to the WordSec service. Core request filtering and file scanning run on your server. The services listed below are contacted only for the specific features described, and most of them only when you explicitly enable that feature (or, for the WordSec API, only after you activate a license key). This section documents every third-party service the plugin can connect to and the data each one receives. #### WordSec API (api.wordsec.net) WordSec runs free without a license, in which case it does not contact this service at all. A free license is available to everyone; once you activate a key the plugin communicates with the WordSec service for two distinct purposes: 1. Required service calls (only while a license key is active): license activation and validation, and threat-data updates (firewall rules, malware signatures, IP reputation lists, GeoIP data, the disposable-email domain list and known-vulnerability data). These enable the cloud-backed features and cannot be performed locally; with no key, none of these calls are made. The local enforcement code for these features (the WAF engine, the malware scanner, the IP-blocking filters and the signup-restriction filter) is always present and active; without an up-to-date feed it simply has no threat-intelligence data to check requests against. * When: on activation/validation and on scheduled threat-data update checks. * Data sent: your site URL and license key (used to authenticate you and bind the license to this site) and, for update checks, the current versions of your installed threat-data feeds. 1. Optional usage/environment telemetry (OPT-IN, OFF by default): an anonymous once- daily snapshot used to improve WordSec. It is only sent after you explicitly enable“ Share usage & environment data” (at license activation or in Settings Advanced Usage Data) and can be turned off again at any time. * When: once daily, only while the opt-in is enabled. * Data sent: a non-personal snapshot of the site environment (server, WordPress, PHP and database versions, the list of active plugins and themes) and aggregate WordSec feature-usage and security statistics. No passwords, database credentials, secret keys or e-mail addresses are ever sent. * Terms of Service: https://wordsec.net/terms * Privacy Policy: https://wordsec.net/privacy #### Have I Been Pwned (api.pwnedpasswords.com) Used by the optional leaked-password check to detect whether a password appears in known data breaches, using k-anonymity. * When: when a user sets or submits a password and the leaked-password check is enabled. * Data sent: only the first 5 characters of the SHA-1 hash of the password. The password itself and its full hash never leave your site. * Terms & Privacy: https://haveibeenpwned.com/Privacy #### WordPress.org API (api.wordpress.org, downloads.wordpress.org, wordpress.org, core.svn.wordpress.org, plugins.svn.wordpress.org, themes.svn.wordpress.org) Used to verify WordPress core, plugin and theme file integrity, to look up public plugin/theme information (plugins_api/themes_api) for the supply-chain reputation scores and update-integrity checks, to download WordSec’s own translation language pack from translate.wordpress.org when you pick a Display Language that is not installed yet (the same mechanism WordPress itself uses when the site language changes), and— only when you click “Repair” on a scanner finding — to download the original copy of a modified core/plugin/theme file so it can be restored. Repair downloads fetch single original files from plugins.svn.wordpress.org / themes.svn.wordpress.org / core.svn.wordpress.org, falling back to full packages from downloads.wordpress.org( plugin/theme zips) and wordpress.org (core release zips). * When: during malware/ integrity scans and supply-chain reputation checks, on an explicit repair action, and when you save a Display Language whose translation is not installed yet. * Data sent: the WordPress core version, site locale, and the slugs/versions of the plugins/ themes being checked; for a language download, the plugin slug/version and the chosen locale. * Terms & Privacy: https://wordpress.org/about/privacy/ #### RDAP (rdap.org) Used by the WHOIS/RDAP lookup tool on the Tools page to show ownership information for an IP address or domain you inspect. * When: only when you run the WHOIS/RDAP lookup tool. * Data sent: the IP address or domain you chose to look up. * Terms& Privacy: https://about.rdap.org/ #### ipify (api.ipify.org) Used by the Tools page blacklist checker and the server-info tool to determine your server’s own public IP address. * When: only when you run the “Blacklist Check” or “Server IPs” tool. * Data sent: a plain request from your server; no site data is included (the service simply echoes the requesting IP). * Terms & Privacy: https:// www.ipify.org/ #### DNS blocklist providers (Blacklist Check tool) The Tools page “Blacklist Check” queries DNS-based blocklists (DNSBLs) to tell you whether your server’s public IPv4 address is listed. Each provider receives a standard DNS query containing your server’s IP address in reversed form. Five providers are queried: * Spamhaus ZEN (zen.spamhaus.org) – https://www.spamhaus.org/privacy-notice/* SpamCop (bl.spamcop.net), operated by Cisco – https://www.cisco.com/c/en/us/about/ legal/privacy-full.html * Barracuda Reputation Block List (b.barracudacentral.org)– https://www.barracuda.com/company/legal/privacy-policy * UCEPROTECT Level 1 (dnsbl- 1.uceprotect.net) – https://www.uceprotect.net/en/index.php * PSBL (psbl.surriel. com) – https://psbl.org/ Details: * When: only when you click “Blacklist Check” on the Tools page. * Data sent: your server’s public IPv4 address, embedded in each DNS blocklist query. #### Telegram Bot API (api.telegram.org) Optional alarm delivery channel. Active only when you configure your own Telegram bot token and chat ID. * When: when a security alarm you enabled fires and Telegram delivery is configured. * Data sent: the alarm message text (event type, site name, relevant IP/user context) to the bot/chat you configured. * Terms of Service: https:// telegram.org/tos * Privacy Policy: https://telegram.org/privacy #### Slack Incoming Webhooks (hooks.slack.com) Optional alarm delivery channel. Active only when you configure your own Slack incoming- webhook URL. * When: when a security alarm you enabled fires and Slack delivery is configured. * Data sent: the alarm message text (event type, site name, relevant IP/user context) to the webhook you configured. * Terms of Service: https://slack. com/terms-of-service * Privacy Policy: https://slack.com/privacy-policy #### Google reCAPTCHA (www.google.com, www.gstatic.com) Optional login/registration CAPTCHA. Active only when you select reCAPTCHA and provide your own keys. * When: on login and registration forms while enabled. * Loaded remotely: reCAPTCHA requires its widget script (www.google.com/recaptcha/api.js, served with assets from www.gstatic.com) to be loaded from Google in the visitor’s browser; it is enqueued only on those forms and only while reCAPTCHA is the selected provider. Token verification is a server-side call from your site to www.google. com. * Data sent: the CAPTCHA response token, your public site key, and the visitor’s IP address. * Terms of Service: https://policies.google.com/terms * Privacy Policy: https://policies.google.com/privacy #### hCaptcha (hcaptcha.com, js.hcaptcha.com) Optional login/registration CAPTCHA. Active only when you select hCaptcha and provide your own keys. * When: on login and registration forms while enabled. * Loaded remotely: hCaptcha requires its widget script (js.hcaptcha.com/1/api.js) to be loaded from hCaptcha in the visitor’s browser; it is enqueued only on those forms and only while hCaptcha is the selected provider. Token verification is a server-side call from your site to hcaptcha.com. * Data sent: the CAPTCHA response token, your public site key, and the visitor’s IP address. * Terms of Service: https://www.hcaptcha. com/terms * Privacy Policy: https://www.hcaptcha.com/privacy #### Cloudflare Turnstile (challenges.cloudflare.com) Optional login/registration CAPTCHA. Active only when you select Turnstile and provide your own keys. * When: on login and registration forms while enabled. * Loaded remotely: Turnstile requires its widget script (challenges.cloudflare.com/turnstile/ v0/api.js) to be loaded from Cloudflare in the visitor’s browser; it is enqueued only on those forms and only while Turnstile is the selected provider. Token verification is a server-side call from your site to challenges.cloudflare.com. * Data sent: the CAPTCHA response token, your public site key, and the visitor’s IP address. * Terms of Service: https://www.cloudflare.com/website-terms/ * Privacy Policy: https:// www.cloudflare.com/privacypolicy/ #### ipwhois.io (ipwho.is) Optional IP details service, disabled by default. All requests go over HTTPS with certificate verification, and none are made until you enable “External IP Lookup Service” in WordSec Settings (Visitor IP Handling section). It is used for exactly one thing: the “IP details” lookup in Live Traffic (country, region, city, ISP, organization, ASN). Traffic logging never contacts this service; country resolution during logging uses only the local GeoIP database. * When: only while the External IP Lookup Service opt-in is enabled, and only on your click in the IP details lookup.* Data sent: the IP address you chose to inspect. * Terms of Service: https://ipwhois. io/terms * Privacy Policy: https://ipwhois.io/privacy #### VirusTotal (virustotal.com) Not contacted automatically. The scanner shows a “Check on VirusTotal” link you can click to open VirusTotal in your browser for a given file. * When: only when you click the link. * Data sent: the file hash contained in the link URL. * Terms& Privacy: https://docs.virustotal.com/docs/privacy-policy #### Qualys SSL Labs (ssllabs.com) Not contacted automatically. The Tools page “Check SSL Health” test runs entirely on your own server (it opens a TLS connection to your own domain and reads the certificate). Next to it, a “Deep Scan (SSL Labs)” link opens the Qualys SSL Labs test in a new browser tab; SSL Labs then connects to your site from the outside and grades its TLS configuration. The link carries the “hide results” flag, so the report is not published on the SSL Labs public board. * When: only when you click the “Deep Scan( SSL Labs)” link. * Data sent: your site’s domain name, contained in the link URL.* Terms: https://www.ssllabs.com/about/terms.html * Privacy: https://www.qualys.com/ company/privacy/ ### Credits WordSec bundles the third-party libraries listed below. Every library is distributed under a license compatible with WordSec’s own “GPLv2 or later” license. Each bundled library keeps its in-file license banner and/or its upstream license file, and the full original (unminified) source for each is available at the linked project and version. #### PHP libraries (`vendor/`) TCPDF 6.11.3 * License: LGPL-3.0-or-later * Copyright: Nicola Asuni, Tecnick.com LTD * Source: https://github.com/tecnickcom/TCPDF * License file: `vendor/tecnickcom/ tcpdf/LICENSE.TXT` * Used for: PDF report/export generation SimpleXLSXGen 1.5.x * License: MIT * Copyright: (c) 2020-2022 Sergey Shuchkin * Source: https://github.com/shuchkin/simplexlsxgen * License file: `vendor/shuchkin/ simplexlsxgen/LICENSE` * Used for: XLSX (Excel) export #### JavaScript / CSS libraries (`assets/*/vendor/`) Select2 4.1.0-rc.0 * License: MIT * Copyright: Kevin Brown, Igor Vaynberg, and the Select2 contributors * Source: https://github.com/select2/select2 * License text: https://github.com/select2/select2/blob/master/LICENSE.md * Bundled files:` assets/js/vendor/select2.min.js`, `assets/css/vendor/select2.min.css` ApexCharts 5.16.0 * License: MIT * Copyright: (c) 2018-2026 ApexCharts * Source: https://github.com/apexcharts/apexcharts.js * License text: https://github.com/apexcharts/ apexcharts.js/blob/main/LICENSE * Bundled files: `assets/js/vendor/apexcharts.min. js` jsVectorMap 1.7.0 * License: MIT * Copyright: (c) Mustafa Omar and the jsVectorMap contributors * Source: https://github.com/themustafaomar/jsvectormap * License text: https://github.com/themustafaomar/jsvectormap/blob/master/LICENSE * Bundled files:` assets/js/vendor/jsvectormap.min.js`, `assets/css/vendor/jsvectormap.min.css` * Used for: world map visualizations (Live Traffic / Blocking / Firewall) World map data (world_mill), registered as the jsVectorMap “world” map * License: MIT * Copyright: jvectormap-content contributors; map geometry derived from Natural Earth (public domain) * Source: https://www.npmjs.com/package/jvectormap-content* Bundled files: `assets/js/vendor/world.js` * Used for: the country geometry rendered by the world map visualizations above qrcode-generator 1.4.4 * License: MIT * Copyright: Kazuhiko Arase * Source: https:// github.com/kazuhikoarase/qrcode-generator * License text: https://github.com/kazuhikoarase/ qrcode-generator/blob/master/LICENSE * Bundled files: `assets/js/vendor/qrcode.min. js` #### Icons / assets flag-icons (country flag SVGs) * License: MIT (SVG markup); the flag designs themselves are in the public domain * Copyright: (c) 2013 Panayiotis Lipiridis * Source: https:// github.com/lipis/flag-icons * License text: https://github.com/lipis/flag-icons/ blob/main/LICENSE * Bundled files: `assets/images/flags/*.svg` (country flags, 4 ×3 `viewBox="0 0 640 480"`) ## Screenshots [⌊Web Application Firewall: inspect every request, build multi-condition custom rules, and review detailed firewall logs.⌉⌊Web Application Firewall: inspect every request, build multi-condition custom rules, and review detailed firewall logs.⌉[ Web Application Firewall: inspect every request, build multi-condition custom rules, and review detailed firewall logs. [⌊Malware & Integrity Scanner: a seven-stage scan across files, database and scheduled tasks, with quarantine and restore.⌉⌊Malware & Integrity Scanner: a seven-stage scan across files, database and scheduled tasks, with quarantine and restore.⌉[ Malware & Integrity Scanner: a seven-stage scan across files, database and scheduled tasks, with quarantine and restore. [⌊Login Security: role-based two-factor authentication, multiple CAPTCHA providers, and brute-force protection.⌉⌊Login Security: role-based two-factor authentication, multiple CAPTCHA providers, and brute-force protection.⌉[ Login Security: role-based two-factor authentication, multiple CAPTCHA providers, and brute-force protection. [⌊Live Traffic Monitor: real-time traffic with historical replay and safe request inspection.⌉⌊Live Traffic Monitor: real-time traffic with historical replay and safe request inspection.⌉[ Live Traffic Monitor: real-time traffic with historical replay and safe request inspection. [⌊IP & Geo Blocking: country and continent lists, IP and CIDR blocking, and rate limiting.⌉⌊IP & Geo Blocking: country and continent lists, IP and CIDR blocking, and rate limiting.⌉[ IP & Geo Blocking: country and continent lists, IP and CIDR blocking, and rate limiting. [⌊Plugin & Theme Intelligence: reputation scoring, vulnerability alerts, and update- integrity checks.⌉⌊Plugin & Theme Intelligence: reputation scoring, vulnerability alerts, and update-integrity checks.⌉[ Plugin & Theme Intelligence: reputation scoring, vulnerability alerts, and update- integrity checks. [⌊Audit Log: complete activity tracking across object types and actions.⌉⌊Audit Log: complete activity tracking across object types and actions.⌉[ Audit Log: complete activity tracking across object types and actions. [⌊Real-Time Security Alerts: 36 event types delivered by email, Telegram or Slack.⌉⌊ Real-Time Security Alerts: 36 event types delivered by email, Telegram or Slack.⌉[ Real-Time Security Alerts: 36 event types delivered by email, Telegram or Slack. ## Installation 1. Upload the plugin files to `/wp-content/plugins/wordsec/`, or install through the WordPress **Plugins** screen. 2. Activate the plugin through the **Plugins** screen in WordPress. 3. Open the **WordSec** menu to start configuring. Activation only creates the plugin’s database tables, default settings and its own data directory. WordSec never modifies .htaccess, .user.ini or wp-config.php, changes file permissions, or installs the pre-WordPress WAF bootstrap without an explicit, clearly-labelled action from you, and deactivation reverts every such change. ## FAQ ### Does WordSec slow down my site? No. WordSec is built around minimal database queries, batch processing and smart caching so protection does not come at the cost of performance. ### Do I need a license key to use WordSec? No. WordSec installs and runs as a fully functional free plugin with local protection: the web application firewall (your own custom rules plus the built-in preset rules), brute-force and login protection, two-factor authentication, hardening, geo-blocking configuration, the audit log and more all work without any key. ### Does it require any external service? No, not to run. WordSec’s core protection runs locally on your server, and with no license key it contacts no external WordSec service at all. ### Can WordSec help with malware removal on a hacked site? Yes. The security scanner examines your files, the database and scheduled tasks, and every finding can be quarantined with one click. A modified WordPress core, plugin or theme file can also be repaired straight from its original copy on WordPress. org, and the scan history keeps a record of everything that was found and changed. ### Does WordSec include brute force protection? Yes. Failed logins are rate limited with progressive lockout, so each further attempt from the same source waits longer. You can also add a honeypot field, rename the login URL, require a CAPTCHA on the login form, and restrict logins by IP, country or time of day. ### Does WordSec support two factor authentication? Yes. Two factor authentication uses RFC 6238 TOTP codes from any standard authenticator app, and you choose which roles have to use it. For the case where a device is lost and nobody can get in, a WORDSEC_DISABLE_2FA constant in wp-config.php provides emergency access. ### What does the web application firewall actually block? The built-in rule sets cover SQL injection, cross-site scripting, path traversal, and PHP and command injection. You can add your own rules with a multi-condition builder, run the firewall in learning mode before you enforce anything, and optionally enable Extended Protection so requests are inspected before WordPress loads. ### Can I run WordSec next to another security plugin? You can, but it is not recommended. Two firewalls inspecting the same request, or two scanners walking the same files, cost you performance and produce duplicate alerts. WordSec is built to own site security end to end, so the usual path is to deactivate the others first. ### What are the minimum requirements? WordPress 6.9+, PHP 7.4+, and MySQL 5.6+ / MariaDB 10.1+. ## Reviews ![](https://secure.gravatar.com/avatar/3377be941e3c41f8608e0a86140d11f7c2cb834ac60cbcf614f4625c0b5c12e0? s=60&d=retro&r=g) ### 󠀁[Reliable and Easy to Use](https://wordpress.org/support/topic/reliable-and-easy-to-use-41/)󠁿 [yazgac](https://profiles.wordpress.org/yazgac/) 26 กรกฎาคม 2026 I’ve been using Wordfence, and it has been one of the most reliable security plugins for my WordPress sites. Easy to set up, excellent protection, and regular updates. Highly recommended! Thank you… ![](https://secure.gravatar.com/avatar/c70a7a4675298a8bb3209104e3077d9035de56e484445f08f847f28db88785ed? s=60&d=retro&r=g) ### 󠀁[Excellent Security Plugin That Helped Protect My Site](https://wordpress.org/support/topic/excellent-security-plugin-that-helped-protect-my-site/)󠁿 [ymcdev](https://profiles.wordpress.org/ymcdev/) 23 กรกฎาคม 2026 I’ve tried several WordPress security plugins over the years, but WordSec has honestly been one of the best experiences so far. After the recent wp2shell vulnerability was disclosed, I tested my website with and without WordSec installed. During my testing, anonymous REST API access was blocked, preventing my site from being exposed to the same attack surface. I still updated WordPress immediately, but it was reassuring to see WordSec providing an additional layer of protection against emerging threats. Beyond that, I really like the overall feature set. Protection against SQL injection, remote code execution attempts, brute force attacks, malicious file uploads, and XML-RPC abuse gives me confidence that my sites are well protected. The firewall rules work out of the box, and I didn’t have to spend hours configuring everything. Another big advantage is performance. Unlike some security plugins that noticeably slow down WordPress, WordSec is lightweight and has had virtually no impact on my site’s speed. If you’re looking for a modern, lightweight, and reliable WordPress security plugin that focuses on practical protection instead of unnecessary complexity, I highly recommend WordSec. Great work by the developer. Looking forward to future updates! [ Read all 2 reviews ](https://wordpress.org/support/plugin/wordsec/reviews/) ## Contributors & Developers “WordSec – Malware Scanner & Removal, Web Application Firewall (WAF), and 2FA” is open source software. The following people have contributed to this plugin. Contributors * [ WordSec ](https://profiles.wordpress.org/wordsec/) “WordSec – Malware Scanner & Removal, Web Application Firewall (WAF), and 2FA” has been translated into 5 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/wordsec/contributors) for their contributions. [Translate “WordSec – Malware Scanner & Removal, Web Application Firewall (WAF), and 2FA” into your language.](https://translate.wordpress.org/projects/wp-plugins/wordsec) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/wordsec/), check out the [SVN repository](https://plugins.svn.wordpress.org/wordsec/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/wordsec/) by [RSS](https://plugins.trac.wordpress.org/log/wordsec/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 * Fixed: Uninstalling the plugin with a data-removal option and later reinstalling it could permanently lock two-factor authentication users out of the login, because the stored 2FA secrets survived the uninstall while their encryption key did not. Uninstall now removes the plugin’s per-user data together with the key, and the “keep only the license key” option preserves the key material the stored license needs. * Fixed: Uninstall left cached entries and the GeoIP/quarantine folders behind; everything under uploads/wordsec is now removed unless “keep everything” is selected. #### 1.0.10 * Changed: The optional ipwhois.io service is now contacted only when you open the “IP details” window in Live Traffic. Traffic logging never calls it anymore, so background visits can no longer spend the monthly lookup quota and leave the IP details window reporting “Rate limit exceeded”. * Changed: The Live Traffic log no longer stores a per-request city, and the unused city database column is removed. City is still shown in the IP details window. * Fixed: The Blocked IP Address table loaded 25 rows after a page refresh even though 10 per page was selected. The rows-per-page choice, sorting and current page are now remembered like the other log tables, and the Clear button returns the time range to All. * Fixed: Sorting the Alarm Log or Firewall Log table could flip the column arrow to the opposite of the order actually applied. #### 1.0.9 * Fixed: On sites where WordPress is installed in a subdirectory, Login URL Rename left no way in: the custom login address returned a 404 while wp-login.php and wp-admin stayed blocked. The custom address now works, and so do the /login, / admin and /dashboard shortcuts. * Fixed: “Block Sensitive Files Access” blocked legitimate media library downloads(. zip, .sql, .log and similar) on subdirectory installations, because the exception for the uploads folder did not match. The exception now follows the real uploads location. * Fixed: The Blackhole trap never triggered on subdirectory installations, and a request carrying a query string slipped past it everywhere. * Fixed: The login IP and country whitelist did not cover a renamed login page on subdirectory installations. * Fixed: Plugin and theme enumeration blocking did not run on subdirectory installations when the request reached PHP. * Fixed: The Nginx and IIS rule examples shown for servers that ignore .htaccess now include the installation path, so they match on subdirectory installations. * Fixed: An invalid custom login slug was silently replaced instead of reported, and on a site that had no slug yet it could become a predictable default. The value is now rejected with a message and the previous slug is kept. * Fixed: When a stored two-factor secret could no longer be decrypted (for example after a security key rotation), login was refused even with the correct password and turning two-factor authentication off did not help. The 2FA toggle now fully disables the check, and a WORDSEC_DISABLE_2FA constant in wp-config.php provides emergency access. * Fixed: “Hide Login Errors” no longer replaces two-factor and site-state error messages with the generic “credentials incorrect” text; only credential errors are masked. * Improved: Two-factor secrets stored in older encryption formats are now re-encrypted to the current format in the background, so a future security key rotation can no longer invalidate them. #### 1.0.8 * Fixed: File Permission Hardening could make a site unreachable. It set the root. htaccess to mode 0440, which takes away read access for the web server on hosting panels where the web server runs as a different user than the file owner (Plesk, cPanel and similar). Apache then answered every request with 403 and logged “ AH00529 pcfg_openfile: unable to check htaccess file”. The root .htaccess is now set to 0644 so the web server can always read it, while wp-config.php still becomes read-only at 0440. Affected sites are repaired automatically the next time an admin page is opened with the option enabled. * Fixed: The malware scanner recommended the same 0440 mode for the root .htaccess, so Fix All (and scheduled scans with automatic fixing) could re-apply it. The scanner now expects 0644 and reports a .htaccess the web server cannot read as an issue instead. * Fixed: The Tools file permission check listed 0440 as the recommended mode for. htaccess and now recommends 0644. * Fixed: The security score no longer expects the .htaccess file to be unreadable by the web server; only group or world write access counts against the score. #### 1.0.7 * Fixed: “Prevent User Enumeration” no longer blocks ordinary author pages. Only ID-based probes (such as /?author=1, which WordPress resolves into a username) are blocked; a visitor opening a known author archive like /author/name/ is served normally. The REST users endpoint and the users sitemap stay closed as before. * Fixed: The scanner’s “View matched content” dialog showed its content box in white while dark mode was active. * Improved: The block page shown to blocked visitors carries the WordSec wordmark with a “WordPress Security Plugin” line beneath it. * Improved: The block screen rendered by Extended Protection (the pre-WordPress firewall) is now identical to the one WordPress serves, instead of a near-copy with an extra error code and reference line. * Fixed: Uninstalling with “keep only the license key” now also keeps this site’s identifier, so reinstalling reuses the existing license binding instead of registering the site a second time. #### 1.0.6 * New: The scanner now reports unexpected extra files inside WordPress.org-hosted plugin and theme folders (files that are not part of the official release). Such files are a common hiding spot for dropped payloads that match no malware signature. Findings support quarantine and are covered by Fix All. * Improved: Plugin and theme file repair now fetches the single original file directly from WordPress.org SVN (the same channel core repairs already use) instead of downloading and extracting the whole plugin/theme zip; the zip package remains as an automatic fallback. * Fixed: Plugin and theme repair could report “the plugin may not be hosted on WordPress.org” for plugins that ARE hosted there, because the zip extraction step ran without an initialized WordPress filesystem. * Fixed: Default themes bundled with WordPress (e.g. Twenty Twenty-Five) no longer produce false “Changed Theme File” findings. WordPress ships its own builds of these themes that can differ byte-for-byte from the theme-directory release of the same version; files matching the official core checksums are now recognized as genuine. * Improved: The Scan History table shows a full severity breakdown (total, critical, high, medium, low, info) when hovering the Issues Found column. #### 1.0.5 * Fixed: The malware scanner no longer flags WordSec’s own unmodified files. Files that byte-match the official WordPress.org release checksums for the installed WordSec version are excluded from signature matching; a modified or unknown file still fails the checksum and is scanned normally. #### 1.0.4 * New: Setup wizard. First activation now opens a guided, step-by-step setup: pick a Recommended, Standard or fully Custom configuration for the firewall, login security, blocking and settings, configure CAPTCHA, two-factor authentication, login URL rename and alarm delivery channels, and finish with the license step. Every data-sharing and server-file change is disclosed before it is applied, and the wizard can be re-run anytime from Settings. * New: Choosing what happens to your data on uninstall (keep everything, keep only the license key, or delete everything) is now offered in a dialog when deactivating the plugin, in addition to the existing Settings control. * Improved: Malware scanner detection and performance. * Improved: Visual refinements across the admin interface. * Fixed: Known issues reported since 1.0.3. #### 1.0.3 * WordPress 6.9 is now the minimum supported version. * The pre-WordPress WAF bootstrap (“Extended Protection”) is no longer installed on activation. It is an explicit opt-in on the Firewall page that lists every server change it makes, and disabling it (or deactivating the plugin) reverts them all. * Hardening features that write to .htaccess, .user.ini or wp-config.php, change file permissions or delete files now default to off, and each toggle’s description states exactly what it writes. * Deactivation now restores the original wp-config.php debug constants and original file permissions, and removes every file and directive the plugin added; uninstall re-runs this cleanup as a safety net. * IP geolocation fallback and the Live Traffic IP-details lookup switched from ip-api.com to ipwhois.io, always over HTTPS with certificate verification, and every request is now gated behind a new default-off “External IP Lookup Service” opt-in (Settings Visitor IP Handling). * Supply-chain reputation scores now work fully without a license key: public wordpress. org plugin/theme data is fetched directly when the service mirror is not available. * The Live Traffic IP-details dialog shows the local request statistics (totals, blocked count, threat level) even while external lookups are disabled. * Settings page reorganized: Usage Data moved to the top, the language and interface options merged into one Admin Interface card, and the Visitor IP section renamed to Visitor IP Handling. * Tools page descriptions now name the external services each tool contacts (api. ipify.org, rdap.org, and the DNS blocklist providers). * External services documentation expanded: DNS blocklist providers, all wordpress. org download hosts and the ipwhois.io service are now listed. * Some known bugs have been fixed. * Visual improvements have been made. #### 1.0.2 * All features are now fully functional locally with no license restrictions. * A bug in the malware scanner has been fixed. * Runtime data (WAF rules, blocklists, GeoIP, quarantine) now lives under the uploads folder (uploads/wordsec). * Additional file/directory location and wp.org guideline compliance fixes. #### 1.0.1 * Inline scripts/styles moved to the WordPress enqueue API. * Stronger input sanitization across request handling. * Updated bundled libraries: ApexCharts 5.16.0, TCPDF 6.11.3. * GeoIP database now stored under wp-content/wordsec-data/ instead of the plugin folder. * Expanded the External services documentation in this readme. #### 1.0.0 * Initial public release. ## Meta * Version **1.1.0** * Last updated **17 ชั่วโมง ago** * Active installations **Fewer than 10** * WordPress version ** 6.9 or higher ** * Tested up to **7.0.2** * PHP version ** 7.4 or higher ** * Languages * [Arabic](https://ar.wordpress.org/plugins/wordsec/), [Dutch](https://nl.wordpress.org/plugins/wordsec/), [English (US)](https://wordpress.org/plugins/wordsec/), [Polish](https://pl.wordpress.org/plugins/wordsec/), [Russian](https://ru.wordpress.org/plugins/wordsec/) และ [Ukrainian](https://uk.wordpress.org/plugins/wordsec/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/wordsec) * Tags * [firewall](https://th.wordpress.org/plugins/tags/firewall/)[malware removal](https://th.wordpress.org/plugins/tags/malware-removal/) [malware scanner](https://th.wordpress.org/plugins/tags/malware-scanner/)[security](https://th.wordpress.org/plugins/tags/security/) [WAF](https://th.wordpress.org/plugins/tags/waf/) * [Advanced View](https://th.wordpress.org/plugins/wordsec/advanced/) ## Ratings 5 out of 5 stars. * [ 2 5-star reviews ](https://wordpress.org/support/plugin/wordsec/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/wordsec/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/wordsec/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/wordsec/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/wordsec/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/wordsec/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/wordsec/reviews/) ## Contributors * [ WordSec ](https://profiles.wordpress.org/wordsec/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/wordsec/)