AlphaLogin
Security & sign-inPasskeys, two-factor codes, magic links and SSO through your Alpha accounts portal, with brute-force protection, session control, login designer and audit log.
223 successful sign-ins logged here
SecureShield
One-score security suite: login lockouts that never lock you out, a firewall, integrity and malware scans, hardening, 2FA, activity log and vulnerability watch.
Active on this demo
v1.0.0
Security & sign-in
Live on this siteread from SecureShield's own tables
210attacks stopped
1,116files under integrity watch
Defend
- Login defence: lockouts per IP and per username with escalation, country allow/deny rules, generic error messages, refusal of the "admin" username, a honeypot on wp-login
- Never ban my own IP: addresses administrators sign in from are remembered and can never be locked out or blocked, by any module
- Web application firewall: SQL injection, XSS, path traversal / LFI, command injection and scanner user agents, in block or log mode, with allow-lists and automatic blocking of repeat offenders; a one-click self-test proves it works
- Comment and form bot protection: honeypot, minimum time to submit, JavaScript token, spam IP blocklist, optional StopForumSpam lookups
Detect
- File integrity: core files against the official checksums for your exact version and locale, wordpress.org plugins against their per-version checksums, everything else against your baseline; a diff against the pristine copy, one-click restore, accept into the baseline, strangers in wp-includes and PHP in uploads flagged
- Malware scan: a signature pack for PHP / JavaScript / .htaccess backdoors, obfuscation, hidden iframes, PHP inside images, double extensions, plus ClamAV when the server has it; findings can be viewed, quarantined, restored or deleted
- Vulnerability watch: installed versions against the Wordfence Intelligence feed (no key) and the WPScan API (optional key), pending updates, abandoned plugins; daily with email alerts
- Activity log: who changed what, including option changes with old and new values and a Revert button; CSV export; retention
Harden
- Security headers (X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, HSTS, optional CSP)
- XML-RPC off, theme/plugin editor off, user enumeration blocked, REST for signed-in users only, WordPress version hidden
- Apache: directory listing off and no PHP execution in uploads via managed .htaccess rules; nginx: the exact snippet to paste; a live probe proves either
- Two-factor (TOTP) for the roles you choose, with recovery codes; hands off to AlphaLogin when it is installed
Score
- One security score with every check explained and a fix-it button next to each; also shown in Site Health
- Upload the
secureshieldfolder to/wp-content/plugins/and activate it. - SecureShield ▸ Overview: read the score, press the fix-it buttons.
- SecureShield ▸ Integrity: run the first scan to create the baseline. Malware: run a scan.
Can it lock me out?
No. The IP you installed it from, every IP an administrator signs in from and anything on the allow-lists are protected from lockouts and firewall blocks.
Does the firewall break page builders?
Users who may post unfiltered HTML (editors, administrators) are not inspected when they save content. Anything else that legitimately posts code can be allow-listed by path.
Is ClamAV required?
No. The signature pack runs everywhere; ClamAV is used in addition when clamscan or clamdscan exists on the server.
- 1.0.0
- First release.