NeverLast Security Lite

NeverLast Security Lite is a complete, standalone security plugin. It runs inside your site: no account, no licence key, no telemetry, and no feature locked behind an upgrade. What it does

• Firewall - inspects requests for common SQL injection, XSS, path traversal, file inclusion, command injection, Log4Shell and Shellshock shapes, in Monitor, Balanced or Strict mode.
• Scanner trap - optional exact-path probes for missing configuration and plugin decoys. Monitor logs locally, Deceive serves inert text, and Block returns 404. No files are placed on disk.
• Upload protection - rejects executable uploads, smuggled server-control files and images that carry code, and holds uploads it cannot fully inspect.
• Login security - attempt limits and lockouts, generic login errors, author-enumeration and REST user protection, XML-RPC and Application Password controls.
• Two-factor authentication - optional TOTP for administrators with encrypted secrets and one-use recovery codes.
• Emergency controls - end every session or freeze logins, with an optional secret-protected emergency link in login alerts.
• Health check - a prioritized score with plain-language recommendations.
• Integrity monitoring - an approved local baseline of your files, resumable comparison for large sites, uploads review, and optional verification against WordPress.org checksums.
• Quarantine you decide - a suspicious upload is held as an authenticated encrypted, non-executable copy until you download it as evidence or delete it. Nothing is deleted automatically.
• Activity log - bounded retention, masked IP addresses, CSV and JSON export, and throttled email alerts.
• Security headers - baseline browser headers and optional CSP Report-Only diagnostics.

What it does not do Lite runs inside WordPress, so it cannot protect anything served before WordPress loads and it does not replace web-server, hosting, CDN or backup controls. It does not scan database content, it logs but does not block the creation of administrator accounts, and it never repairs files automatically. An integrity baseline shows what changed since you approved it; it does not prove the approved state was clean. Single-site installations only. The optional scanner trap is off by default. It covers five exact, missing probe paths only after the request reaches WordPress. Existing files are never replaced, and authenticated or administrative requests are excluded. In Firewall Monitor mode, the trap also observes only. The ordinary firewall can still act on a suspicious request independently. Lite and PRO Lite is a standalone plugin; PRO is a separate product, not required to use any Lite feature. Both include a local firewall, login protection, administrator two-factor authentication, file-integrity monitoring, activity logs and an optional scanner trap. The scope differs:

• Lite uses five exact, missing scanner-probe paths. Its local trap can observe, serve inert text or return 404; it does not score visitors or lock out an IP because of a trap hit.
• PRO request protection adds custom WAF rules, virtual patches, request behavior contracts and broader scanner-trap correlation.
• PRO investigation adds malware scanning, vulnerability intelligence, Safe Fuzzer diagnostics and Compatibility Autopilot.
• PRO identity and recovery adds Identity Risk, Browser Integrity, Extreme Security Features and the independent Guardian integrity layer.

PRO feature availability and enforcement mode depend on the installed PRO release and its configuration. This comparison does not change Lite's independent operation. No security product can guarantee a site is free of vulnerabilities. Keep WordPress, PHP, plugins and themes updated, use least privilege, and keep tested off-site backups. Support and security contact: nss@neverlast.ro

1. Install through Plugins > Add New, or upload the ZIP, then activate. Protective defaults apply at once: the firewall in Balanced mode, XML-RPC and Application Passwords disabled, public REST user endpoints hidden, author enumeration blocked and the dashboard code editor disabled.
2. Open NeverLast Security > Protection. If Jetpack, the WordPress mobile apps or another service needs XML-RPC or an Application Password, untick the matching control. Start in Monitor if you are unsure about compatibility, then move to Balanced.
3. Run the Health Check and work through the prioritized items.
4. Review your installed files, then create the first integrity baseline.
5. Enroll each administrator in TOTP and store the recovery codes offline.

Using the optional Scanner Trap

1. Open NeverLast Security > Protection. Keep "Enable local firewall" on. Choose Balanced or Strict firewall mode if you intend to use Deceive or Block; Firewall Monitor forces the trap to Monitor.
2. In Scanner trap > Probe handling, select Monitor and save. The effective mode is shown directly below the control. Off disables the trap.
3. Review scanner_trap_probe entries under NeverLast Security > Activity. The log records the probe type and effective mode with a masked IP address; it does not send the event to another service.
4. After checking legitimate traffic, choose Deceive to return inert plain text with HTTP 200, or Block to return HTTP 404. You can return to Monitor or Off at any time. The regular firewall can still block a request independently while the trap is in Monitor.

The trap handles only GET and HEAD requests for five missing paths: /.env, /.git/config, /wp-config.php.bak, /xmlrpc.php.bak and /wp-content/plugins/fake-vulnerable-plugin/readme.txt. It does not intercept existing files, logged-in users, administration requests, or requests with query or body data. The web server or CDN may answer a request before WordPress loads; such requests are outside Lite's view. Test changes on a staging site before using Deceive or Block on production.

1.2.8

• Added an opt-in, local-only scanner trap for five exact missing probe paths, with Monitor, Deceive and Block modes. It never writes decoy files, and reports the effective mode on Protection.
• Baseline build and confirmation feedback now appears in the Integrity work area, and the page returns there after submission. A resumable build is labeled In progress rather than Failed.

1.2.7

• Uses WordPress filesystem abstractions for evidence permissions, writable-folder checks, and nonrecursive uninstall cleanup. Retains bounded encrypted streaming for safety with an explicitly documented PHP_CodeSniffer exception. Operations fail closed when private permissions cannot be enforced.

1.2.6

• WordPress.org prereview remediation: configured uploads quarantine storage with legacy evidence encryption and migration, portable findings paths, no direct executable restoration, restricted dashboard notices, and corrected privacy URL.

1.2.5

• Fixed: a request body sent with GET, or under a Content-Type the firewall did not list (WordPress still reads "application/json," as JSON), was not inspected. Every body is now inspected; binary files are left to the upload guard.
• Fixed: data deletion on uninstall left the quarantine .htaccess and failed storage probes behind.

1.2.4

• Fixed: a baseline or comparison that runs in several steps could check a folder twice or skip a file when files were added or removed meanwhile, for example the .maintenance file WordPress writes during an update. The comparison then stopped with a storage error or reported an existing file as deleted. Each folder now resumes after the last file name it checked.

1.2.3

• Fixed: on WordPress 6.6, quarantine removed a file from uploads but discarded the held copy and reported that nothing was quarantined. Deletions are now confirmed on disk.
• The emergency response page loads its styles through the WordPress style API. The complete history is in changelog.txt inside the plugin folder.