| 开发者 |
prokashsarker2026
freemius nexurasecurity |
|---|---|
| 更新时间 | 2026年9月13日 13:25 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
.zip file from this page.Yes, 100% free. All core security features — malware scanning, file integrity monitoring, 2FA, brute-force protection, WAF, hardening, and more — are completely free with no usage limits. The Pro version adds advanced automation and enterprise features for sites that need maximum protection.
Yes. The built-in malware scanner detects backdoors, obfuscated code, web shells, and known malware patterns. You can remove detected threats with a single click. For fully automated, zero-touch cleanup, upgrade to Nexura Security Pro.
No. Nexura Security uses a micro-batching architecture that runs all scans in small, non-blocking chunks in the background. It utilizes lightweight background scanning, even during a full site scan of 50,000+ files.
Nexura Security offers comparable malware scanning, firewall, 2FA, and brute-force protection — but with a significantly lighter performance footprint. Unlike Wordfence, Nexura Security does not insert blocking rows into your database during normal operation, and its WAF uses auto_prepend_file to intercept threats at the PHP level before WordPress even loads.
Sucuri's core plugin on WordPress.org primarily offers activity auditing and basic hardening. Nexura Security provides a more complete free feature set including a built-in malware scanner, 2FA, brute-force protection, and automated security alert emails — all in one plugin.
Yes. The free version fully protects WooCommerce sites. The Pro version adds WooCommerce-specific protections including anti-card-testing on checkout pages and customer account takeover prevention.
Only when you explicitly enable a cloud feature such as Threat Intelligence, Pwned Passwords, or Safe Browsing. All external connections are fully documented in the Third-Party Services section above. By default, everything runs on your own server.
Yes. Nexura Security is compatible with all major caching plugins including WP Rocket, W3 Total Cache, LiteSpeed Cache, and WP Super Cache. The WAF and scanner operate at the PHP level and do not interfere with caching behavior.
Yes. Nexura Security is fully compatible with Cloudflare proxied sites. The WAF and brute-force protection correctly identify and handle traffic passing through Cloudflare.
PHP 7.4 or higher is required. PHP 8.1+ is recommended for the best performance.
Yes. Nexura Security can be network-activated on WordPress Multisite installations.
Yes. There are no restrictions on the number of sites you can protect with the free version.
SameSite=Strict and constant-time hash_equals() comparison.wp_login actions with third-party separate-prompt 2FA.FILTER_SANITIZE_URL usage for WAF log tracking.esc_js, esc_html__).WP_Http_Curl class, as the core does not use it.shorturl.fm, t.ly, goo.su and more). Spam comments with these links will now be blocked automatically before they ever appear on your site.nexura-waf-bootstrap.php proxy file at the server root. This eliminates fatal errors when the plugin folder is renamed, moved, or the Pro version is installed alongside the free version.Failed opening required 'nexura-security-pro/nexura-waf.php') that occurred on sites where the plugin was installed as nexura-security while .htaccess still referenced the old nexura-security-pro path.$total_activity, $recent_attacks, $top_countries, $error_rate) in the WAF Analytics REST endpoint that caused the dashboard charts to fail to load on Pro installations.foreach() on null PHP warnings in the DB Optimizer Stats and Table List endpoints, which caused JSON parse errors preventing the Database Optimizer page from loading on some hosting environments.nexura-security-pro plugin on activation, displaying a clear admin notice to prevent conflicts and fatal errors.wp_options, wp_postmeta, wp_usermeta, and Custom Tables for hidden JavaScript injections, encoded PHP, SEO spam, and backdoor iframes.chattr). Now strictly opt-in, properly capability checked, and fully audited.Nexura_Security::can_manage_security() method, making the plugin more reliable and extensible.CURLOPT_SSL_VERIFYPEER is now true to prevent MITM attacks.esc_url_raw with wp_validate_redirect() in 2FA login to prevent Open Redirect attacks.preg_replace sanitization in DB Backup and Plugin Conflict Cleaner.auto_prepend_file directive is now correctly removed from .htaccess and .user.ini during deactivation.