Web Plura Security Center – Security Scanner, Firewall, 2FA & Login Protection

Web Plura Security Center helps WordPress administrators investigate suspicious files, review security risks, strengthen login protection, monitor important file changes, and manage local firewall and hardening controls from the WordPress dashboard. The free WordPress.org plugin is built around local security work. Security scans, login protection, firewall/rate-limiting controls, file-change review, hardening checks, reports, notifications, and privacy tools can be used without a Web Plura Cloud account, separate extension, or hosted service. Use it when you need a practical security review inside WordPress: scan for suspicious files and malware indicators, check risky configuration, review administrator and file-integrity signals, configure supported 2FA/passkey login controls, and manage local request protection. Findings are advisory signals for investigation, not proof that every flagged item is malicious. Key Security Features

• Security scanning for suspicious files, malware indicators, and risky configuration
• File integrity checks and local file-change baseline review
• Firewall controls with rate limiting and temporary blocking
• Login protection with two-factor authentication, passkeys, backup codes, and optional CAPTCHA
• Plugin checksum verification against WordPress.org where supported
• Security hardening checks for headers, XML-RPC, debug exposure, file permissions, and related configuration
• Administrator/user risk checks and file-integrity advisors
• Security findings, reports, email notifications, and local privacy tools

Security Scanner Run local security scans to review suspicious files, malware indicators, risky configuration, and other findings that may need administrator attention. The scanner is designed to support investigation. It does not automatically treat every unusual file as malware, and administrators should review scan evidence before taking destructive action. Suspicious Files and Malware Indicators Unexpected files or file changes can sometimes indicate a compromised WordPress installation, but legitimate plugin updates, theme updates, administrators, hosting tools, and deployment processes can also modify files. Web Plura Security Center can help identify files and patterns that may require review. It does not claim to detect every compromise, confirm that every suspicious file is malicious, or fully clean hacked WordPress sites automatically. Login Protection, 2FA and Passkeys Account security is a common weak point on WordPress sites. Web Plura Security Center includes supported login-security controls such as:

• Two-factor authentication (2FA) using authenticator codes
• Passkey enrollment and passkey login where supported by the browser, device, and site configuration
• Backup authentication codes
• Trusted-device review and revocation
• Role or user force-logout controls
• Temporary lockout after repeated login failures
• Optional CAPTCHA protection for supported login surfaces

These controls can reduce risk from reused passwords, repeated login attempts, and account-access problems. They do not guarantee account security. Firewall and Rate Limiting Web Plura Security Center includes local firewall controls designed to reduce repeated or abusive requests. Supported protections include request inspection, endpoint rate limiting, temporary blocking, local allowlist/blocklist controls, and firewall audit events. These tools keep request protection under administrator control and can be disabled temporarily for troubleshooting. File Integrity and File-Change Monitoring Web Plura Security Center keeps local file-change and integrity context to help administrators review important changes. A changed file does not automatically mean a website has been compromised. File-change and baseline information is meant to help administrators compare expected changes, such as updates or deployments, with changes that deserve closer review. Plugin Checksum Verification Where supported, administrators can run checksum verification against the WordPress.org Plugin Checksums API. This can help identify differences between supported installed plugin files and the files expected for a known WordPress.org plugin release. Checksum verification is an integrity check, not guaranteed malware detection. Security Hardening Checks Web Plura Security Center includes local checks and controls that help administrators review common WordPress exposure points. Supported areas include security headers, XML-RPC exposure, API exposure notes, debug-log exposure, file permissions, executable files in uploads, public backup/archive indicators, file editor exposure, administrator/user risk, and update posture. These checks are intended to provide practical review context. They should be used with secure hosting, regular updates, strong credentials, reliable backups, and careful administrator review. Admin/User Risk and File Integrity Checks The Admin/User Risk & File Integrity advisor reviews supported security conditions such as:

• administrator changes
• user-registration role exposure
• relevant file permissions
• executable files in upload locations
• exposed debug-log indicators
• publicly accessible archive indicators
• recent component changes

These checks are advisory and read-only. They do not silently modify users, roles, files, or approved baselines. Security Findings and Reports Web Plura Security Center provides security findings, incident visibility, local reports, security history, and administrative guidance for supported local checks. Findings are intended to provide enough context for an administrator to decide what deserves investigation. Not every warning is a confirmed security breach. Security Notifications Where configured and supported by the current release, administrators can receive security-related email notifications. The free plugin does not claim SMS, push notifications, external monitoring, or continuous cloud monitoring. Additional Security Advisors Web Plura Security Center also includes secondary local advisors that can help administrators review related risk signals. The Form Abuse & Lead Security advisor reviews supported local signals involving installed form plugins, likely lead pages, SMTP configuration, update status, privacy-page configuration, and risky form markers. These checks run locally according to the current plugin implementation. The advisor does not submit forms, capture leads for external analysis, analyze private lead content externally, or upload lead data to Web Plura. Who Is This For? Web Plura Security Center can be useful when you need to:

• investigate unexpected or suspicious files;
• scan for malware indicators and supported security risks;
• improve WordPress login security;
• enable two-factor authentication, passkeys, or backup codes;
• review file changes after plugin, theme, or deployment activity;
• check risky file permissions, debug-log exposure, public archives, and upload executable markers;
• inspect security headers, XML-RPC exposure, and common configuration issues;
• verify supported plugin files against WordPress.org checksums;
• reduce repeated abusive login or request attempts with local firewall controls;
• keep local security findings, reports, and privacy tools available inside WordPress.

Local-First Security and Privacy The WordPress.org version is designed so that its included local security functionality can operate without requiring a Web Plura Cloud account. Local security functionality should be understood as local WordPress-site functionality. The free plugin stores plugin-owned security metadata in the site's WordPress database, including local settings, contact or notification email settings when configured, login-security metadata, audit events, hashed or prefix IP evidence, blocked IP records, file-baseline summaries, and local report or scan state. The free plugin does not automatically upload suspicious file samples, form-advisor data, administrator/user-risk data, file-baseline history, setup-checklist information, or local security reports to Web Plura Cloud. The plugin registers applicable WordPress Privacy Tools exporter and eraser callbacks for plugin-owned security metadata. Uninstall removes applicable plugin options, scheduled hooks, and plugin-owned custom database tables. Limitations and Important Notes No WordPress security plugin can guarantee that every attack, malicious file, compromised account, vulnerability, or intrusion will always be detected. Web Plura Security Center provides security checks and administrative tools intended to help site owners identify and investigate supported security risks. Administrators should maintain secure hosting, strong credentials, current WordPress core, plugins and themes, reliable backups, and other appropriate security practices. Suspicious-file findings, checksum differences, file-change signals, administrator warnings, and hardening checks should be reviewed before action is taken. A finding indicates something worth reviewing; it does not automatically prove that the site has been compromised. Backup, restore, and disaster recovery workflows are handled by the standalone Web Plura Backup & Restore Manager plugin.

0.1.14

• Fixed first-time telemetry opt-in so the consent event queues only after an administrator enables that category.

0.1.13

• Improved the Free Vulnerabilities and Activity Logs mobile layouts so local evidence rows stack with readable labels, usable action buttons, and native Activity Logs section tabs.
• Organized dense Security Center Risk & Files advisor evidence behind an accessible disclosure so the mobile workspace stays focused on summary and actions.
• Organized dense Security Center Setup & Score checklist evidence behind an accessible disclosure while keeping score status visible.
• Tightened the Free Firewall Login Security status snapshot on mobile with scoped native status-card spacing.
• Reordered Free Support around support resources first and collapsed diagnostic details into native disclosures.
• Collapsed dense Free Upgrade comparison and boundary explanation into native disclosures while keeping local-control availability visible.
• Collapsed dense Form Abuse lead-security checklist evidence into a native disclosure while keeping the local risk summary visible.
• Collapsed dense Activity Logs audit-event evidence into a native disclosure while keeping activity totals and latest event visible.

0.1.12

• Reorganized the Free Firewall admin screen into standard WordPress section tabs for overview, threat intel, geo blocking, security headers, virtual patching, and login security without changing the underlying local controls.

0.1.11

• Added explicit WPlura legal, help, contact, and disclosure resource labels for WordPress.org release compliance.

0.1.10

• Improved WordPress.org compliance for paths, nonces, input sanitization, escaping, local scripts, and remote asset disclosures.

0.1.9

• Removed product-local Cloud connection, entitlement, dashboard, remote scan, policy sync, and signed transport workflows from the WordPress.org package.
• Kept local fixes, emergency review controls, firewall controls, login protection, and integrity checks available without Pro, Cloud, subscription, or entitlement checks.

0.1.8 Kept Free issue fixes, remediation-plan execution, and emergency action controls independent from Web Plura Cloud, Pro, subscription, and entitlement checks. 0.1.7 Renamed the public display title, added local-only integrity baselines, tightened nonce/passkey handling, expanded external-service disclosure, downgraded unsafe filesystem cleanup to manual guidance, and removed unused public key files. 0.1.6 Improved external-service consent wording, Upgrade page presentation, and dormant cloud-service wording. 0.1.5 Added a Free-owned local scan evidence resolver so Free and Pro share canonical scanner report, summary, timestamp, and score fallback behavior. 0.1.4 Added a Free-owned reports extension surface. 0.1.3 Formalized the dashboard capability panel slot as a reversible Free-owned extension surface for Security Center Pro. 0.1.1 Added stable admin extension slots while keeping free features local-only. 0.1.0 Initial public release with local scans, login protection, firewall controls, setup guidance, advisor checks, privacy tooling, and bounded local data handling.