SecureShield | Firewall, Login Defence & Malware Scans for WordPress

SecureShield | Firewall, Login Defence, Malware & Integrity Scans for WordPress

SecureShield is a complete security suite with one score. It locks out brute-force attempts without ever locking you out, blocks injection attempts before WordPress runs, verifies every core and wordpress.org file against the official checksums, scans for malware with a signature pack and ClamAV, hardens the usual weak spots with a switch each, logs who changed what with a Revert button, and watches your installed versions for known vulnerabilities.

Key Features

• Login defence: lockouts per IP and per username with escalation, country allow/deny rules, generic error messages, refusal of the "admin" username, a login honeypot
• Never ban my own IP: every address an administrator signs in from is protected from lockouts and firewall blocks
• Web application firewall: SQL injection, XSS, path traversal / LFI, command injection and scanner user agents; block or log mode; allow-lists; automatic blocking of repeat offenders; a one-click self-test
• File integrity: core files against the official checksums for your version and locale, wordpress.org plugins against their checksums, everything else against your baseline; diff against the pristine copy, one-click restore, accept into the baseline
• Unknown files in wp-admin / wp-includes and PHP files in uploads are flagged
• Malware scan: signature pack for backdoors, obfuscation, hidden iframes, PHP inside images and .htaccess tricks, plus ClamAV when the server has it; quarantine, restore, delete
• Security headers, XML-RPC off, theme/plugin editor off, user enumeration blocked, REST for signed-in users, version hidden; Apache .htaccess rules or the nginx snippet, verified by a live probe
• Two-factor (TOTP) for the roles you choose with recovery codes; hands off to AlphaLogin when it is installed
• Activity log: who changed what, option changes with old/new values and a Revert button, CSV export, retention
• Vulnerability watch: installed versions against the WPVulnerability database (no key) and the WPScan API (optional), pending updates, abandoned plugins, email alerts
• Comment and form bot protection: honeypot, minimum time to submit, JavaScript token, spam IP blocklist, StopForumSpam lookups
• One security score with every check explained and a fix-it button next to each; shown in Site Health too

The Score

1. Open SecureShield: 27 checks are weighted into one score (HTTPS, updates, login defence, firewall, 2FA, integrity, malware and known vulnerabilities count most)
2. Every failing check explains itself and has a fix-it button, a link, or a scan to run
3. Run the first integrity scan to create your baseline and the first malware scan
4. Come back to the Overview: the score, attacks per day and recent events are always there

Installation

1. Download the zip from your Library
2. In wp-admin go to Plugins › Add New › Upload Plugin, choose the zip and activate it
3. A new menu entry appears in the admin sidebar; open it
4. SecureShield › Overview: press the fix-it buttons; Integrity and Malware: run the first scans

Requirements

• WordPress 6.0 or newer (tested up to 7.0)
• PHP 8.0 or newer
• Optional: ClamAV (clamscan / clamdscan) on the server for the second scanner
• Optional: a WPScan API key for direct lookups

What You Get

• SecureShield 1.0.0 for WordPress (secureshield-1.0.0.zip)
• Full, readable PHP and JavaScript source, no obfuscation
• Updates for the term of your licence

Works With

Part of the Alpha WordPress line, built with one admin kit: AlphaLogin, SiteStats, CodeSell, LicenseGuard, MailDoctor, FolderPress.

The screenshots show the plugin on our demo site with sample data.