Aria Security Suite

Description

Aria Security Suite is a modular, production-ready security plugin for WordPress. It delivers enterprise-level protection that works standalone on your server — and can optionally connect to your own Enterprise Security API for centralized WAF decisions, integrity checks, and reporting.

Built with clean PHP architecture (PSR-4), a modern AJAX admin experience, and privacy-first defaults: no outbound calls until you configure and enable each feature.

Why Aria Security Suite?

• All-in-one protection — local WAF, login hardening, TOTP, malware scanning, honeypots, session control, and live traffic monitoring in one plugin.
• Works without the cloud — firewall, 2FA, scanners, hardening, audit log, and exports run fully on your site.
• Zero performance penalty — heavy scans and log sync run in the background via WP-Cron or Action Scheduler.
• Privacy by design — cloud API, Cloudflare, geo lookups, checksums, vulnerability scanning, HIBP, and webhooks are opt-in only.
• Actionable security score — grades your site A–F from real hardening, not from whether an API is connected.
• Developer-friendly — modular codebase, REST API endpoints, WP-CLI (wp aria), HMAC-signed API client, and GPL-licensed.

Setup & Dashboard

• 3-step Onboarding Wizard — choose Basic, Medium, or Strict presets in seconds.
• Security Grade Score (0–100) — real-time posture analysis with actionable tips.
• Dashboard Widget & Admin Bar — security status at a glance from any admin screen.
• Modern AJAX UI — fast, reload-free settings with responsive design.

Login & Authentication

• Hide Login Page — replace wp-login.php with a custom secret URL.
• Passwordless Login (Magic Links) — secure email-based one-time login tokens.
• TOTP 2FA — authenticator-app second factor with backup codes. Works without the Enterprise API. Enroll from your WordPress profile.
• Force TOTP by role — require authenticator setup for selected roles.
• API email 2FA — optional second factor via your Enterprise API.
• Session Manager — view and remotely destroy active sessions for all users.
• Device Fingerprinting — recognize trusted admin devices.
• New-device login alerts — email the account owner when a new browser or country appears.
• Admin IP allowlist — restrict administrator sign-in to specific IPs or CIDRs.
• Password policy — minimum length, letters + numbers, optional Have I Been Pwned check (k-anonymity, opt-in).
• Brute-Force Protection — rate limiting and automatic IP bans on failed logins.

Firewall & Network (WAF)

• Local Web Application Firewall — inspects requests on the server for SQLi, XSS, path traversal, and wrapper patterns. No API required.
• IP allowlist / blocklist — IPs and CIDR ranges, one per line.
• Custom WAF rules — block or challenge by path, query, or user-agent.
• JS challenge page — lightweight browser check before a hard block.
• Optional API offload — send WAF decisions to your Enterprise API when configured.
• Cloudflare Integration — push banned IPs to the Cloudflare edge firewall (CDN level).
• Geo-Blocking — block listed countries or allow only listed countries. Uses CF-IPCountry, then GeoIP, then ip-api.com (24-hour cache).
• PHP Execution Blocker — prevent PHP execution in uploads via .htaccess / web.config.
• User-Agent Filtering — block known malicious bots and scanners.
• XML-RPC Control — leave enabled, allow pingback only, or disable xmlrpc.php completely.
• Virtual patches — optional extra block rules pulled from the Enterprise API.

Scanners & Integrity

• Heuristic Malware Scanner — background scan for suspicious patterns, plus a limited database content check.
• Quarantine / restore — move suspicious files out of the web root and restore them from the admin UI.
• File Integrity Monitor — detect unauthorized changes to core WordPress files.
• WordPress.org checksums — compare core and hosted plugin files with official checksums (opt-in).
• Hash Scanner — verify file hashes against known-good baselines.
• Vulnerability Scanner — optional cloud comparison of installed plugin versions (explicit opt-in).

Spam & Intrusion Prevention

• Invisible Honeypots — comments, registration, login, Contact Form 7, Gravity Forms, WPForms, Elementor, Fluent Forms, and WooCommerce — no CAPTCHA needed.
• Endpoint rate limits — REST, comments, password reset, and XML-RPC.
• Behavioral Analysis — detect anomalous request patterns.
• WooCommerce protection — rate-limit checkout and coupon abuse.
• Global Ban Sync — share ban lists when connected to the Enterprise API.

Monitoring, Logging & Alerts

• Live Traffic Monitoring — real-time request log with IP, path, status codes, and user-agents.
• Admin audit log — plugin, user, role, and Aria setting changes.
• Weekly email digest — score and event counts to the site admin email.
• Local CSV / HTML export — download events or open a local report without the API.
• Encrypted local backup — snapshot of Aria settings and recent events.
• SQL Query Analyzer — surface slow or suspicious database queries.
• Log Rotation — automatic cleanup with configurable retention.
• Webhooks — instant alerts to Slack, Telegram, or custom JSON endpoints.
• Central Reporting — signed log export to your Enterprise API.
• Encrypted Cloud Backup Requests — trigger cloud backups from the admin panel when the API is configured.

Hardening & Headers

• Disable the theme/plugin file editor (DISALLOW_FILE_EDIT).
• Block user enumeration — ?author=1 and /wp/v2/users for guests.
• Lock anonymous REST API — with an allowlist for commerce and form plugins.
• Disable application passwords.
• FORCE_SSL_ADMIN and secure auth cookies.
• Security Headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
• Table Prefix Advisor — guidance for safer database prefixes.
• Crypto Vault — secure storage for API secrets and TOTP material.

Multisite & WP-CLI

• Network admin screen — per-site security scores and baseline hardening across the network.
• WP-CLI — wp aria score, wp aria scan, wp aria checksums, wp aria ban add|remove <ip>, wp aria export, wp aria events.

Optional Enterprise API

Connect your own API endpoint for WAF offload, heartbeat health checks, hash verification, ban reporting, quota lookups, virtual patches, and vulnerability intelligence. Credentials are stored encrypted; every request is signed with HMAC-SHA256.

Developer: Alireza Aminzadeh (syeedalireza)
Websites: aryait.net · ariacoder.ir
GitHub: github.com/alireza-aminzadeh/aria-security-suite

External services

This plugin may connect to third-party or external services only when you explicitly enable and configure the related feature. No outbound tracking or data collection occurs by default.

Enterprise Security API (optional)

When you enter an API Base URL, Site ID, and Secret Key under API & Connection, the plugin can send signed requests to your configured Enterprise Security API for features such as WAF decisions, heartbeat health checks, hash integrity verification, ban reporting, quota lookups, virtual patches, and (if opted in) vulnerability scanning.

Data sent: Request metadata (IP, path, HTTP method, user-agent, query parameter names), security event logs, file hashes, and—only when the Vulnerability Scanner opt-in is enabled—installed plugin slugs and versions.

When: Only after credentials are saved and the relevant feature is turned on. Heartbeat runs on WP-Cron when the API is configured. Plugin inventory is sent only when the Vulnerability Scanner opt-in is enabled.

Service provider: Your own Enterprise Security API endpoint (URL you provide). You are responsible for that service’s terms and privacy policy.

Cloudflare API (optional)

When Cloudflare integration is enabled and you provide a Zone ID and API token, the plugin calls the Cloudflare API to create firewall access rules that block malicious IP addresses at the CDN edge.

Data sent: IP addresses of blocked visitors and a short note identifying the block source.

When: Only after you enable Cloudflare integration and supply credentials, and only when a local security rule triggers an IP ban.

Service provider: Cloudflare, Inc. — Terms of Use, Privacy Policy.

ip-api.com (optional)

When Geo-Blocking is enabled and you configure a country list, the plugin queries ip-api.com to resolve a visitor’s country code from their IP address if Cloudflare or a local GeoIP source is not available.

Data sent: The visitor’s IP address.

When: Only when Geo-Blocking is enabled, a country list is configured, and the country for an IP is not already cached locally (results are cached for 24 hours).

Service provider: ip-api.com — Terms & Legal, Privacy Policy.

WordPress.org checksums (optional)

When checksum verification is enabled, the plugin downloads official checksums from WordPress.org to compare core and hosted plugin files on your server.

Data sent: WordPress version, locale, and (for plugins) slug + version in the request URL.

When: Only when checksum verification is enabled (off by default).

Service provider: WordPress.org — Privacy Policy.

Have I Been Pwned (optional)

When the breached password check is enabled, the plugin sends the first 5 characters of a SHA-1 password hash (k-anonymity) to the Pwned Passwords API.

Data sent: SHA-1 hash prefix only (not the password).

When: Only after you enable the option, and only when a password is being set or changed.

Service provider: Have I Been Pwned — Privacy.

User-configured webhooks (optional)

When you add Slack, Telegram, or generic webhook URLs under Alerts & Notifications, the plugin POSTs JSON alert payloads to those URLs when security events occur.

Data sent: Alert severity, message text, and contextual fields (e.g., IP address, event type).

When: Only after you save a webhook URL and a qualifying security event fires.

Service provider: The third-party service behind the URL you provide (e.g., Slack, Telegram). See their respective terms and privacy policies.

composer require woocommerce/action-scheduler