Title: Aria Security Suite
Author: Alireza Aminzadeh
Published: Juny 26, 2026
Last modified: Agost 17, 2026
---
Search plugins
# Aria Security Suite
By [Alireza Aminzadeh](https://profiles.wordpress.org/syeedalireza/)
[Download](https://downloads.wordpress.org/plugin/aria-security-suite.1.3.0.zip)
* [Details](https://bal.wordpress.org/plugins/aria-security-suite/#description)
* [Reviews](https://bal.wordpress.org/plugins/aria-security-suite/#reviews)
* [Installation](https://bal.wordpress.org/plugins/aria-security-suite/#installation)
* [Development](https://bal.wordpress.org/plugins/aria-security-suite/#developers)
[Support](https://wordpress.org/support/plugin/aria-security-suite/)
## Description
**Aria Security Suite** is a modular, production-ready security plugin for WordPress.
It delivers enterprise-level protection that works **standalone on your server**—
and can optionally connect to your own **Enterprise Security API** for centralized
WAF decisions, integrity checks, and reporting.
Built with clean PHP architecture (PSR-4), a modern AJAX admin experience, and privacy-
first defaults: **no outbound calls until you configure and enable each feature.**
#### Why Aria Security Suite?
* **All-in-one protection** — local WAF, login hardening, TOTP, malware scanning,
honeypots, session control, and live traffic monitoring in one plugin.
* **Works without the cloud** — firewall, 2FA, scanners, hardening, audit log,
and exports run fully on your site.
* **Zero performance penalty** — heavy scans and log sync run in the background
via WP-Cron or Action Scheduler.
* **Privacy by design** — cloud API, Cloudflare, geo lookups, checksums, vulnerability
scanning, HIBP, and webhooks are **opt-in only**.
* **Actionable security score** — grades your site A–F from real hardening, not
from whether an API is connected.
* **Developer-friendly** — modular codebase, REST API endpoints, WP-CLI (`wp aria`),
HMAC-signed API client, and GPL-licensed.
#### Setup & Dashboard
* **3-step Onboarding Wizard** — choose Basic, Medium, or Strict presets in seconds.
* **Security Grade Score (0–100)** — real-time posture analysis with actionable
tips.
* **Dashboard Widget & Admin Bar** — security status at a glance from any admin
screen.
* **Modern AJAX UI** — fast, reload-free settings with responsive design.
#### Login & Authentication
* **Hide Login Page** — replace `wp-login.php` with a custom secret URL.
* **Passwordless Login (Magic Links)** — secure email-based one-time login tokens.
* **TOTP 2FA** — authenticator-app second factor with backup codes. Works without
the Enterprise API. Enroll from your WordPress profile.
* **Force TOTP by role** — require authenticator setup for selected roles.
* **API email 2FA** — optional second factor via your Enterprise API.
* **Session Manager** — view and remotely destroy active sessions for all users.
* **Device Fingerprinting** — recognize trusted admin devices.
* **New-device login alerts** — email the account owner when a new browser or country
appears.
* **Admin IP allowlist** — restrict administrator sign-in to specific IPs or CIDRs.
* **Password policy** — minimum length, letters + numbers, optional Have I Been
Pwned check (k-anonymity, opt-in).
* **Brute-Force Protection** — rate limiting and automatic IP bans on failed logins.
#### Firewall & Network (WAF)
* **Local Web Application Firewall** — inspects requests on the server for SQLi,
XSS, path traversal, and wrapper patterns. No API required.
* **IP allowlist / blocklist** — IPs and CIDR ranges, one per line.
* **Custom WAF rules** — block or challenge by path, query, or user-agent.
* **JS challenge page** — lightweight browser check before a hard block.
* **Optional API offload** — send WAF decisions to your Enterprise API when configured.
* **Cloudflare Integration** — push banned IPs to the Cloudflare edge firewall (
CDN level).
* **Geo-Blocking** — block listed countries or allow only listed countries. Uses
CF-IPCountry, then GeoIP, then ip-api.com (24-hour cache).
* **PHP Execution Blocker** — prevent PHP execution in `uploads` via `.htaccess`/`
web.config`.
* **User-Agent Filtering** — block known malicious bots and scanners.
* **XML-RPC Control** — leave enabled, allow pingback only, or disable `xmlrpc.
php` completely.
* **Virtual patches** — optional extra block rules pulled from the Enterprise API.
#### Scanners & Integrity
* **Heuristic Malware Scanner** — background scan for suspicious patterns, plus
a limited database content check.
* **Quarantine / restore** — move suspicious files out of the web root and restore
them from the admin UI.
* **File Integrity Monitor** — detect unauthorized changes to core WordPress files.
* **WordPress.org checksums** — compare core and hosted plugin files with official
checksums (opt-in).
* **Hash Scanner** — verify file hashes against known-good baselines.
* **Vulnerability Scanner** — optional cloud comparison of installed plugin versions(
explicit opt-in).
#### Spam & Intrusion Prevention
* **Invisible Honeypots** — comments, registration, login, Contact Form 7, Gravity
Forms, WPForms, Elementor, Fluent Forms, and WooCommerce — no CAPTCHA needed.
* **Endpoint rate limits** — REST, comments, password reset, and XML-RPC.
* **Behavioral Analysis** — detect anomalous request patterns.
* **WooCommerce protection** — rate-limit checkout and coupon abuse.
* **Global Ban Sync** — share ban lists when connected to the Enterprise API.
#### Monitoring, Logging & Alerts
* **Live Traffic Monitoring** — real-time request log with IP, path, status codes,
and user-agents.
* **Admin audit log** — plugin, user, role, and Aria setting changes.
* **Weekly email digest** — score and event counts to the site admin email.
* **Local CSV / HTML export** — download events or open a local report without
the API.
* **Encrypted local backup** — snapshot of Aria settings and recent events.
* **SQL Query Analyzer** — surface slow or suspicious database queries.
* **Log Rotation** — automatic cleanup with configurable retention.
* **Webhooks** — instant alerts to **Slack**, **Telegram**, or custom JSON endpoints.
* **Central Reporting** — signed log export to your Enterprise API.
* **Encrypted Cloud Backup Requests** — trigger cloud backups from the admin panel
when the API is configured.
#### Hardening & Headers
* **Disable the theme/plugin file editor** (`DISALLOW_FILE_EDIT`).
* **Block user enumeration** — `?author=1` and `/wp/v2/users` for guests.
* **Lock anonymous REST API** — with an allowlist for commerce and form plugins.
* **Disable application passwords**.
* **FORCE_SSL_ADMIN** and secure auth cookies.
* **Security Headers** — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-
Policy, Permissions-Policy.
* **Table Prefix Advisor** — guidance for safer database prefixes.
* **Crypto Vault** — secure storage for API secrets and TOTP material.
#### Multisite & WP-CLI
* **Network admin screen** — per-site security scores and baseline hardening across
the network.
* **WP-CLI** — `wp aria score`, `wp aria scan`, `wp aria checksums`, `wp aria ban
add|remove `, `wp aria export`, `wp aria events`.
#### Optional Enterprise API
Connect your own API endpoint for WAF offload, heartbeat health checks, hash verification,
ban reporting, quota lookups, virtual patches, and vulnerability intelligence. Credentials
are stored encrypted; every request is signed with **HMAC-SHA256**.
**Developer:** [Alireza Aminzadeh](https://github.com/alireza-aminzadeh) ([syeedalireza](https://profiles.wordpress.org/syeedalireza/))
**
Websites:** [aryait.net](https://aryait.net/) · [ariacoder.ir](https://ariacoder.ir/)**
GitHub:** [github.com/alireza-aminzadeh/aria-security-suite](https://github.com/alireza-aminzadeh/aria-security-suite)
### External services
This plugin may connect to third-party or external services **only when you explicitly
enable and configure the related feature**. No outbound tracking or data collection
occurs by default.
#### Enterprise Security API (optional)
When you enter an API Base URL, Site ID, and Secret Key under **API & Connection**,
the plugin can send signed requests to your configured Enterprise Security API for
features such as WAF decisions, heartbeat health checks, hash integrity verification,
ban reporting, quota lookups, virtual patches, and (if opted in) vulnerability scanning.
**Data sent:** Request metadata (IP, path, HTTP method, user-agent, query parameter
names), security event logs, file hashes, and—only when the Vulnerability Scanner
opt-in is enabled—installed plugin slugs and versions.
**When:** Only after credentials are saved and the relevant feature is turned on.
Heartbeat runs on WP-Cron when the API is configured. Plugin inventory is sent only
when the Vulnerability Scanner opt-in is enabled.
**Service provider:** Your own Enterprise Security API endpoint (URL you provide).
You are responsible for that service’s terms and privacy policy.
#### Cloudflare API (optional)
When **Cloudflare integration** is enabled and you provide a Zone ID and API token,
the plugin calls the Cloudflare API to create firewall access rules that block malicious
IP addresses at the CDN edge.
**Data sent:** IP addresses of blocked visitors and a short note identifying the
block source.
**When:** Only after you enable Cloudflare integration and supply credentials, and
only when a local security rule triggers an IP ban.
**Service provider:** Cloudflare, Inc. — [Terms of Use](https://www.cloudflare.com/website-terms/),
[Privacy Policy](https://www.cloudflare.com/privacypolicy/).
#### ip-api.com (optional)
When **Geo-Blocking** is enabled and you configure a country list, the plugin queries
ip-api.com to resolve a visitor’s country code from their IP address if Cloudflare
or a local GeoIP source is not available.
**Data sent:** The visitor’s IP address.
**When:** Only when Geo-Blocking is enabled, a country list is configured, and the
country for an IP is not already cached locally (results are cached for 24 hours).
**Service provider:** ip-api.com — [Terms & Legal](http://ip-api.com/docs/legal),
[Privacy Policy](http://ip-api.com/docs/legal).
#### WordPress.org checksums (optional)
When **checksum verification** is enabled, the plugin downloads official checksums
from WordPress.org to compare core and hosted plugin files on your server.
**Data sent:** WordPress version, locale, and (for plugins) slug + version in the
request URL.
**When:** Only when checksum verification is enabled (off by default).
**Service provider:** WordPress.org — [Privacy Policy](https://wordpress.org/about/privacy/).
#### Have I Been Pwned (optional)
When the **breached password check** is enabled, the plugin sends the first 5 characters
of a SHA-1 password hash (k-anonymity) to the Pwned Passwords API.
**Data sent:** SHA-1 hash prefix only (not the password).
**When:** Only after you enable the option, and only when a password is being set
or changed.
**Service provider:** Have I Been Pwned — [Privacy](https://haveibeenpwned.com/Privacy).
#### User-configured webhooks (optional)
When you add Slack, Telegram, or generic webhook URLs under **Alerts & Notifications**,
the plugin POSTs JSON alert payloads to those URLs when security events occur.
**Data sent:** Alert severity, message text, and contextual fields (e.g., IP address,
event type).
**When:** Only after you save a webhook URL and a qualifying security event fires.
**Service provider:** The third-party service behind the URL you provide (e.g.,
Slack, Telegram). See their respective terms and privacy policies.
## Installation
1. Upload the `aria-security-suite` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Complete the **Onboarding Wizard** (opens automatically on first activation).
4. Review your **Security Score** on the dashboard and apply recommended fixes.
5. Open **Users Profile** to enroll in TOTP 2FA.
6. _(Optional)_ Enter API Base URL, Site ID, and Secret Key under **Connection & API**
for cloud features.
#### MU-Plugin early load (optional)
Copy `extras/aria-security-suite-mu-loader.php` to `wp-content/mu-plugins/` to load
protection before regular plugins. Do not activate the plugin twice.
#### Action Scheduler (recommended)
For more reliable background jobs than WP-Cron alone:
```
composer require woocommerce/action-scheduler
```
## FAQ
### Does this plugin slow down my site?
No. Malware scanning, log synchronization, checksums, and integrity checks run in
the background using WP-Cron or Action Scheduler. Your front-end TTFB is unaffected.
### Is my data sent anywhere without permission?
No. Remote API calls, vulnerability scanning, Cloudflare blocking, geo lookups,
checksums, Have I Been Pwned, and webhooks are all **opt-in** and remain off until
you configure and enable them.
### Does it work without the Enterprise API?
Yes. Local WAF, TOTP, hide login, honeypots, malware scanner, quarantine, session
manager, traffic monitoring, hardening, audit log, and exports work fully standalone.
### How do I enable authenticator 2FA?
Open **Users Profile**, generate a TOTP secret, add it to your authenticator app,
and confirm with a 6-digit code. Store the backup codes shown once.
### What if I forget my hidden login URL?
Rename the plugin folder via FTP/SFTP to disable it, or look up the `ariasesu_hide_login_slug`
option in the `wp_options` table.
### How does Cloudflare integration work?
When the local firewall detects a malicious IP (brute-force, honeypot trigger, etc.),
it can automatically push a block rule to Cloudflare — but only if you have enabled
integration and provided API credentials.
### Is it compatible with multisite?
Yes. A network admin screen shows per-site scores and can apply baseline hardening
across the network.
### How is the Security Score calculated?
The score analyzes enabled protections (local WAF, TOTP, hide login, headers, hardening,
scanner, audit log, HTTPS) and known misconfigurations, then maps the result to
a letter grade A–F. Connecting the Enterprise API is optional and only adds a small
bonus.
### Are there WP-CLI commands?
Yes: `wp aria score`, `wp aria scan`, `wp aria checksums`, `wp aria ban add|remove
`, `wp aria export`, and `wp aria events`.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Aria Security Suite” is open source software. The following people have contributed
to this plugin.
Contributors
* [ Alireza Aminzadeh ](https://profiles.wordpress.org/syeedalireza/)
[Translate “Aria Security Suite” into your language.](https://translate.wordpress.org/projects/wp-plugins/aria-security-suite)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/aria-security-suite/),
check out the [SVN repository](https://plugins.svn.wordpress.org/aria-security-suite/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/aria-security-suite/)
by [RSS](https://plugins.trac.wordpress.org/log/aria-security-suite/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.3.0
* Added: Standalone local WAF (no API required), IP allow/block lists, custom rules,
JS challenge.
* Added: TOTP authenticator 2FA with backup codes (independent of the Enterprise
API).
* Added: WordPress.org checksum verification, malware quarantine, database heuristic
scan.
* Added: Hardening switches — file editor, user enumeration, REST lock, application
passwords, HSTS, Referrer-Policy.
* Added: Admin audit log, weekly email digest, local CSV/HTML export, encrypted
local backup.
* Added: Session manager for all users, new-device login alerts, admin IP allowlist,
password policy.
* Added: Geo allowlist mode, XML-RPC pingback-only, endpoint rate limits, WooCommerce
checkout protection.
* Added: Honeypots for Gravity Forms, WPForms, Elementor, Fluent Forms, and WooCommerce.
* Added: Multisite network overview, WP-CLI (`wp aria`), optional virtual-patch
pull from the API.
* Improved: Security score no longer requires an API connection for a high grade.
* Improved: Tested up to WordPress 7.0.
#### 1.2.5
* Initial public release on WordPress.org Plugin Directory.
* Updated readme and documentation for repository guidelines.
* Tested up to WordPress 6.7.
#### 1.2.4
* Updated: Tested up to WordPress 6.7.
#### 1.2.3
* Fixed: Vulnerability scanner no longer phones home unless API is configured and
the feature is explicitly opted in (off by default).
* Fixed: Removed writing `.htaccess` into `wp-includes` (WordPress.org policy).
* Fixed: Input sanitization for `$_SERVER` and admin proxy header settings.
* Fixed: Correct WordPress directory APIs (`WP_PLUGIN_DIR`, `get_theme_root()`,`
wp_upload_dir()`).
* Added: `composer.json` included in plugin distribution package.
* Added: External services documentation in readme.
* Added: Dedicated honeypot login stylesheet (no inline CSS).
* Improved: API client refuses requests when credentials are not configured.
* Improved: Admin and front-end UI styles moved from inline markup to enqueued
CSS files.
#### 1.2.2
* Fixed: WordPress Plugin Check compliance — database queries now use safe table-
name concatenation instead of interpolated placeholders.
* Fixed: Global variable prefixes in uninstall routine aligned with plugin naming
conventions.
* Improved: Distribution packaging excludes development-only files.
#### 1.2.1
* Maintenance and stability improvements.
#### 1.2.0
* Added: Live Traffic Monitoring dashboard.
* Added: Security Score grading system.
* Added: Dashboard Widget and Admin Bar integration.
* Added: AJAX-based 3-step Onboarding Wizard.
* Added: Hide Login Page, Passwordless login, Session Management.
* Added: Heuristic Malware Scanner, Cloudflare integration, Geo-blocking.
* Added: PHP execution blocking in uploads, Contact Form 7 honeypot.
* Updated: Modern AJAX admin UI.
#### 1.1.0
* Initial release of the Enterprise API Client.
* WAF offload, HMAC signing, Hash scanner, Remote Logging.
## Meta
* Version **1.3.0**
* Last updated **3 dies ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.2 or higher **
* Tested up to **7.0.4**
* PHP version ** 7.4 or higher **
* Language
* [English (US)](https://wordpress.org/plugins/aria-security-suite/)
* Tags
* [firewall](https://bal.wordpress.org/plugins/tags/firewall/)[login](https://bal.wordpress.org/plugins/tags/login/)
[malware scanner](https://bal.wordpress.org/plugins/tags/malware-scanner/)[security](https://bal.wordpress.org/plugins/tags/security/)
[two factor](https://bal.wordpress.org/plugins/tags/two-factor/)
* [Advanced View](https://bal.wordpress.org/plugins/aria-security-suite/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/aria-security-suite/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/aria-security-suite/reviews/)
## Contributors
* [ Alireza Aminzadeh ](https://profiles.wordpress.org/syeedalireza/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/aria-security-suite/)
## Donate
Would you like to support the advancement of this plugin?
[ Donate to this plugin ](https://aryait.net/)