{"id":319217,"date":"2026-06-26T14:08:24","date_gmt":"2026-06-26T14:08:24","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/shieldguard-security\/"},"modified":"2026-08-17T09:46:55","modified_gmt":"2026-08-17T09:46:55","slug":"aria-security-suite","status":"publish","type":"plugin","link":"https:\/\/bal.wordpress.org\/plugins\/aria-security-suite\/","author":15728675,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.3.0","stable_tag":"1.3.0","tested":"7.0.4","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Aria Security Suite","header_author":"Alireza Aminzadeh","header_description":"Enterprise security client: API-signed requests, WAF offload, IDS, integrity, remote logging.","assets_banners_color":"021b45","last_updated":"2026-08-17 09:46:55","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/aryait.net\/","header_plugin_uri":"https:\/\/ariacoder.ir\/aria-security-suite-wordpress\/","header_author_uri":"https:\/\/github.com\/alireza-aminzadeh","rating":0,"author_block_rating":0,"active_installs":0,"downloads":147,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.2.5":{"tag":"1.2.5","author":"syeedalireza","date":"2026-06-26 14:08:05"},"1.3.0":{"tag":"1.3.0","author":"syeedalireza","date":"2026-08-17 09:46:55"}},"upgrade_notice":{"1.3.0":"<p>Standalone security upgrade: local WAF, TOTP, hardening, audit log, and exports. Cloud features stay opt-in. Tested up to WordPress 7.0.<\/p>","1.2.5":"<p>First WordPress.org release. All cloud and external service features remain opt-in by default.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3587349,"resolution":"128x128","location":"assets","locale":"","width":128,"height":131},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3587349,"resolution":"256x256","location":"assets","locale":"","width":256,"height":261}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3587349,"resolution":"1544x500","location":"assets","locale":"","width":1554,"height":354},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3587349,"resolution":"772x250","location":"assets","locale":"","width":772,"height":249}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.5","1.3.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Security dashboard with grade score and threat overview","2":"Onboarding wizard \u2014 3-step setup","3":"Live traffic monitoring panel","4":"Firewall and Cloudflare settings","5":"Session manager \u2014 active devices list"}},"plugin_section":[262246],"plugin_tags":[1174,602,55021,600,9217],"plugin_category":[38,54],"plugin_contributors":[253123],"plugin_business_model":[],"class_list":["post-319217","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-firewall","plugin_tags-login","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-syeedalireza","plugin_committers-syeedalireza"],"banners":{"banner":"https:\/\/ps.w.org\/aria-security-suite\/assets\/banner-772x250.png?rev=3587349","banner_2x":"https:\/\/ps.w.org\/aria-security-suite\/assets\/banner-1544x500.png?rev=3587349","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/aria-security-suite\/assets\/icon-128x128.png?rev=3587349","icon_2x":"https:\/\/ps.w.org\/aria-security-suite\/assets\/icon-256x256.png?rev=3587349","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p><strong>Aria Security Suite<\/strong> is a modular, production-ready security plugin for WordPress. It delivers enterprise-level protection that works <strong>standalone on your server<\/strong> \u2014 and can optionally connect to your own <strong>Enterprise Security API<\/strong> for centralized WAF decisions, integrity checks, and reporting.<\/p>\n\n<p>Built with clean PHP architecture (PSR-4), a modern AJAX admin experience, and privacy-first defaults: <strong>no outbound calls until you configure and enable each feature.<\/strong><\/p>\n\n<h4>Why Aria Security Suite?<\/h4>\n\n<ul>\n<li><strong>All-in-one protection<\/strong> \u2014 local WAF, login hardening, TOTP, malware scanning, honeypots, session control, and live traffic monitoring in one plugin.<\/li>\n<li><strong>Works without the cloud<\/strong> \u2014 firewall, 2FA, scanners, hardening, audit log, and exports run fully on your site.<\/li>\n<li><strong>Zero performance penalty<\/strong> \u2014 heavy scans and log sync run in the background via WP-Cron or Action Scheduler.<\/li>\n<li><strong>Privacy by design<\/strong> \u2014 cloud API, Cloudflare, geo lookups, checksums, vulnerability scanning, HIBP, and webhooks are <strong>opt-in only<\/strong>.<\/li>\n<li><strong>Actionable security score<\/strong> \u2014 grades your site A\u2013F from real hardening, not from whether an API is connected.<\/li>\n<li><strong>Developer-friendly<\/strong> \u2014 modular codebase, REST API endpoints, WP-CLI (<code>wp aria<\/code>), HMAC-signed API client, and GPL-licensed.<\/li>\n<\/ul>\n\n<h4>Setup &amp; Dashboard<\/h4>\n\n<ul>\n<li><strong>3-step Onboarding Wizard<\/strong> \u2014 choose Basic, Medium, or Strict presets in seconds.<\/li>\n<li><strong>Security Grade Score (0\u2013100)<\/strong> \u2014 real-time posture analysis with actionable tips.<\/li>\n<li><strong>Dashboard Widget &amp; Admin Bar<\/strong> \u2014 security status at a glance from any admin screen.<\/li>\n<li><strong>Modern AJAX UI<\/strong> \u2014 fast, reload-free settings with responsive design.<\/li>\n<\/ul>\n\n<h4>Login &amp; Authentication<\/h4>\n\n<ul>\n<li><strong>Hide Login Page<\/strong> \u2014 replace <code>wp-login.php<\/code> with a custom secret URL.<\/li>\n<li><strong>Passwordless Login (Magic Links)<\/strong> \u2014 secure email-based one-time login tokens.<\/li>\n<li><strong>TOTP 2FA<\/strong> \u2014 authenticator-app second factor with backup codes. Works without the Enterprise API. Enroll from your WordPress profile.<\/li>\n<li><strong>Force TOTP by role<\/strong> \u2014 require authenticator setup for selected roles.<\/li>\n<li><strong>API email 2FA<\/strong> \u2014 optional second factor via your Enterprise API.<\/li>\n<li><strong>Session Manager<\/strong> \u2014 view and remotely destroy active sessions for all users.<\/li>\n<li><strong>Device Fingerprinting<\/strong> \u2014 recognize trusted admin devices.<\/li>\n<li><strong>New-device login alerts<\/strong> \u2014 email the account owner when a new browser or country appears.<\/li>\n<li><strong>Admin IP allowlist<\/strong> \u2014 restrict administrator sign-in to specific IPs or CIDRs.<\/li>\n<li><strong>Password policy<\/strong> \u2014 minimum length, letters + numbers, optional Have I Been Pwned check (k-anonymity, opt-in).<\/li>\n<li><strong>Brute-Force Protection<\/strong> \u2014 rate limiting and automatic IP bans on failed logins.<\/li>\n<\/ul>\n\n<h4>Firewall &amp; Network (WAF)<\/h4>\n\n<ul>\n<li><strong>Local Web Application Firewall<\/strong> \u2014 inspects requests on the server for SQLi, XSS, path traversal, and wrapper patterns. No API required.<\/li>\n<li><strong>IP allowlist \/ blocklist<\/strong> \u2014 IPs and CIDR ranges, one per line.<\/li>\n<li><strong>Custom WAF rules<\/strong> \u2014 block or challenge by path, query, or user-agent.<\/li>\n<li><strong>JS challenge page<\/strong> \u2014 lightweight browser check before a hard block.<\/li>\n<li><strong>Optional API offload<\/strong> \u2014 send WAF decisions to your Enterprise API when configured.<\/li>\n<li><strong>Cloudflare Integration<\/strong> \u2014 push banned IPs to the Cloudflare edge firewall (CDN level).<\/li>\n<li><strong>Geo-Blocking<\/strong> \u2014 block listed countries or allow only listed countries. Uses CF-IPCountry, then GeoIP, then ip-api.com (24-hour cache).<\/li>\n<li><strong>PHP Execution Blocker<\/strong> \u2014 prevent PHP execution in <code>uploads<\/code> via <code>.htaccess<\/code> \/ <code>web.config<\/code>.<\/li>\n<li><strong>User-Agent Filtering<\/strong> \u2014 block known malicious bots and scanners.<\/li>\n<li><strong>XML-RPC Control<\/strong> \u2014 leave enabled, allow pingback only, or disable <code>xmlrpc.php<\/code> completely.<\/li>\n<li><strong>Virtual patches<\/strong> \u2014 optional extra block rules pulled from the Enterprise API.<\/li>\n<\/ul>\n\n<h4>Scanners &amp; Integrity<\/h4>\n\n<ul>\n<li><strong>Heuristic Malware Scanner<\/strong> \u2014 background scan for suspicious patterns, plus a limited database content check.<\/li>\n<li><strong>Quarantine \/ restore<\/strong> \u2014 move suspicious files out of the web root and restore them from the admin UI.<\/li>\n<li><strong>File Integrity Monitor<\/strong> \u2014 detect unauthorized changes to core WordPress files.<\/li>\n<li><strong>WordPress.org checksums<\/strong> \u2014 compare core and hosted plugin files with official checksums (opt-in).<\/li>\n<li><strong>Hash Scanner<\/strong> \u2014 verify file hashes against known-good baselines.<\/li>\n<li><strong>Vulnerability Scanner<\/strong> \u2014 optional cloud comparison of installed plugin versions (explicit opt-in).<\/li>\n<\/ul>\n\n<h4>Spam &amp; Intrusion Prevention<\/h4>\n\n<ul>\n<li><strong>Invisible Honeypots<\/strong> \u2014 comments, registration, login, Contact Form 7, Gravity Forms, WPForms, Elementor, Fluent Forms, and WooCommerce \u2014 no CAPTCHA needed.<\/li>\n<li><strong>Endpoint rate limits<\/strong> \u2014 REST, comments, password reset, and XML-RPC.<\/li>\n<li><strong>Behavioral Analysis<\/strong> \u2014 detect anomalous request patterns.<\/li>\n<li><strong>WooCommerce protection<\/strong> \u2014 rate-limit checkout and coupon abuse.<\/li>\n<li><strong>Global Ban Sync<\/strong> \u2014 share ban lists when connected to the Enterprise API.<\/li>\n<\/ul>\n\n<h4>Monitoring, Logging &amp; Alerts<\/h4>\n\n<ul>\n<li><strong>Live Traffic Monitoring<\/strong> \u2014 real-time request log with IP, path, status codes, and user-agents.<\/li>\n<li><strong>Admin audit log<\/strong> \u2014 plugin, user, role, and Aria setting changes.<\/li>\n<li><strong>Weekly email digest<\/strong> \u2014 score and event counts to the site admin email.<\/li>\n<li><strong>Local CSV \/ HTML export<\/strong> \u2014 download events or open a local report without the API.<\/li>\n<li><strong>Encrypted local backup<\/strong> \u2014 snapshot of Aria settings and recent events.<\/li>\n<li><strong>SQL Query Analyzer<\/strong> \u2014 surface slow or suspicious database queries.<\/li>\n<li><strong>Log Rotation<\/strong> \u2014 automatic cleanup with configurable retention.<\/li>\n<li><strong>Webhooks<\/strong> \u2014 instant alerts to <strong>Slack<\/strong>, <strong>Telegram<\/strong>, or custom JSON endpoints.<\/li>\n<li><strong>Central Reporting<\/strong> \u2014 signed log export to your Enterprise API.<\/li>\n<li><strong>Encrypted Cloud Backup Requests<\/strong> \u2014 trigger cloud backups from the admin panel when the API is configured.<\/li>\n<\/ul>\n\n<h4>Hardening &amp; Headers<\/h4>\n\n<ul>\n<li><strong>Disable the theme\/plugin file editor<\/strong> (<code>DISALLOW_FILE_EDIT<\/code>).<\/li>\n<li><strong>Block user enumeration<\/strong> \u2014 <code>?author=1<\/code> and <code>\/wp\/v2\/users<\/code> for guests.<\/li>\n<li><strong>Lock anonymous REST API<\/strong> \u2014 with an allowlist for commerce and form plugins.<\/li>\n<li><strong>Disable application passwords<\/strong>.<\/li>\n<li><strong>FORCE_SSL_ADMIN<\/strong> and secure auth cookies.<\/li>\n<li><strong>Security Headers<\/strong> \u2014 CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.<\/li>\n<li><strong>Table Prefix Advisor<\/strong> \u2014 guidance for safer database prefixes.<\/li>\n<li><strong>Crypto Vault<\/strong> \u2014 secure storage for API secrets and TOTP material.<\/li>\n<\/ul>\n\n<h4>Multisite &amp; WP-CLI<\/h4>\n\n<ul>\n<li><strong>Network admin screen<\/strong> \u2014 per-site security scores and baseline hardening across the network.<\/li>\n<li><strong>WP-CLI<\/strong> \u2014 <code>wp aria score<\/code>, <code>wp aria scan<\/code>, <code>wp aria checksums<\/code>, <code>wp aria ban add|remove &lt;ip&gt;<\/code>, <code>wp aria export<\/code>, <code>wp aria events<\/code>.<\/li>\n<\/ul>\n\n<h4>Optional Enterprise API<\/h4>\n\n<p>Connect your own API endpoint for WAF offload, heartbeat health checks, hash verification, ban reporting, quota lookups, virtual patches, and vulnerability intelligence. Credentials are stored encrypted; every request is signed with <strong>HMAC-SHA256<\/strong>.<\/p>\n\n<p><strong>Developer:<\/strong> <a href=\"https:\/\/github.com\/alireza-aminzadeh\">Alireza Aminzadeh<\/a> (<a href=\"https:\/\/profiles.wordpress.org\/syeedalireza\/\">syeedalireza<\/a>)<br \/>\n<strong>Websites:<\/strong> <a href=\"https:\/\/aryait.net\/\">aryait.net<\/a> \u00b7 <a href=\"https:\/\/ariacoder.ir\/\">ariacoder.ir<\/a><br \/>\n<strong>GitHub:<\/strong> <a href=\"https:\/\/github.com\/alireza-aminzadeh\/aria-security-suite\">github.com\/alireza-aminzadeh\/aria-security-suite<\/a><\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin may connect to third-party or external services <strong>only when you explicitly enable and configure the related feature<\/strong>. No outbound tracking or data collection occurs by default.<\/p>\n\n<h4>Enterprise Security API (optional)<\/h4>\n\n<p>When you enter an API Base URL, Site ID, and Secret Key under <strong>API &amp; Connection<\/strong>, the plugin can send signed requests to your configured Enterprise Security API for features such as WAF decisions, heartbeat health checks, hash integrity verification, ban reporting, quota lookups, virtual patches, and (if opted in) vulnerability scanning.<\/p>\n\n<p><strong>Data sent:<\/strong> Request metadata (IP, path, HTTP method, user-agent, query parameter names), security event logs, file hashes, and\u2014only when the Vulnerability Scanner opt-in is enabled\u2014installed plugin slugs and versions.<\/p>\n\n<p><strong>When:<\/strong> Only after credentials are saved and the relevant feature is turned on. Heartbeat runs on WP-Cron when the API is configured. Plugin inventory is sent only when the Vulnerability Scanner opt-in is enabled.<\/p>\n\n<p><strong>Service provider:<\/strong> Your own Enterprise Security API endpoint (URL you provide). You are responsible for that service's terms and privacy policy.<\/p>\n\n<h4>Cloudflare API (optional)<\/h4>\n\n<p>When <strong>Cloudflare integration<\/strong> is enabled and you provide a Zone ID and API token, the plugin calls the Cloudflare API to create firewall access rules that block malicious IP addresses at the CDN edge.<\/p>\n\n<p><strong>Data sent:<\/strong> IP addresses of blocked visitors and a short note identifying the block source.<\/p>\n\n<p><strong>When:<\/strong> Only after you enable Cloudflare integration and supply credentials, and only when a local security rule triggers an IP ban.<\/p>\n\n<p><strong>Service provider:<\/strong> Cloudflare, Inc. \u2014 <a href=\"https:\/\/www.cloudflare.com\/website-terms\/\">Terms of Use<\/a>, <a href=\"https:\/\/www.cloudflare.com\/privacypolicy\/\">Privacy Policy<\/a>.<\/p>\n\n<h4>ip-api.com (optional)<\/h4>\n\n<p>When <strong>Geo-Blocking<\/strong> is enabled and you configure a country list, the plugin queries ip-api.com to resolve a visitor's country code from their IP address if Cloudflare or a local GeoIP source is not available.<\/p>\n\n<p><strong>Data sent:<\/strong> The visitor's IP address.<\/p>\n\n<p><strong>When:<\/strong> Only when Geo-Blocking is enabled, a country list is configured, and the country for an IP is not already cached locally (results are cached for 24 hours).<\/p>\n\n<p><strong>Service provider:<\/strong> ip-api.com \u2014 <a href=\"http:\/\/ip-api.com\/docs\/legal\">Terms &amp; Legal<\/a>, <a href=\"http:\/\/ip-api.com\/docs\/legal\">Privacy Policy<\/a>.<\/p>\n\n<h4>WordPress.org checksums (optional)<\/h4>\n\n<p>When <strong>checksum verification<\/strong> is enabled, the plugin downloads official checksums from WordPress.org to compare core and hosted plugin files on your server.<\/p>\n\n<p><strong>Data sent:<\/strong> WordPress version, locale, and (for plugins) slug + version in the request URL.<\/p>\n\n<p><strong>When:<\/strong> Only when checksum verification is enabled (off by default).<\/p>\n\n<p><strong>Service provider:<\/strong> WordPress.org \u2014 <a href=\"https:\/\/wordpress.org\/about\/privacy\/\">Privacy Policy<\/a>.<\/p>\n\n<h4>Have I Been Pwned (optional)<\/h4>\n\n<p>When the <strong>breached password check<\/strong> is enabled, the plugin sends the first 5 characters of a SHA-1 password hash (k-anonymity) to the Pwned Passwords API.<\/p>\n\n<p><strong>Data sent:<\/strong> SHA-1 hash prefix only (not the password).<\/p>\n\n<p><strong>When:<\/strong> Only after you enable the option, and only when a password is being set or changed.<\/p>\n\n<p><strong>Service provider:<\/strong> Have I Been Pwned \u2014 <a href=\"https:\/\/haveibeenpwned.com\/Privacy\">Privacy<\/a>.<\/p>\n\n<h4>User-configured webhooks (optional)<\/h4>\n\n<p>When you add Slack, Telegram, or generic webhook URLs under <strong>Alerts &amp; Notifications<\/strong>, the plugin POSTs JSON alert payloads to those URLs when security events occur.<\/p>\n\n<p><strong>Data sent:<\/strong> Alert severity, message text, and contextual fields (e.g., IP address, event type).<\/p>\n\n<p><strong>When:<\/strong> Only after you save a webhook URL and a qualifying security event fires.<\/p>\n\n<p><strong>Service provider:<\/strong> The third-party service behind the URL you provide (e.g., Slack, Telegram). See their respective terms and privacy policies.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>aria-security-suite<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Complete the <strong>Onboarding Wizard<\/strong> (opens automatically on first activation).<\/li>\n<li>Review your <strong>Security Score<\/strong> on the dashboard and apply recommended fixes.<\/li>\n<li>Open <strong>Users \u2192 Profile<\/strong> to enroll in TOTP 2FA.<\/li>\n<li><em>(Optional)<\/em> Enter API Base URL, Site ID, and Secret Key under <strong>Connection &amp; API<\/strong> for cloud features.<\/li>\n<\/ol>\n\n<h4>MU-Plugin early load (optional)<\/h4>\n\n<p>Copy <code>extras\/aria-security-suite-mu-loader.php<\/code> to <code>wp-content\/mu-plugins\/<\/code> to load protection before regular plugins. Do not activate the plugin twice.<\/p>\n\n<h4>Action Scheduler (recommended)<\/h4>\n\n<p>For more reliable background jobs than WP-Cron alone:<\/p>\n\n<pre><code>composer require woocommerce\/action-scheduler\n<\/code><\/pre>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20slow%20down%20my%20site%3F\"><h3>Does this plugin slow down my site?<\/h3><\/dt>\n<dd><p>No. Malware scanning, log synchronization, checksums, and integrity checks run in the background using WP-Cron or Action Scheduler. Your front-end TTFB is unaffected.<\/p><\/dd>\n<dt id=\"is%20my%20data%20sent%20anywhere%20without%20permission%3F\"><h3>Is my data sent anywhere without permission?<\/h3><\/dt>\n<dd><p>No. Remote API calls, vulnerability scanning, Cloudflare blocking, geo lookups, checksums, Have I Been Pwned, and webhooks are all <strong>opt-in<\/strong> and remain off until you configure and enable them.<\/p><\/dd>\n<dt id=\"does%20it%20work%20without%20the%20enterprise%20api%3F\"><h3>Does it work without the Enterprise API?<\/h3><\/dt>\n<dd><p>Yes. Local WAF, TOTP, hide login, honeypots, malware scanner, quarantine, session manager, traffic monitoring, hardening, audit log, and exports work fully standalone.<\/p><\/dd>\n<dt id=\"how%20do%20i%20enable%20authenticator%202fa%3F\"><h3>How do I enable authenticator 2FA?<\/h3><\/dt>\n<dd><p>Open <strong>Users \u2192 Profile<\/strong>, generate a TOTP secret, add it to your authenticator app, and confirm with a 6-digit code. Store the backup codes shown once.<\/p><\/dd>\n<dt id=\"what%20if%20i%20forget%20my%20hidden%20login%20url%3F\"><h3>What if I forget my hidden login URL?<\/h3><\/dt>\n<dd><p>Rename the plugin folder via FTP\/SFTP to disable it, or look up the <code>ariasesu_hide_login_slug<\/code> option in the <code>wp_options<\/code> table.<\/p><\/dd>\n<dt id=\"how%20does%20cloudflare%20integration%20work%3F\"><h3>How does Cloudflare integration work?<\/h3><\/dt>\n<dd><p>When the local firewall detects a malicious IP (brute-force, honeypot trigger, etc.), it can automatically push a block rule to Cloudflare \u2014 but only if you have enabled integration and provided API credentials.<\/p><\/dd>\n<dt id=\"is%20it%20compatible%20with%20multisite%3F\"><h3>Is it compatible with multisite?<\/h3><\/dt>\n<dd><p>Yes. A network admin screen shows per-site scores and can apply baseline hardening across the network.<\/p><\/dd>\n<dt id=\"how%20is%20the%20security%20score%20calculated%3F\"><h3>How is the Security Score calculated?<\/h3><\/dt>\n<dd><p>The score analyzes enabled protections (local WAF, TOTP, hide login, headers, hardening, scanner, audit log, HTTPS) and known misconfigurations, then maps the result to a letter grade A\u2013F. Connecting the Enterprise API is optional and only adds a small bonus.<\/p><\/dd>\n<dt id=\"are%20there%20wp-cli%20commands%3F\"><h3>Are there WP-CLI commands?<\/h3><\/dt>\n<dd><p>Yes: <code>wp aria score<\/code>, <code>wp aria scan<\/code>, <code>wp aria checksums<\/code>, <code>wp aria ban add|remove &lt;ip&gt;<\/code>, <code>wp aria export<\/code>, and <code>wp aria events<\/code>.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>Added: Standalone local WAF (no API required), IP allow\/block lists, custom rules, JS challenge.<\/li>\n<li>Added: TOTP authenticator 2FA with backup codes (independent of the Enterprise API).<\/li>\n<li>Added: WordPress.org checksum verification, malware quarantine, database heuristic scan.<\/li>\n<li>Added: Hardening switches \u2014 file editor, user enumeration, REST lock, application passwords, HSTS, Referrer-Policy.<\/li>\n<li>Added: Admin audit log, weekly email digest, local CSV\/HTML export, encrypted local backup.<\/li>\n<li>Added: Session manager for all users, new-device login alerts, admin IP allowlist, password policy.<\/li>\n<li>Added: Geo allowlist mode, XML-RPC pingback-only, endpoint rate limits, WooCommerce checkout protection.<\/li>\n<li>Added: Honeypots for Gravity Forms, WPForms, Elementor, Fluent Forms, and WooCommerce.<\/li>\n<li>Added: Multisite network overview, WP-CLI (<code>wp aria<\/code>), optional virtual-patch pull from the API.<\/li>\n<li>Improved: Security score no longer requires an API connection for a high grade.<\/li>\n<li>Improved: Tested up to WordPress 7.0.<\/li>\n<\/ul>\n\n<h4>1.2.5<\/h4>\n\n<ul>\n<li>Initial public release on WordPress.org Plugin Directory.<\/li>\n<li>Updated readme and documentation for repository guidelines.<\/li>\n<li>Tested up to WordPress 6.7.<\/li>\n<\/ul>\n\n<h4>1.2.4<\/h4>\n\n<ul>\n<li>Updated: Tested up to WordPress 6.7.<\/li>\n<\/ul>\n\n<h4>1.2.3<\/h4>\n\n<ul>\n<li>Fixed: Vulnerability scanner no longer phones home unless API is configured and the feature is explicitly opted in (off by default).<\/li>\n<li>Fixed: Removed writing <code>.htaccess<\/code> into <code>wp-includes<\/code> (WordPress.org policy).<\/li>\n<li>Fixed: Input sanitization for <code>$_SERVER<\/code> and admin proxy header settings.<\/li>\n<li>Fixed: Correct WordPress directory APIs (<code>WP_PLUGIN_DIR<\/code>, <code>get_theme_root()<\/code>, <code>wp_upload_dir()<\/code>).<\/li>\n<li>Added: <code>composer.json<\/code> included in plugin distribution package.<\/li>\n<li>Added: External services documentation in readme.<\/li>\n<li>Added: Dedicated honeypot login stylesheet (no inline CSS).<\/li>\n<li>Improved: API client refuses requests when credentials are not configured.<\/li>\n<li>Improved: Admin and front-end UI styles moved from inline markup to enqueued CSS files.<\/li>\n<\/ul>\n\n<h4>1.2.2<\/h4>\n\n<ul>\n<li>Fixed: WordPress Plugin Check compliance \u2014 database queries now use safe table-name concatenation instead of interpolated placeholders.<\/li>\n<li>Fixed: Global variable prefixes in uninstall routine aligned with plugin naming conventions.<\/li>\n<li>Improved: Distribution packaging excludes development-only files.<\/li>\n<\/ul>\n\n<h4>1.2.1<\/h4>\n\n<ul>\n<li>Maintenance and stability improvements.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Added: Live Traffic Monitoring dashboard.<\/li>\n<li>Added: Security Score grading system.<\/li>\n<li>Added: Dashboard Widget and Admin Bar integration.<\/li>\n<li>Added: AJAX-based 3-step Onboarding Wizard.<\/li>\n<li>Added: Hide Login Page, Passwordless login, Session Management.<\/li>\n<li>Added: Heuristic Malware Scanner, Cloudflare integration, Geo-blocking.<\/li>\n<li>Added: PHP execution blocking in uploads, Contact Form 7 honeypot.<\/li>\n<li>Updated: Modern AJAX admin UI.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Initial release of the Enterprise API Client.<\/li>\n<li>WAF offload, HMAC signing, Hash scanner, Remote Logging.<\/li>\n<\/ul>","raw_excerpt":"Standalone WordPress security: local WAF, TOTP 2FA, malware scanner, hardening, live traffic, and an optional Enterprise API.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/319217","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=319217"}],"author":[{"embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/syeedalireza"}],"wp:attachment":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=319217"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=319217"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=319217"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=319217"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=319217"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=319217"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}