=== Liveupx Security === Contributors: liveupx Tags: security, firewall, login protection, brute force, malware scanner Requires at least: 5.0 Tested up to: 6.9 Requires PHP: 7.4 Stable tag: 2.0.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Complete WordPress security — login protection, firewall, 2FA, file scanner, security headers, rate limiting, country blocking. 100% free. == Description == **Liveupx Security** is a comprehensive, lightweight WordPress security plugin that protects your website against hackers, brute force attacks, malware injections, and malicious bots. Developed and maintained by [Liveupx.com](https://liveupx.com) — a WordPress development agency. **100% free. No premium upsells. No data sent to external servers.** = Features = **Login Security** * Brute force protection with automatic IP lockout * Configurable attempt limits and lockout durations * Login honeypot field to trap automated bots * Simple math CAPTCHA for human verification * Hide specific login error messages to prevent username leaks * Custom login URL — hide wp-login.php from bots * Alert admin on new administrator account creation **Two-Factor Authentication** * Email-based OTP (6-digit code) sent on login * Configurable by role — require 2FA only for administrators, editors, etc. * 10-minute code expiry with automatic cleanup **Web Application Firewall** * Block malicious query strings (SQL injection, XSS, LFI, RFI, null bytes) * Block known vulnerability scanners (sqlmap, nikto, wpscan, nmap, etc.) * Disable XML-RPC to prevent DDoS amplification * Disable pingbacks * Hide WordPress version from source code and headers * Rate limiting — configurable requests per time window (returns 429) * Country blocking — block entire countries by ISO code * Admin IP restriction — limit wp-admin access to specific IPs * CIDR range blocking — block entire IP ranges * Apache .htaccess rules — server-level protection **HTTP Security Headers** * X-Frame-Options — prevent clickjacking * X-Content-Type-Options — prevent MIME sniffing * X-XSS-Protection — legacy browser XSS filter * Referrer-Policy — control referrer information leakage * Permissions-Policy — restrict browser feature access * Strict-Transport-Security (HSTS) — force HTTPS with configurable max-age * Content-Security-Policy — advanced resource loading control * Removes X-Powered-By header **File Integrity Scanner** * Compares every WordPress core file against official WordPress.org checksums API * Detects modified, missing, and unknown PHP files in core directories * Runs daily via WP-Cron and emails you when issues are found * One-click manual scan from the admin dashboard **User Security** * User enumeration protection via ?author= redirect blocking * REST API /wp/v2/users endpoint protection * Strong password enforcement (length, uppercase, lowercase, numbers, special chars) * Block common dangerous usernames (admin, administrator, root) * Disable theme/plugin file editor (DISALLOW_FILE_EDIT) **IP Management** * Manual IP and CIDR range blocking with reason * IP whitelisting for trusted sources that bypass all checks * Automatic blocking after firewall violations * Automatic lockout on brute force detection **Activity Monitoring** * Comprehensive security event log with pagination and event-type filtering * CSV export for external analysis * Tracks login success/failure, lockouts, IP blocks, profile updates, file changes, 2FA events * Automatic cleanup of old log entries (30-day retention) = Why Choose Liveupx Security? = * **Truly Free** — No premium tier, no upsells, 100% open source (GPL) * **Lightweight** — Optimized queries, caching, and minimal footprint * **Privacy First** — All data stays on your server. No external APIs except WordPress.org checksums * **Works with Nginx and Apache** — PHP protection is server-agnostic; .htaccess rules are Apache-only * **Compatible** — Works alongside all major caching and page builder plugins = Powered by Liveupx.com = Liveupx Security is built by [Liveupx.com](https://liveupx.com), a WordPress development agency offering security audits, custom development, and performance optimization. We also recommend pairing this plugin with reliable hosting. Our cloud hosting partner **[xHost](https://xhost.live)** provides WordPress-optimized cloud hosting with built-in DDoS protection — developed by Liveupx.com. [xHost was featured at JustHunt.co](https://justhunt.co/startups/x-security) — a startup discovery platform. = Documentation = For documentation and support, visit [liveupx.com](https://liveupx.com) or open a support thread on the WordPress.org forums. = Data Storage = This plugin stores the following data locally in your WordPress database: * Failed login attempts (IP, username, timestamp) * Login lockouts (IP, duration, reason) * Blocked and whitelisted IP addresses * Security activity log (events, user info, IP addresses) * Rate limiting counters (IP, request count, window start) All data is stored **only on your server** and is never transmitted to external services. Data is automatically cleaned up (failed logins: 7 days, activity logs: 30 days). == Installation == = Automatic = 1. Go to Plugins > Add New in your WordPress admin 2. Search for "Liveupx Security" 3. Click "Install Now" then "Activate" = Manual = 1. Download the plugin ZIP 2. Go to Plugins > Add New > Upload Plugin 3. Upload the ZIP and activate = After Activation = 1. Visit Liveupx Security in your admin sidebar 2. Configure settings under Settings 3. Optionally enable .htaccess protection under Firewall 4. Enable Two-Factor Authentication for administrators == Frequently Asked Questions == = Will this slow down my site? = No. Security checks use optimized DB queries with proper indexes, transient caching for geo-lookup, and early exits for whitelisted IPs. = What if I get locked out of my own site? = 1. Connect from a whitelisted IP 2. Wait for the lockout to expire 3. Use FTP/SSH to rename the plugin folder temporarily 4. Access your database directly and clear `xsec_login_lockouts` = Does .htaccess protection work on Nginx? = No — .htaccess is Apache-only. All PHP-based features work on any web server including Nginx, LiteSpeed, and Caddy. = Can I use this with Wordfence or iThemes Security? = We recommend using only one security plugin to avoid conflicts. Liveupx Security provides comprehensive coverage on its own. = Does the file scanner catch everything? = The scanner checks WordPress core files only. It does not scan plugin or theme files (there is no reliable third-party API for those checksums). For plugins, keep them updated and only install from trusted sources. = Is this compatible with WooCommerce? = Yes. Liveupx Security is fully compatible with WooCommerce, including the WooCommerce login form (honeypot and captcha apply to wp-login.php only by default). = How does country blocking work? = Country lookups use the free ip-api.com service with 7-day transient caching to minimize external requests. The lookup is skipped for local/private IPs. == Screenshots == 1. Security Dashboard — score, stats, protection status, and recent activity 2. Settings — all features configurable from one page 3. Security Headers — view and configure all HTTP security headers 4. Two-Factor Authentication — email OTP for administrator login 5. File Integrity Scanner — compare core files against WordPress.org checksums 6. Login Security — lockout and failed attempt tables 7. Firewall — status panel and .htaccess management 8. IP Manager — block, unblock, and whitelist with CIDR support 9. Activity Log — filterable, exportable security event log == Changelog == = 2.0.0 = * NEW: Two-Factor Authentication via email OTP (configurable by role) * NEW: HTTP Security Headers module (X-Frame-Options, HSTS, CSP, Referrer-Policy, Permissions-Policy) * NEW: WordPress File Integrity Scanner with official checksums API * NEW: Rate Limiting with configurable requests per time window (returns HTTP 429) * NEW: Country Blocking via ISO country codes * NEW: Admin IP Restriction — limit wp-admin to specific IPs * NEW: CIDR range blocking support * NEW: Custom Login URL — hide wp-login.php * NEW: Alert admin on new administrator account creation * NEW: CSV export for activity log * NEW: Event-type filter on Activity Log page * NEW: Failed logins count on dashboard stats * NEW: Protection Status widget on dashboard * NEW: Navigation bar across all admin pages * NEW: Rate limiting DB table * FIXED: Security Scan modal was showing blank results (JS was reading item.title on plain string items) * FIXED: Cron jobs (xsec_cleanup, xsec_daily_scan) were never scheduled on activation * FIXED: File scan button now uses dedicated AJAX action with 2-minute timeout * IMPROVED: Security score now covers 100 points including headers and 2FA * IMPROVED: .htaccess rules now include security headers section * IMPROVED: Bot list updated with additional modern scanners = 1.5.2 = * Fixed database tables not being created on activation in some environments * Added fallback table creation check on plugin load * Improved compatibility with WordPress Playground = 1.5.1 = * Moved inline CSS to external stylesheet for blocked page template * Removed development files * Improved i18n support = 1.5.0 = * Fixed all remaining WordPress Plugin Check warnings * Improved SQL query handling with proper phpcs directives * Enhanced array input sanitization using map_deep() * Full PHPCS compliance = 1.0.0 = * Initial release == Upgrade Notice == = 2.0.0 = Major update with Two-Factor Authentication, File Integrity Scanner, Security Headers, Rate Limiting, and Country Blocking. All previous features enhanced with bug fixes. == Privacy Policy == Liveupx Security stores the following data locally in your WordPress database: * **Login Attempts**: IP addresses, usernames, and timestamps of failed login attempts * **Lockouts**: IP addresses and lockout details for brute force protection * **Activity Log**: Security events including user actions, IP addresses, and timestamps * **IP Lists**: Manually blocked and whitelisted IP addresses * **Rate Limits**: Request counts per IP per time window Data is used solely for security purposes and is **never shared with third parties**. Country lookups use the free ip-api.com service (IP sent externally; no personal data beyond the IP). WordPress file checksums are fetched from api.wordpress.org (no personal data sent). When the plugin is uninstalled, all data is permanently deleted from your database.