=== Liveupx Security === Contributors: liveupx Tags: security, firewall, malware scanner, login protection, two factor authentication Requires at least: 5.0 Tested up to: 6.9 Requires PHP: 7.4 Stable tag: 3.0.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Complete WordPress security — malware scanner & remover, core repair, 2FA (TOTP + Email), firewall, security headers, and post-hack recovery. 100% free. == Description == **Liveupx Security** is a complete, professional-grade WordPress security plugin with zero paid tiers. Every feature is fully functional and free — forever. Developed by [Liveupx.com](https://liveupx.com) — a WordPress development agency. We keep this plugin free and compete with the best. For expert security help, [contact us](https://liveupx.com/contact). = Malware Scanner & Remover = * Scans all PHP and JS files in plugins, themes, uploads, and mu-plugins * 25+ malicious code patterns: eval(base64_decode()), shell injections, backdoors (r57, c99, WSO), crypto miners, remote file inclusion, obfuscated function calls * Chunked scanning with live progress bar — no timeouts on large sites * Quarantine infected files (moves them out of webroot, blocks execution) * Permanently delete malicious files * Scheduled daily scan with email alert when malware is found = Core File Repair = * Downloads original WordPress core files directly from WordPress.org SVN * Verifies each file against official MD5 checksum before writing * Repair individual or all modified/missing core files in one click * Detects unknown PHP files in wp-admin and wp-includes = Two-Factor Authentication = * **TOTP (Google Authenticator, Authy, 1Password)** — full RFC 6238 implementation, pure PHP, zero external libraries * **Email OTP** fallback — 6-digit code, 10-minute expiry * Configurable per role — require 2FA only for administrators, editors, or any role * Backup codes — 8 single-use codes, regeneratable any time * QR code setup on the WordPress profile page = Web Application Firewall = * Block SQL injection, XSS, LFI, RFI, null byte attacks * Block known vulnerability scanners (sqlmap, nikto, wpscan, nuclei, etc.) * Rate limiting — configurable requests per time window (returns HTTP 429) * Country blocking by ISO code * Admin IP restriction — whitelist IPs for wp-admin access * CIDR range blocking * Disable XML-RPC * Remove WordPress version = HTTP Security Headers = * X-Frame-Options (clickjacking protection) * X-Content-Type-Options (MIME sniffing protection) * X-XSS-Protection * Referrer-Policy (configurable) * Permissions-Policy * HSTS — Strict-Transport-Security with includeSubDomains and preload * Content-Security-Policy (advanced, editable) * Remove X-Powered-By = Login Security = * Brute force lockout with configurable attempts and duration * Login honeypot — hidden field traps bots instantly * Math CAPTCHA * Hide login errors * Custom login URL — hide wp-login.php (returns 404) * Alert admin when a new administrator account is created = Post-Hack Recovery = * **Lock & Protect System Folders** — prevent PHP execution in uploads and wp-includes via .htaccess * **Log Out All Users** — destroys every active session instantly * **Force Password Reset** — prompts all users to change password on next login * **Reinstall All Free Plugins** — re-downloads from WordPress.org, removes injected code * **Delete Version-Revealing Files** — removes readme.html, license.txt, wp-config-sample.php * **Disable RSS & Atom Feeds** — blocks content scraping endpoints * Weekly security report email — failed logins, lockouts, IPs blocked, malware status = User Security = * User enumeration protection (?author= redirect + REST API endpoint removal) * Strong password enforcement (length, uppercase, lowercase, numbers, special chars) * Block dangerous usernames (admin, administrator, root) * Disable theme/plugin file editor = Activity Monitoring = * Full security event log — paginated, filterable by event type * CSV export * Real-time dashboard stats * 30-day auto-cleanup = 100% Free — No Premium Tier = Every single feature above is fully functional and free. No upsells inside the plugin features. We earn revenue by offering [Liveupx.com services](https://liveupx.com/contact) to users who need expert help — not by paywalling features. = Powered by Liveupx.com = Liveupx Security is built by [Liveupx.com](https://liveupx.com), a WordPress development agency. Our cloud hosting partner **[xHost](https://xhost.live)** provides WordPress-optimized cloud hosting with built-in DDoS protection — developed by Liveupx.com, [featured on JustHunt.co](https://justhunt.co/startups/x-security). == Installation == 1. Go to Plugins > Add New, search "Liveupx Security", install and activate 2. Visit **Liveupx Security** in your admin sidebar 3. Run a Security Scan to see your score 4. Enable Two-Factor Authentication in Settings 5. Run a Malware Scan from the Malware Scanner page == Frequently Asked Questions == = Does the malware scanner find everything? = It detects common malware patterns and known backdoor signatures. No scanner catches 100% of threats — combine with file monitoring and regular updates. = Will TOTP work with any authenticator app? = Yes. Any RFC 6238 TOTP app works: Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and more. = Does core repair work with all WordPress versions? = Yes. It fetches files from the official WordPress.org SVN for your exact version and locale. = Does the firewall work on Nginx? = All PHP-based features work on any server. The .htaccess features are Apache-only. = Is any data sent externally? = Country lookups use ip-api.com (IP sent, 7-day cache). Core checksums fetched from api.wordpress.org. QR code generation uses Google Charts API (otpauth URL only). No personal data is ever sent. == Screenshots == 1. Dashboard — security score, stats, protection status 2. Malware Scanner — progress bar, infected file list with quarantine/delete actions 3. Post-Hack Recovery — system folder locking, core repair, emergency actions 4. Two-Factor Authentication setup — QR code on profile page 5. Security Headers — full header control panel 6. Settings — all features on one page 7. Activity Log — filterable, exportable == Changelog == = 3.0.0 = * NEW: Malware Scanner with 25+ pattern detection, chunked scanning, progress bar * NEW: File quarantine (moves file out of webroot) and permanent delete * NEW: TOTP 2FA — Google Authenticator compatible (RFC 6238, pure PHP, no dependencies) * NEW: 2FA backup codes (8 codes, single-use, regeneratable) * NEW: Core File Repair — downloads and restores files from WordPress.org SVN * NEW: Lock & Protect System Folders (blocks PHP execution in uploads + wp-includes) * NEW: Log Out All Users (destroy all sessions instantly) * NEW: Force Password Reset for all users * NEW: Reinstall All Free Plugins from WordPress.org * NEW: Delete version-revealing files (readme.html, license.txt, wp-config-sample.php) * NEW: Disable RSS & Atom Feeds * NEW: Weekly security report email * NEW: Post-Hack admin page with emergency recovery tools * NEW: Upsell panel for Liveupx.com services (no feature paywalls) * IMPROVED: 2FA now prefers TOTP over email OTP if user has set up authenticator app * IMPROVED: Security score expanded to cover new modules = 2.0.0 = * Two-Factor Authentication (Email OTP), Security Headers, File Integrity Scanner * Rate Limiting, Country Blocking, Admin IP Restriction, CIDR Blocking * CSV export, weekly report cron, fixed scan modal JS bug, fixed cron scheduling = 1.5.2 = * Fixed database tables not being created on some hosting environments = 1.0.0 = * Initial release == Upgrade Notice == = 3.0.0 = Major update: Malware Scanner, TOTP 2FA, Core File Repair, and full Post-Hack Recovery toolkit. All features 100% free. == Privacy Policy == Data stored locally: login attempts, lockouts, blocked IPs, activity log, rate limit counters. External requests: ip-api.com for country lookups (IP only, cached 7 days), api.wordpress.org for file checksums, Google Charts for TOTP QR codes (otpauth URL only). No personal data is ever sent to Liveupx.com or any third party.