ArkHost

<p>A complete security plugin that’s actually free. No “pro” version, no nag screens, no made-up threat statistics.</p>
<h4>Login Protection</h4>
<ul>
<li>Blocks IPs after failed login attempts</li>
<li>Custom login URL (hides wp-login.php)</li>
<li>Hides wp-admin from logged-out users</li>
<li>Honeypot field for bots</li>
<li>Hides login errors (stops username enumeration)</li>
<li>Email alerts for admin logins from new IPs</li>
<li>Country/IP restrictions on login page</li>
</ul>
<h4>IP Control</h4>
<ul>
<li>Whitelist and blacklist</li>
<li>Auto-blacklist after repeated lockouts</li>
<li>IPv4, IPv6, CIDR supported</li>
</ul>
<h4>Geo Blocking</h4>
<ul>
<li>Block countries</li>
<li>Uses free IP2Location LITE database</li>
<li>One-click download</li>
</ul>
<h4>Hardening</h4>
<ul>
<li>Disable XML-RPC</li>
<li>Disable dashboard file editing</li>
<li>Disable application passwords</li>
<li>Restrict REST API to logged-in users</li>
<li>Remove WordPress version</li>
<li>Block user enumeration (?author=1 and REST API)</li>
<li>Disable pingbacks/trackbacks</li>
</ul>
<h4>Security Headers</h4>
<p>X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS</p>
<h4>Two-Factor Authentication</h4>
<ul>
<li>TOTP (Google Authenticator, Authy, etc.)</li>
<li>Backup codes</li>
<li>Enforce for admins</li>
</ul>
<h4>File Integrity Monitoring</h4>
<ul>
<li>Checks WordPress core files against official checksums</li>
<li>Daily scans</li>
<li>Email alerts on changes</li>
</ul>
<h4>Malware Scanner</h4>
<ul>
<li>Scans plugins, themes, uploads</li>
<li>Pattern-based detection</li>
<li>Quarantine suspicious files</li>
<li>Weekly scans</li>
</ul>
<h4>Activity Log</h4>
<ul>
<li>Login attempts, lockouts, blocks</li>
<li>IP, country, username, timestamp</li>
<li>Configurable retention</li>
<li>CSV export</li>
</ul>
<h4>Tools</h4>
<ul>
<li>Export/import settings</li>
<li>Force logout all users</li>
<li>Test email</li>
<li>Delete readme.html/license.txt</li>
</ul>
<h4>Privacy</h4>
<p>No tracking. No analytics. No telemetry.</p>
<p>External connections:<br />
* WordPress.org API (core file checksums)<br />
* IP2Location (database download, only when you click it)</p>
<h3>External services</h3>
<p>This plugin connects to the following external services under specific circumstances:</p>
<h4>WordPress.org Checksums API</h4>
<ul>
<li>Service: api.wordpress.org/core/checksums/1.0/</li>
<li>Used for: Verifying WordPress core file integrity by comparing local files against official checksums</li>
<li>Data sent: WordPress version and locale</li>
<li>When: During daily scheduled file integrity scans and when manually triggered by the admin</li>
<li>Privacy policy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>IP Detection Services</h4>
<ul>
<li>Services: api.ipify.org, ifconfig.me, icanhazip.com</li>
<li>Used for: Detecting the server’s public IP address for the “Whitelist My IP” tool</li>
<li>Data sent: Standard HTTP request (no personal data)</li>
<li>When: Only when an admin uses the “Whitelist My IP” feature in the Tools tab</li>
<li>Terms: https://www.ipify.org/ / https://ifconfig.me/ / https://icanhazip.com/</li>
</ul>
<h4>IP2Location</h4>
<ul>
<li>Service: download.ip2location.com</li>
<li>Used for: Downloading the free IP2Location LITE geolocation database for country-based blocking</li>
<li>Data sent: Standard HTTP request (optional: user’s download token if configured)</li>
<li>When: Only when an admin clicks “Download IP2Location Database” in the IP Control tab</li>
<li>Terms of service: https://www.ip2location.com/terms</li>
<li>Privacy policy: https://www.ip2location.com/privacy</li>
</ul>


ArkHost Security Pack

WordPress security without the nonsense. No upsells, no premium tier, no fake threat counters.

quttera

<p>Quttera ThreatSign protects your WordPress website with multi-layered security:</p>
<p><strong>Malware Detection:</strong> Powered by Quttera’s AI-driven heuristic engine, the scanner detects malicious PHP, obfuscated JavaScript, hidden iframes, redirects, spam, SEO malware, and credit-card skimmers targeting checkout pages. The plugin performs on-demand scans directly from your WordPress admin and checks your domain against more than 40 global security authorities, including Google, McAfee, Norton, and Yandex. Detection capabilities are continuously enhanced using insights from Quttera’s worldwide threat intelligence network.</p>
<p><strong>Brute Force Protection:</strong> Prevents unauthorized login attempts with IP locking, configurable rate limiting, and environment-aware protection policies. Supports both shared hosting (aggressive locking) and dedicated servers (progressive delays). Includes emergency bypass mechanism for critical situations.</p>
<p><strong>Bot Protection:</strong> Layered defense against automated attacks using multi-stage risk evaluation, token-bucket rate limiting, and legitimate bot recognition (Googlebot, Bingbot, etc.). Protects REST API, XML-RPC, and WooCommerce endpoints with endpoint-specific risk scoring.</p>
<p><strong>Admin User Monitoring:</strong> Real-time detection and alerting for unauthorized admin additions, removals, and role changes with database audit trail and snapshots.</p>
<p>For complete protection—including automated malware removal, scheduled scanning, WAF, and 24/7 monitoring—you can upgrade to a ThreatSign Website Security plan.</p>
<h4>Malware Detection Features:</h4>
<ul>
<li>One-click on-demand scans from WP admin</li>
<li>0-day (unknown threat) detection via heuristic & behavioral analysis</li>
<li>Detection of malicious PHP (backdoors, shells, injections)</li>
<li>Detection of obfuscated or polymorphic JavaScript</li>
<li>Identification of malicious iframes, redirects & hidden links</li>
<li>Detection of spam & SEO malware</li>
<li>Checkout skimmer detection</li>
<li>Inspection of WordPress core file integrity</li>
<li>Detection of alien or unauthorized files in core directories</li>
<li>External links and outbound reference analysis</li>
<li>Blacklist checks across 40+ security authorities</li>
<li>Cloud-based scanning to reduce server resource load</li>
<li>Detailed investigation reports with severity levels</li>
</ul>
<h4>Brute Force Protection Features:</h4>
<ul>
<li>IP-based locking with configurable thresholds</li>
<li>Multi-stage failure detection with soft and hard locks</li>
<li>Environment-aware policies for shared hosting and dedicated servers</li>
<li>IP whitelist/blacklist with CIDR notation support</li>
<li>Emergency bypass mechanism via constant or filter</li>
<li>User account lockout alerts via email</li>
<li>Combo-lock (IP + username) detection</li>
<li>Rate limiting with progressive delays</li>
</ul>
<h4>Bot Protection Features:</h4>
<ul>
<li>Multi-stage risk evaluation with heuristic analysis</li>
<li>Token-bucket rate limiting across multiple lanes (global, REST, XML-RPC, checkout, cart)</li>
<li>Legitimate bot recognition (Googlebot, Bingbot with elevated rate limits)</li>
<li>REST API enumeration and authentication protection</li>
<li>WooCommerce endpoint protection (checkout & cart)</li>
<li>Configurable operation modes (Observe, Balanced, Aggressive)</li>
<li>Risk-based challenge mechanisms and exponential backoff</li>
</ul>
<h4>Admin User Monitoring Features:</h4>
<ul>
<li>Real-time detection of admin user additions and removals</li>
<li>Admin role change tracking</li>
<li>Database snapshot comparison for audit trail</li>
<li>WP-Cron scheduled checks (1-minute intervals)</li>
<li>Immediate detection via WordPress hooks</li>
<li>Email alerts for unauthorized changes</li>
<li>Comprehensive alarm system integration</li>
</ul>
<p>If you need malware removal assistance, contact us at support@quttera.com or sign up for any<br />
of our ThreatSign annual plans, which include cleanup & blacklist removal:<br />
https://quttera.com/anti-malware-website-monitoring-signup</p>
<h3>Credits</h3>
<ul>
<li><a href="https://quttera.com" rel="nofollow ugc">Quttera</a></li>
</ul>
<h3>Plugin’s other home</h3>
<ul>
<li><a href="https://quttera.com/wordpress-malware-scanner" rel="nofollow ugc">WordPress Malware Scanner</a></li>
</ul>


Quttera ThreatSign – Web Malware Scanner for WordPress

WordPress multi-level security scanner detecting malware, 0-day threats, brute-force attacks, bot attacks, and unauthorized admin changes.

ArkHost Security Pack vs Quttera ThreatSign – Web Malware Scanner for WordPress