Atlant

<p><strong>Atlant Security</strong> is a comprehensive WordPress security plugin that provides enterprise-grade protection through 17 integrated security modules organized in a 5-layer defense architecture.</p>
<h4>5-Layer Defense Architecture</h4>
<ol>
<li><strong>Pre-WordPress WAF</strong> — Firewall, rate limiter, and IP blocking run before WordPress processes the request.</li>
<li><strong>Application-Aware</strong> — Login security, custom login URL, two-factor authentication, session hardening, cron monitoring, and REST API policies.</li>
<li><strong>Content & Config</strong> — WordPress hardening, security headers, AI crawler management, and honeypot traps.</li>
<li><strong>Outbound & Data</strong> — SSRF prevention, malware scanning (files and database).</li>
<li><strong>Response & Recovery</strong> — Post-breach recovery, notifications, visitor log, and audit log.</li>
</ol>
<h4>Key Features</h4>
<p><strong>Web Application Firewall (WAF)</strong><br />
Inspects every request against 28+ attack pattern families including SQL injection, XSS, remote code execution, path traversal, PHP object injection, and WordPress-specific attacks. Block or log-only mode. Triple URL decoding prevents evasion.</p>
<p><strong>Brute Force Protection</strong><br />
Progressive lockout system (5 min > 30 min > 24 hours) with configurable thresholds. Generic login error messages prevent username enumeration. Author enumeration blocking.</p>
<p><strong>Malware Scanner</strong><br />
Local file and database scanner with 38 malware signatures. Detects backdoors, webshells (WSO, c99, r57), crypto miners, credit card skimmers, and obfuscated code. Quarantine system with web access blocking.</p>
<p><strong>Two-Factor Authentication (2FA)</strong><br />
TOTP (Google Authenticator, Authy) and email OTP. Per-role enforcement, 10 recovery codes, 5-minute challenge timeout, replay attack prevention.</p>
<p><strong>Honeypot Traps</strong><br />
Zero-false-positive bot detection: hidden link traps, fake login pages, comment honeypots, and Contact Form 7 integration. 3-layer safe bot protection ensures Googlebot, Bingbot, and allowed AI crawlers are never blocked.</p>
<p><strong>AI Crawler Management</strong><br />
Control 20+ known AI/LLM training crawlers (GPTBot, ClaudeBot, Google-Extended, Bytespider, and more). Per-crawler toggles, robots.txt integration, and 403 enforcement. Block training crawlers while allowing browsing bots.</p>
<p><strong>Security Headers</strong><br />
Manage HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP, CORP, and COOP. Letter-grade scoring system. Remove X-Powered-By and Server headers.</p>
<p><strong>Session Security</strong><br />
Cookie hardening (HttpOnly, Secure, SameSite). Session binding via IP + User-Agent fingerprint detects hijacking. Concurrent session limits. Idle timeout. Optional admin bypass for all session restrictions.</p>
<p><strong>Rate Limiter</strong><br />
Sliding-window rate limiting across 11 endpoint categories: frontend, login, search, feed, REST API, WooCommerce checkout, XML-RPC, and cron.</p>
<p><strong>REST API Policies</strong><br />
Per-route access control with authentication requirements, HTTP method restrictions, rate limits, and IP whitelists. 5 built-in policies protect user enumeration, search, and write endpoints.</p>
<p><strong>Cron Guard</strong><br />
Monitors wp-cron.php for flood attacks. Detects suspicious scheduled tasks via baseline comparison. System cron migration helper.</p>
<p><strong>Outbound Monitor (SSRF Prevention)</strong><br />
Monitors all outgoing HTTP requests. Blocks requests to private/internal IP ranges including cloud metadata endpoints. Domain allowlist with wildcard support. Caller detection traces requests to specific plugins.</p>
<p><strong>Post-Breach Recovery</strong><br />
12 emergency actions: terminate sessions, force password reset, rotate secret keys, emergency lockdown, reinstall core, reinstall plugins, audit admin accounts, clear caches, malware scan, disable plugins, and downloadable incident report.</p>
<p><strong>Real-Time Dashboard</strong><br />
Live visitor monitoring with 15-second auto-refresh. Stat cards, traffic charts, top IPs with VirusTotal integration, browser distribution, and IP detail modals.</p>
<p><strong>Visitor Log & Audit Log</strong><br />
Complete request history with filters (IP, URL, bots, blocked, time range). Tamper-resistant admin action audit trail.</p>
<p><strong>Notifications</strong><br />
Email alerts (HTML formatted, color-coded severity), Slack webhooks, custom JSON webhooks, and daily digest. Configurable severity threshold with 5-minute deduplication.</p>
<p><strong>WordPress Hardening</strong><br />
One-click toggles: disable XML-RPC, hide WordPress version, block REST API user enumeration, block author enumeration, disable file editor, block PHP execution in uploads.</p>
<h4>What Makes Atlant Security Different</h4>
<ul>
<li><strong>Pre-WordPress WAF</strong> — Blocks attacks via auto_prepend_file before WordPress even loads</li>
<li><strong>Outbound HTTP Monitor</strong> — Detects SSRF attacks and unauthorized outbound connections</li>
<li><strong>Database Backdoor Scanner</strong> — Scans wp_options and wp_posts for eval(), base64, and hidden backdoors</li>
<li><strong>Client-Side Bot Detection</strong> — JavaScript challenges and browser fingerprinting catch sophisticated bots</li>
<li><strong>AI/LLM Crawler Blocking</strong> — Identify and block AI training crawlers scraping your content</li>
<li><strong>Honeypot Traps</strong> — Hidden links, fake login pages, invisible form fields that only bots trigger</li>
<li><strong>Cron Guard</strong> — Monitors wp-cron for unauthorized scheduled tasks planted by malware</li>
<li><strong>Post-Breach Recovery</strong> — Guided recovery toolkit with 12 emergency actions in one place</li>
<li><strong>Session Fingerprint Binding</strong> — Binds sessions to IP + User-Agent so stolen cookies are useless</li>
<li><strong>Real-Time Visitor Dashboard</strong> — Live visitor feed updated every 15 seconds</li>
<li><strong>Smart Password Policy</strong> — Minimum length, complexity, common-password blocking, and passphrase support</li>
<li><strong>Granular REST API Policies</strong> — Per-endpoint control, not just a global on/off switch</li>
<li><strong>Safe Mode Override</strong> — One constant in wp-config.php disables all blocking features instantly</li>
<li><strong>Deactivation Data Control</strong> — Choose to keep or wipe all security data when deactivating</li>
<li><strong>Zero phone-home</strong> — No telemetry, no tracking, fully GDPR-compliant (external services used only when explicitly enabled by the admin — see External Services section)</li>
</ul>
<h4>Why Atlant Security?</h4>
<ul>
<li><strong>All-in-one</strong> — Replaces 5-6 separate security plugins</li>
<li><strong>No external dependencies</strong> — Core security features run locally on your server</li>
<li><strong>Zero phone-home</strong> — No telemetry, no tracking (optional features like GeoIP use external services only when explicitly enabled — see External Services section)</li>
<li><strong>GDPR-friendly</strong> — No external fonts, no CDN resources</li>
<li><strong>Setup wizard</strong> — Configure core security in under 2 minutes</li>
<li><strong>Clean uninstall</strong> — Removes all database tables and options when deleted (opt-in)</li>
<li><strong>Safe Mode</strong> — Emergency override if you get locked out of your site</li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to the following third-party services under specific conditions:</p>
<h4>Cloudflare IP Ranges</h4>
<p>When Cloudflare integration is enabled, the plugin periodically fetches the current list of Cloudflare edge IP ranges from Cloudflare’s official endpoints. This is used to correctly identify visitor IP addresses behind the Cloudflare proxy and to whitelist Cloudflare edge servers.</p>
<ul>
<li>Data sent: No user data is sent. The plugin fetches publicly available IP range lists.</li>
<li>When: Once per week via a scheduled cron job (aswp_refresh_cloudflare_ips), only when Cloudflare integration is enabled.</li>
<li>Endpoints: https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6</li>
<li><a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Cloudflare Terms of Use</a></li>
<li><a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Cloudflare Privacy Policy</a></li>
</ul>
<h4>MaxMind GeoLite2 GeoIP Database</h4>
<p>When GeoIP country detection is enabled and a MaxMind license key is configured, the plugin downloads the GeoLite2-Country database from MaxMind. This database is stored locally and used to resolve visitor IP addresses to country codes for display in the visitor log and dashboard.</p>
<ul>
<li>Data sent: Your MaxMind license key is sent to authenticate the download request. No visitor data is sent to MaxMind.</li>
<li>When: On initial setup and once per week via a scheduled cron job (aswp_update_geoip_db), only when GeoIP is enabled and a license key is configured.</li>
<li>Endpoint: https://download.maxmind.com/app/geoip_download</li>
<li><a href="https://www.maxmind.com/en/geolite2/eula" rel="nofollow ugc">MaxMind End User License Agreement</a></li>
<li><a href="https://www.maxmind.com/en/privacy-policy" rel="nofollow ugc">MaxMind Privacy Policy</a></li>
</ul>
<h4>Google IP Ranges</h4>
<p>When Google integration is enabled in the IP Whitelist, the plugin periodically fetches the current list of Google IP ranges from Google’s official endpoint. This is used to automatically whitelist known Google infrastructure IPs (Googlebot, Google Cloud, etc.) so legitimate Google traffic is never blocked.</p>
<ul>
<li>Data sent: No user data is sent. The plugin fetches a publicly available JSON file containing Google IP ranges.</li>
<li>When: Once per week via a scheduled cron job (aswp_refresh_google_ips), only when Google integration is enabled.</li>
<li>Endpoint: https://www.gstatic.com/ipranges/goog.json</li>
<li><a href="https://policies.google.com/terms" rel="nofollow ugc">Google Terms of Service</a></li>
<li><a href="https://policies.google.com/privacy" rel="nofollow ugc">Google Privacy Policy</a></li>
</ul>
<h4>Microsoft / Bing IP Ranges</h4>
<p>When Microsoft integration is enabled in the IP Whitelist, the plugin periodically fetches the current list of Bing bot IP ranges from Microsoft’s official endpoint. This is used to automatically whitelist known Bing crawler IPs so legitimate Bing traffic is never blocked.</p>
<ul>
<li>Data sent: No user data is sent. The plugin fetches a publicly available JSON file containing Bing bot IP ranges.</li>
<li>When: Once per week via a scheduled cron job (aswp_refresh_microsoft_ips), only when Microsoft integration is enabled.</li>
<li>Endpoint: https://www.bing.com/toolbox/bingbot.json</li>
<li><a href="https://www.microsoft.com/en-us/servicesagreement/" rel="nofollow ugc">Microsoft Services Agreement</a></li>
<li><a href="https://privacy.microsoft.com/en-us/privacystatement" rel="nofollow ugc">Microsoft Privacy Statement</a></li>
</ul>
<h4>WordPress.org Secret Key API</h4>
<p>The Post-Breach Recovery module can generate new WordPress secret keys and salts using the official WordPress.org API. This is used when an administrator manually triggers the “Rotate Secret Keys” emergency action after a security breach.</p>
<ul>
<li>Data sent: No user data is sent. The plugin fetches randomly generated keys from the API.</li>
<li>When: Only when an administrator manually triggers the “Rotate Secret Keys” action in the Post-Breach Recovery module.</li>
<li>Endpoint: https://api.wordpress.org/secret-key/1.1/salt/</li>
<li><a href="https://wordpress.org/about/domains/" rel="ugc">WordPress.org Terms of Service</a></li>
<li><a href="https://wordpress.org/about/privacy/" rel="ugc">WordPress.org Privacy Policy</a></li>
</ul>
<h4>Slack Webhooks</h4>
<p>When Slack notifications are enabled and a Slack webhook URL is configured, the plugin sends security alert messages to the specified Slack channel. This allows administrators to receive real-time security notifications in Slack.</p>
<ul>
<li>Data sent: Security alert messages containing the alert subject, description, severity level, site URL, and the IP address that triggered the alert. No visitor personal data or cookies are sent.</li>
<li>When: Only when a security event occurs (e.g., brute force attempt, WAF block, honeypot trip) and Slack notifications are enabled.</li>
<li>Endpoint: Administrator-configured Slack Incoming Webhook URL (e.g., https://hooks.slack.com/services/…)</li>
<li><a href="https://slack.com/terms-of-service" rel="nofollow ugc">Slack Terms of Service</a></li>
<li><a href="https://slack.com/privacy-policy" rel="nofollow ugc">Slack Privacy Policy</a></li>
</ul>
<h4>Custom Webhooks</h4>
<p>When webhook notifications are enabled and a webhook URL is configured, the plugin sends security alert payloads in JSON format to the specified endpoint. This allows integration with any external monitoring or alerting system.</p>
<ul>
<li>Data sent: JSON payload containing the alert subject, description, severity level, site URL, timestamp, and the IP address that triggered the alert. No visitor personal data or cookies are sent.</li>
<li>When: Only when a security event occurs and webhook notifications are enabled.</li>
<li>Endpoint: Administrator-configured webhook URL.</li>
<li>Terms and privacy: Determined by the third-party service the administrator configures.</li>
</ul>
<h3>Upgrade Notices</h3>
<h4>1.1.2</h4>
<p>New About page consolidates defense architecture and competitive features. Setup wizard no longer auto-redirects on activation. Dashboard is cleaner with focus on operational data.</p>
<h4>1.0.7</h4>
<p>Major UI overhaul: inner sidebar navigation replaces 23 WordPress submenu items with a clean, persistent sidebar panel. All page URLs remain the same — bookmarks still work.</p>
<h4>1.0.4</h4>
<p>Adds GeoIP country flags in visitor log, custom login URL, password policy enforcement, and Force SSL Admin setting. Internal prefix migration runs automatically — no action required.</p>
<h4>1.0.3</h4>
<p>Adds honeypot traps, security headers management, two-factor authentication, and notification channels. Fixes IP management and status code logging. Recommended update.</p>
<h4>1.0.0</h4>
<p>Initial release. Run the Setup Wizard after activation to configure your site’s security.</p>


Atlant Security

Enterprise-grade WordPress security: WAF, brute force protection, malware scanner, 2FA, honeypots, AI crawler control, and post-breach recovery.

Bill Minozzi

<p><strong>ANTI HACKER PLUGIN</strong><br />
★★★★★</p>
<h3><strong>AI Has Raised Cyber Threats to Unprecedented Levels, Microsoft Warns</strong></h3>
<p>The digital security landscape has reached a defining inflection point, fundamentally shaped by Artificial Intelligence. According to the Microsoft <strong>Digital Defense Report 2025</strong>, the impact of this change is stark: AI is making sophisticated cyberattacks 450% more effective than traditional methods, accelerating the overall risk landscape.</p>
<h3><strong>🚀 In a Hurry? Get the Essentials and Stay Protected!</strong></h3>
<p><strong>What it does:</strong><br />
It’s a complete security shield for your WordPress site. This plugin prevents, detects, malware, blocks hackers, and protects your site’s data and reputation.</p>
<p><strong>Why it matters:</strong><br />
WordPress sites are a top target for hackers. A single attack can lead to data loss, a damaged reputation, and major SEO penalties from Google. <strong>Your site’s security isn’t a feature—it’s a necessity.</strong><br />
Roughly 30% of all internet traffic is from bots, and 2.5% is malicious (data theft, brute-force attacks, slowing down sites). According to Cloudflare, that’s nearly 2 million attacks every second.</p>
<p><strong>Key Protections:</strong><br />
* <strong>Malware Scanner:</strong> Finds malicious code (797 types) in your files.<br />
* <strong>Firewall:</strong> Blocks malicious requests and common vulnerabilities.<br />
* <strong>Brute-Force Protection:</strong> Stops hackers from guessing your login password.<br />
* <strong>File Integrity Monitor:</strong> Alerts you to any unauthorized changes (or new files) to your WordPress core files and plugins.<br />
* <strong>No DNS, Cloud, or external API required</strong> <span aria-hidden="true" class="wp-exclude-emoji">→</span> The plugin is self-contained, fast, and lightweight.</p>
<p><strong>Features:</strong><br />
* <strong>Quick Start:</strong> Easy to install and configure in just a few clicks (Less than 2 minutes).<br />
* <strong>Intuitive Dashboard:</strong> A clear, user-friendly interface to manage your security.<br />
* <strong>Real-time Alerts:</strong> Get instant notifications about suspicious activity.<br />
* <strong>Instant Support:</strong> Get 24/7 AI-powered support (included in the free version).<br />
* <strong>Attack Charts:</strong> Visualize blocked threats with daily charts showing the number of blocks by type.<br />
* <strong>Visits Log:</strong> See who’s visiting your site.<br />
* <strong>Languages:</strong> Available in Dutch, French, German, Italian, Spanish, and Portuguese.</p>
<h3><strong>🔎 Want All the Details? Read the Full Explanation Below</strong></h3>
<blockquote>
<p><strong>Even Small Sites Are At Risk!</strong><br />
  Cloudflare, the internet security giant, reported blocking an average of 166 BILLION cyberthreats PER DAY in early 2024 – that’s nearly <strong>2 million attacks every second</strong> sweeping across the web. In Q1 2025, Cloudflare blocked 20.5 million DDoS attacks, a massive 358% year-over-year (YoY) increase.”<br />
  Threats to WordPress sites have also skyrocketed, according to Defiant Inc: <strong>+68% new vulnerabilities in 2024.</strong><br />
  Hackers use <strong>automated bots that don’t pick and choose; they attack all sites, large or small</strong>, 24/7, by exploiting vulnerabilities.<br />
  And the trend for 2025 points to an even <strong>greater increase</strong>: Artificial Intelligence (AI) is empowering even less-skilled attackers to create bots to steal information, while ready-made attack kits are sold on the dark web, amplifying both the volume and sophistication of threats.<br />
  No matter how small or big your server is, hackers may attempt to use it to send spam, steal traffic, and attack other computers.<br />
  In fact, some studies suggest that the majority of attacks against websites begin to occur within the first 24 hours of a site going online.</p>
<p><strong>Amplify Your Server’s Defenses!</strong> Optional. When AntiHacker blocks a threat, it <strong>automatically sets up Fail2Ban</strong> to intercept and block that IP on all <strong>future attempts before they even reach your WordPress site</strong>. So, if you manage your own VPS, Cloud, or Dedicated server with Fail2Ban installed, <strong>this is a game-changer!</strong></p>
</blockquote>
<p>Our free plugin Improve system security, protect login (Login Security), firewall, scan for malware, block user enumeration and TOR, disable Json WordPress Rest API, xmlrpc (xml-rpc) & Pingback and more a lot of security tools.<br />
Translation ready. Files included: Dutch, English, French, Italian, Portuguese, Spanish, and German.<br />
<strong>So easy, even beginners can secure their site in under a 3 minutes with our guided setup wizard.</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/FTm2Ck_OhLk?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h3>Must-Have Scanner for WordPress Health & Integrity</h3>
<p>This feature verifies in a <strong>few seconds</strong> the integrity of your entire WordPress installation, including core files and plugins. It meticulously compares your site’s code against the official versions on the WordPress.org repository, instantly flagging any unauthorized modifications. Furthermore, it scans for and reports any unknown files that have been added, exposing potential backdoors and malware that would otherwise go unnoticed.</p>
<h3>Features and Tools Included</h3>
<ul>
<li>Prevent unauthorized access to your account by protect your login page also against bots and brute force.</li>
<li>Firewall to Block Malicious Requests, Queries, User Agents and URLS. <strong>100% Plug-n-play</strong>, no configuration required.</li>
<li>View Table of the Blocked Visits and add IP to Whitelist from table and logs failed login attempts. </li>
<li>Option to disable Json WordPress Rest API (also new WordPress 4.7 Rest API). </li>
<li>You can also disable the  WordPress xmlrpc (xml-rpc) (or disable only Pingback) API with just one click.</li>
<li>You can turn on login alerts with just one click. Also login fails alert.</li>
<li>Send alert email when any new plugin is installed. (First thing hackers do when gain access to your site)</li>
<li>Send email alert when AntiHacker plugin in deactivated.</li>
<li>WordPress Debug enabled warning.</li>
<li>Disable file editing within the WordPress dashboard.</li>
<li>Replace insecure login error message.</li>
<li>Hide WordPress version number.</li>
<li>Disable Application Passwords: Block external applications to request permission to connect to a site and generate a password (WordPress 5.6 new feature)</li>
<li>Limit Visits, Limit Bots Attempts (Premium Version)</li>
<li>limit only 404 requests (Premium Version)</li>
<li>File Integrity Checker (verify the integrity of your WordPress core files).</li>
<li>Check Google Safe Browsing Blacklist</li>
<li>Check and alert for deactivated Plugins and themes</li>
<li>Check and alert for extra files and dangerous files on root folder.</li>
<li>Check plugins integrity against the WordPress repository.</li>
<li>Allows you to reinstall plugins without modifying the database or needing to delete them first.(Premium Version)</li>
<li>Multilingual ready.</li>
<li>Disable WordPress native sitemap (for user’s) creation.</li>
<li>Disable xmlrpc</li>
<li>Disable Pingback</li>
<li>Protect Against Cyber Attack</li>
<li>hardening wordpress</li>
<li>Display info about must use plugins</li>
</ul>
<h3>Optional Fail2ban Monitor integration with GUI</h3>
<p>Available in our plugin Stop Bad Bots<br />
Please ensure Fail2Ban is installed and operational on your server, VPS or Cloud VPS for this monitor to function.<br />
Currently, you can track key Fail2ban details like the offending IP, when the last attempt occurred, the specific Security Rule (jail) triggered, the number of attempts, and how long the ban lasts. This is your first step towards richer insights like daily totals, activity graphs, and more detailed ban reasons.</p>
<h3>Malware Scanner</h3>
<ul>
<li>Security Malware scanner (one click scan) for <strong>797 malwares</strong> also in free version (unlimited files).</li>
<li>7 speed options to scan and the scan run on your local computer to not overload your server.</li>
<li>Scans every folder and inspects every file on a website (deep scanner) for traces of malware, exploits, trojans, worms, viruses, backdoors as well as JavaScript code obfuscation, exploits, malicious iframes, malicious code injection, malicious code obfuscation, auto-generated malicious content, redirects, hidden eval code and more.</li>
<li>Scan all Pages, Posts and Comments against malwares.</li>
<li>Alert for plugins and themes without updates for long time or with old versions.</li>
<li>Scan your site now before Google blacklists it or your web host takes it down.</li>
</ul>
<h3>Block</h3>
<ul>
<li>User enumeration. (is one of the most popular attacks to identify the valid user names)</li>
<li>Comments in media page.</li>
<li>Bad Queries.* Block All Feeds  (Optional).</li>
<li>Creation of new Administrators from plugins and themes with vulnerabilities.</li>
<li>False Google and Bing (MSN) bots (Premium Version)</li>
<li>Search for Theme’s vulnerabilities (Premium Version)</li>
<li>Search for Plugin’s vulnerabilities (Premium Version)</li>
<li>Tor (The Onion Router) Traffic – Optional –  (Premium Version) Tor anonymity provides value to online attackers. </li>
<li>HTTP Tools (you can manage the strings)</li>
<li>Blank User Agent</li>
</ul>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/Yks7AWZZt18?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h3>Useful Links</h3>
<p><a href="http://antihackerplugin.com/premium" rel="nofollow ugc">Premium Version with more features</a><br />
(Our Premium version won’t empty your pocket.)<br />
<a href="http://antihackerplugin.com/start-up-guide/" rel="nofollow ugc">StartUp Guide</a><br />
<a href="http://antihackerplugin.com/on-line-manual/" rel="nofollow ugc">Online Documentation</a><br />
<a href="http://antihackerplugin.com/faq/" rel="nofollow ugc">FAQ Page</a><br />
<a href="http://antihackerplugin.com" rel="nofollow ugc">Plugin Site</a><br />
<a href="https://antihackerplugin.com/blog/" rel="nofollow ugc">Plugin Blog with a lot of tips</a><br />
<a href="http://stopbadbots.com" rel="nofollow ugc">Compatible with Stop Bad Bots Plugin</a><br />
<a href="http://antihackerplugin.com/share/" rel="nofollow ugc">Share</a> 🙂</p>
<blockquote>
<p>Italian: Migliora la sicurezza del sistema, proteggi l’accesso (sicurezza dell’accesso), firewall, cerca malware, blocca l’enumerazione degli utenti e TOR, disabilita l’API Rest di Json WordPress, xmlrpc (xml-rpc) e Pingback e molti altri strumenti di sicurezza. Multilingua pronto. Inclusi anche file in lingua italiana e portoghese.<br />
  .<br />
  Português: Melhora a segurança do sistema, proteje o login (Segurança de login), firewall, verifica se há malware, bloqueia a enumeração do usuário e TOR, desativa Json WordPress Rest API, xmlrpc (xml-rpc) e Pingback e mais muitas ferramentas de segurança. Pronto para vários idiomas. Incluídos também arquivos em italiano e português.</p>
</blockquote>
<ul>
<li><strong>No DNS API (entryPoint) or Cloud Traffic Redirection. No Slow Down Your Site! No Google penalties for slow sites.</strong></li>
</ul>
<h3>Why disable the  WordPress xmlrpc</h3>
<p>This plugin disables XMLRPC API in WordPress 3.5+ or above, which is enabled by default.<br />
XMLRPC on WordPress is actually an API or “application program interface“.<br />
It gives developers who make mobile apps, desktop apps and other services the ability to talk to your WordPress site.<br />
Most users don’t need WordPress XMLRPC functionality, and it’s one of the most common causes for exploits.<br />
If you want to access and publish to your blog remotely, then you need XMLRPC enabled.</p>
<h3>Why should we disable pingbacks?</h3>
<p>Pingback allows you to notify other bloggers that you have linked to their article on your website.<br />
A WordPress website with Pingback enabled can be used in DDOS attacks against other websites.<br />
An attacker can exploit pingback functionality through simple command and an XMLRPC request.</p>
<h3>Why disable Json WordPress Rest API</h3>
<p>(disable WordPress Rest API)<br />
<strong>Block User enumeration to improve security.</strong></p>
<p>The REST API (new WordPress 4.7) allows for anonymous access and this means that anyone can list all<br />
the users of a website. This will enable botnets to try and Bruteforce attack a website with the user’s credentials.</p>
<h3>Brute Force Login Protection</h3>
<p>A <strong>brute-force attack</strong> is an attempt to discover a password by systematically trying every<br />
possible combination of letters, numbers, and symbols until you discover the one correct combination<br />
that works.<br />
Our plugin will <strong>protect your site against Brute Force Attack</strong>, by restrict access to login page to<br />
whitelisted IP addresses.<br />
Otherwise, your login page will request your wordpress user email.<br />
It is not necessary Limit Login Attempts. Read below about Rate Limiting.</p>
<h3>Rate Limiting</h3>
<p>Rate Limiting is a substitute to <strong>Limit Login Attempts</strong>.<br />
Bots and Hackers can make a lot of visits in a short time period.<br />
We can just limit a number of visits.</p>
<h3>Simple Login Lockdown</h3>
<p>Rate Limiting is a substitute to <strong>Simple Login Lockdown</strong>. Read above.</p>
<h3>Rename wp-login.php</h3>
<p>Rate Limiting is a substitute to <strong>Rename wp-login.php</strong>. Read above.</p>
<h3>External service</h3>
<p>If the settings of Anti Hacker is Block all traffic from Tor? = “Yes”, we can test visitors Ip<br />
from the TOR PROJECT database. We download daily Tor Database and we didn’t send any information to them.<br />
This is a free service. TorProject is a not-for-profit organization.</p>
<p>Tor Documentation:<br />
https://www.torproject.org/</p>
<h3>External service 2</h3>
<p>Our plugin will check your status on Google regarding Google Safe Browsing.<br />
Google Safe Browsing is a service provided by Google to help protect users from malicious websites on the internet.<br />
To simplify your inquiry, avoiding the need to create a Google account to obtain an API,<br />
we will perform this query for you.<br />
We will send your domain address and Google will inform us whether it considers your site safe or not.<br />
Obviously, if it does not consider it safe, it will not send visitors to your site.<br />
Instead, it will inform those who intend to visit your site that it is dangerous.<br />
Hence the importance of always monitoring this. We will add that on your plugin dashboard.<br />
This collected data (domain name) will only be used to query Google and will not be stored.<br />
For more information about this, <a href="https://safebrowsing.google.com/" rel="nofollow ugc">visit Google.</a><br />
For more details about our site, <a href="https://antihackerplugin.com/" rel="nofollow ugc">visit us.</a><br />
This plugin is a service. If you choose the premium version, only in this case, when applying your purchase code, it will be sent to our server, which will return whether it is valid or not.</p>
<p>This plugin is a service. If you choose the premium version, your site will receive weekly updates for its bot, IP, and referrer tables.<br />
Only in this case, when applying your purchase code, it will be sent to our server, which will return whether it is valid or not.</p>
<h3>External service 3</h3>
<p>The plugin will retrieve tips and news from our site BillMinozzi.com. This information will be displayed in the plugin dashboard, in the right-hand column under the title “Tips and News.” No data is sent to our server.<br />
domain: https://billminozzi.com/API/bill-api.php</p>
<h3>External service 4</h3>
<p>When using our chat, only some information about issues, such as your language and data from the Diagnose tab, may be sent to our server. We do not share, publish, or disclose any information with third parties.<br />
domain: https://BillMinozzi.com/chat/api/api.php</p>
<h3>Advanced Site Health</h3>
<p>WordPress’s built-in Site Health feature provides a great baseline for your site’s well-being. However, in today’s digital landscape, true “health” goes beyond server configuration. A site can have a perfect score and still be slow, vulnerable, or plagued by critical errors.</p>
<p>Our plugin extends the core Site Health concept to provide a truly holistic analysis of what keeps your site fast, stable, and secure. We don’t just check the basics; we diagnose critical issues that directly impact your visitors’ experience and your site’s operational integrity.</p>
<p>Our enhanced checks include:Performance & Memory Analysis, Proactive Error Detection, Modern Security Monitoring.<br />
That  involves querying public, authoritative services like rdap.db.ripe.net with visitor IP addresses for security analysis.<br />
domain: https://rdap.db.ripe.net/ip/<br />
and<br />
domain: https://BillMinozzi.com/API/api.php<br />
info send: Domain, plugin and WordPress version, status (string) 98.</p>
<p>For a complete overview of all features, our data handling practices, and the full terms governing our software, please visit our official website:<br />
https://siterightaway.net/terms-of-use-of-our-plugins-and-themes/</p>
<h3>Look the file changelog.txt for details</h3>
<p>We can keep the size of the standard WordPress readme.txt file reasonable</p>


Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan

Firewall, Scanner, block user enumeration & TOR, disable Json API, xmlrpc & Pingback, Hide Version, Login error message, Notifications, more...

Atlant Security vs Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan