Liveupx

Liveupx Security is a complete, 100% free WordPress security plugin that rivals paid solutions. No paywalls, ever.
<h4>Core Features</h4>
Login Security 
* Brute force protection with progressive lockouts (1st/2nd/3rd+ strikes escalate automatically) 
* Multi-provider CAPTCHA: Math, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile 
* Honeypot bot detection (wp-login.php + WooCommerce) 
* Passwordless magic link login 
* Two-factor authentication: TOTP (Google Authenticator) + Email OTP 
* Trusted device (30-day bypass cookie) 
* Geolocation login alerts — notify when login comes from a new country 
* Subnet auto-blocking (repeated attacks from /24 range) 
* Custom login URL (hide wp-login.php)
Firewall / WAF 
* PHP-based Web Application Firewall running at priority 1 
* Remote WAF rule feed (auto-updated from liveupx.com) 
* Admin-defined custom firewall rules 
* Per-endpoint rate limiting (REST API, checkout, search, etc.) 
* REST API security controls (block guests, hide /users endpoint) 
* Country/geo blocking with API fallback chain 
* Bad bot blocking with verified bot allowlist (Google, Bing, etc.) 
* Referrer blocking with spam referrer presets 
* Bad query/XSS/SQL injection blocking 
* .htaccess security rules
Malware Scanner 
* Chunked AJAX scanner — scans plugins, themes, uploads, mu-plugins 
* 30+ malware patterns including backdoors, crypto miners, shell injections 
* Heuristic risk scoring (0–100) per suspicious file 
* Auto-quarantine critical findings during scan 
* Scan diff — shows new threats vs last scan 
* Database malware scanner (posts, options, comments, users) 
* File quarantine and permanent delete
Vulnerability Scanner 
* Powered by WPScan API (free tier) 
* Scans all active plugins and active theme for known CVEs 
* CVSS severity scoring (Critical/High/Medium/Low) 
* Dashboard widget showing unresolved critical/high count 
* Dedicated Vulnerabilities admin page
File Integrity 
* WordPress core file integrity check (vs WordPress.org checksums API) 
* Plugin & theme checksum verification (vs WordPress.org checksums) 
* wp-config.php and .htaccess tampering detection 
* Unknown PHP file detection in core directories
Core File Repair 
* Downloads clean copies from WordPress.org SVN 
* MD5 verification before writing 
* Single file or bulk repair
Security Headers 
* X-Frame-Options, X-Content-Type-Options, X-XSS-Protection 
* Referrer-Policy, Permissions-Policy (per-feature builder) 
* HSTS with preload support 
* Content-Security-Policy with visual builder 
* CSP violation reporting endpoint (REST API) 
* A–F letter grade for your header configuration
User Security 
* User enumeration protection (?author= + REST API) 
* Strong password enforcement 
* Block dangerous usernames (admin, root, etc.) 
* Inactive user auto-lock (configurable threshold) 
* Admin action audit trail 
* Active session manager (view & revoke) 
* GDPR IP anonymization
Post-Hack Recovery 
* Lock PHP execution in uploads and wp-includes 
* Log out all users instantly 
* Force password reset for all users 
* Reinstall free plugins from WordPress.org 
* Delete version-revealing files (readme.html, etc.) 
* Weekly security summary email report
Monitoring & Notifications 
* Activity log (filterable, paginated, CSV export, configurable retention) 
* HTML branded email alerts 
* Slack/webhook notifications (compatible with Make.com, Zapier, Discord) 
* Real-time dashboard stats (auto-refresh every 30s) 
* 7-day login attempt chart
Developer Tools 
* WP-CLI commands (wp xsec status|scan|block-ip|unblock-ip|2fa-reset|export-settings|import-settings) 
* Settings import/export (JSON) 
* Security score with category breakdown
Developed by <a href="https://liveupx.com" rel="nofollow ugc">Liveupx.com</a> 
Cloud hosting partner: <a href="https://xhost.live" rel="nofollow ugc">xHost</a> — by Liveupx.com 
<a href="https://justhunt.co/startups/x-security" rel="nofollow ugc">Featured on JustHunt.co</a>

Liveupx Security

Complete WordPress security — Firewall, 2FA, Malware Scanner, Vulnerability Scanner, Login Protection, Security Headers. 100% free.

Yoyal Limbu

BruteFort is your WordPress site’s complete login security solution focused on four core protections: Rate Limit, Custom Login URL, Geo Blocking, and IP Restriction.
Protect against brute force attacks, hide your login page with a custom URL, block countries with geo rules, and control access using IP whitelists/blacklists – all in one lightweight, performance-optimized plugin.
Whether you’re running a blog, a WooCommerce store, or a membership site, BruteFort keeps bots, hackers, and unauthorized users out while maintaining fast page speeds.
<h4>🔐 Core Security Features</h4>
🛡️ Rate Limit & Brute Force Protection 
– Limit repeated login attempts per IP 
– Configure attempt windows and lockout duration 
– Apply progressive lockouts for repeated abuse 
– Reduce automated credential stuffing and bot attacks
🔗 Custom Login URL (Hide wp-login.php) 
– Replace the default <code>/wp-login.php</code> endpoint with your custom slug 
– Return 404 for direct <code>wp-login.php</code> requests 
– Reduce scanner and bot traffic on known login endpoints 
– Keep login access private for authorized users
🌐 Geo Blocking (Country-Based Restrictions) 
– Block or allow login attempts by country 
– Blacklist mode: Block specific countries from accessing wp-login.php 
– Whitelist mode: Only allow login from selected countries 
– IP geolocation detection (Cloudflare compatible) 
– Perfect for region-specific sites or blocking high-risk countries
📍 IP Restriction (Whitelist & Blacklist) 
– Enforce custom IP allow/deny rules for login protection 
– Add individual IPs or CIDR ranges 
– Instantly block suspicious IPs 
– Whitelist your own IP to prevent lockouts 
– Bulk IP management with easy interface
📊 Real-Time Monitoring & Logs 
– View failed login attempts in real-time 
– Track IP addresses, usernames, and timestamps 
– Filter logs by status, date, or IP 
– Manual unlock for accidentally locked users 
– Export logs for security audits
⚡ Performance & Compatibility 
– Lightweight and performance-optimized 
– Works with Cloudflare, proxy servers, and CDNs 
– Compatible with most security plugins 
– Dark mode UI support 
– No impact on page load speeds
<h4>🎯 Perfect For</h4>
<ul>
<li>WooCommerce stores protecting customer data and preventing unauthorized access</li>
<li>Membership sites restricting access by geographic location</li>
<li>Corporate websites blocking countries where business doesn’t operate</li>
<li>Blog owners hiding login page from automated bots and scanners</li>
<li>Agencies managing multiple client sites with different security requirements</li>
<li>High-traffic sites experiencing frequent brute force attacks</li>
<li>International sites wanting region-specific login restrictions</li>
</ul>
<h4>🚀 Why Choose BruteFort?</h4>
<ul>
<li>Core protection stack: Rate Limit + Custom Login URL + Geo Blocking + IP Restriction</li>
<li>Easy to use: Simple, intuitive interface with no complex configuration</li>
<li>Performance-focused: Minimal resource usage, no site slowdown</li>
<li>SEO-friendly: Properly handles redirects and 404s</li>
<li>Privacy-conscious: No external API calls for basic features (optional geo API)</li>
<li>Regular updates: Actively maintained with new features added regularly</li>
</ul>

BruteFort – Rate Limit, Custom Login URL, Geo Blocking & IP Restriction

BruteFort - Rate Limit, Custom Login URL, Geo Blocking & IP Restriction for complete WordPress login security.

Liveupx Security vs BruteFort – Rate Limit, Custom Login URL, Geo Blocking & IP Restriction