Liveupx

Liveupx Security is a complete, 100% free WordPress security plugin that rivals paid solutions. No paywalls, ever.
<h4>Core Features</h4>
Login Security 
* Brute force protection with progressive lockouts (1st/2nd/3rd+ strikes escalate automatically) 
* Multi-provider CAPTCHA: Math, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile 
* Honeypot bot detection (wp-login.php + WooCommerce) 
* Passwordless magic link login 
* Two-factor authentication: TOTP (Google Authenticator) + Email OTP 
* Trusted device (30-day bypass cookie) 
* Geolocation login alerts — notify when login comes from a new country 
* Subnet auto-blocking (repeated attacks from /24 range) 
* Custom login URL (hide wp-login.php)
Firewall / WAF 
* PHP-based Web Application Firewall running at priority 1 
* Remote WAF rule feed (auto-updated from liveupx.com) 
* Admin-defined custom firewall rules 
* Per-endpoint rate limiting (REST API, checkout, search, etc.) 
* REST API security controls (block guests, hide /users endpoint) 
* Country/geo blocking with API fallback chain 
* Bad bot blocking with verified bot allowlist (Google, Bing, etc.) 
* Referrer blocking with spam referrer presets 
* Bad query/XSS/SQL injection blocking 
* .htaccess security rules
Malware Scanner 
* Chunked AJAX scanner — scans plugins, themes, uploads, mu-plugins 
* 30+ malware patterns including backdoors, crypto miners, shell injections 
* Heuristic risk scoring (0–100) per suspicious file 
* Auto-quarantine critical findings during scan 
* Scan diff — shows new threats vs last scan 
* Database malware scanner (posts, options, comments, users) 
* File quarantine and permanent delete
Vulnerability Scanner 
* Powered by WPScan API (free tier) 
* Scans all active plugins and active theme for known CVEs 
* CVSS severity scoring (Critical/High/Medium/Low) 
* Dashboard widget showing unresolved critical/high count 
* Dedicated Vulnerabilities admin page
File Integrity 
* WordPress core file integrity check (vs WordPress.org checksums API) 
* Plugin & theme checksum verification (vs WordPress.org checksums) 
* wp-config.php and .htaccess tampering detection 
* Unknown PHP file detection in core directories
Core File Repair 
* Downloads clean copies from WordPress.org SVN 
* MD5 verification before writing 
* Single file or bulk repair
Security Headers 
* X-Frame-Options, X-Content-Type-Options, X-XSS-Protection 
* Referrer-Policy, Permissions-Policy (per-feature builder) 
* HSTS with preload support 
* Content-Security-Policy with visual builder 
* CSP violation reporting endpoint (REST API) 
* A–F letter grade for your header configuration
User Security 
* User enumeration protection (?author= + REST API) 
* Strong password enforcement 
* Block dangerous usernames (admin, root, etc.) 
* Inactive user auto-lock (configurable threshold) 
* Admin action audit trail 
* Active session manager (view & revoke) 
* GDPR IP anonymization
Post-Hack Recovery 
* Lock PHP execution in uploads and wp-includes 
* Log out all users instantly 
* Force password reset for all users 
* Reinstall free plugins from WordPress.org 
* Delete version-revealing files (readme.html, etc.) 
* Weekly security summary email report
Monitoring & Notifications 
* Activity log (filterable, paginated, CSV export, configurable retention) 
* HTML branded email alerts 
* Slack/webhook notifications (compatible with Make.com, Zapier, Discord) 
* Real-time dashboard stats (auto-refresh every 30s) 
* 7-day login attempt chart
Developer Tools 
* WP-CLI commands (wp xsec status|scan|block-ip|unblock-ip|2fa-reset|export-settings|import-settings) 
* Settings import/export (JSON) 
* Security score with category breakdown
Developed by <a href="https://liveupx.com" rel="nofollow ugc">Liveupx.com</a> 
Cloud hosting partner: <a href="https://xhost.live" rel="nofollow ugc">xHost</a> — by Liveupx.com 
<a href="https://justhunt.co/startups/x-security" rel="nofollow ugc">Featured on JustHunt.co</a>

Liveupx Security

Complete WordPress security — Firewall, 2FA, Malware Scanner, Vulnerability Scanner, Login Protection, Security Headers. 100% free.

learnhowwp

Login Gatekeeper adds an extra layer of security to your WordPress login page by requiring a custom key and value in the login URL (e.g. <code>/wp-login.php?secret=myvalue</code>). You can restrict which user roles require the key, helping to prevent brute force and bot login attempts.
Stealth Protection: 
The plugin does not modify the appearance or behavior of the default WordPress login page. Anyone accessing the login page without the correct secret and value will see the standard WordPress error message, even if they enter the correct username and password. This means attackers cannot detect that extra protection is in place.
Easily configure your login key, value, and restricted roles from the WordPress admin settings page. The plugin also includes a risk confirmation step to prevent accidental lockout.
Lost your secret or value? 
If you forget your login key or value, you can use the default WordPress “Lost your password?” feature. The secret key and value will be included in the password reset email, allowing you to regain access without needing to disable the plugin.
Features:
<ul>
<li>Require a custom key/value in the login URL</li>
<li>Restrict login by user role</li>
<li>Easy-to-use settings page</li>
<li>Prevents brute force and bot login attempts</li>
<li>No visible changes to the login page for added stealth</li>
<li>Secret and value included in password reset email if forgotten</li>
</ul>
Check Out Our Other Plugins
<ul>
<li><a href="https://wordpress.org/plugins/contact-form-db-divi/" rel="ugc">Divi Contact Form DB</a></li>
<li><a href="https://wordpress.org/plugins/overlay-image-divi-module/" rel="ugc">Divi Overlay on Images Module</a></li>
<li><a href="https://wordpress.org/plugins/post-carousel-divi/" rel="ugc">Divi Post Carousel Module</a></li>
<li><a href="https://wordpress.org/plugins/menu-cart-divi/" rel="ugc">Divi Menu Cart Module</a></li>
<li><a href="https://wordpress.org/plugins/flip-cards-module-divi/" rel="ugc">Divi Flip Cards Module</a></li>
<li><a href="https://wordpress.org/plugins/image-carousel-divi/" rel="ugc">Divi Image Carousel</a></li>
<li><a href="https://wordpress.org/plugins/breadcrumbs-divi-module/" rel="ugc">Divi Breadcrumbs Module</a></li>
</ul>

Login Gatekeeper

Protect your login page by requiring a secret key and value in the login URL.

Liveupx Security vs Login Gatekeeper