Liveupx

Liveupx Security is a complete, 100% free WordPress security plugin that rivals paid solutions. No paywalls, ever.
<h4>Core Features</h4>
Login Security 
* Brute force protection with progressive lockouts (1st/2nd/3rd+ strikes escalate automatically) 
* Multi-provider CAPTCHA: Math, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile 
* Honeypot bot detection (wp-login.php + WooCommerce) 
* Passwordless magic link login 
* Two-factor authentication: TOTP (Google Authenticator) + Email OTP 
* Trusted device (30-day bypass cookie) 
* Geolocation login alerts — notify when login comes from a new country 
* Subnet auto-blocking (repeated attacks from /24 range) 
* Custom login URL (hide wp-login.php)
Firewall / WAF 
* PHP-based Web Application Firewall running at priority 1 
* Remote WAF rule feed (auto-updated from liveupx.com) 
* Admin-defined custom firewall rules 
* Per-endpoint rate limiting (REST API, checkout, search, etc.) 
* REST API security controls (block guests, hide /users endpoint) 
* Country/geo blocking with API fallback chain 
* Bad bot blocking with verified bot allowlist (Google, Bing, etc.) 
* Referrer blocking with spam referrer presets 
* Bad query/XSS/SQL injection blocking 
* .htaccess security rules
Malware Scanner 
* Chunked AJAX scanner — scans plugins, themes, uploads, mu-plugins 
* 30+ malware patterns including backdoors, crypto miners, shell injections 
* Heuristic risk scoring (0–100) per suspicious file 
* Auto-quarantine critical findings during scan 
* Scan diff — shows new threats vs last scan 
* Database malware scanner (posts, options, comments, users) 
* File quarantine and permanent delete
Vulnerability Scanner 
* Powered by WPScan API (free tier) 
* Scans all active plugins and active theme for known CVEs 
* CVSS severity scoring (Critical/High/Medium/Low) 
* Dashboard widget showing unresolved critical/high count 
* Dedicated Vulnerabilities admin page
File Integrity 
* WordPress core file integrity check (vs WordPress.org checksums API) 
* Plugin & theme checksum verification (vs WordPress.org checksums) 
* wp-config.php and .htaccess tampering detection 
* Unknown PHP file detection in core directories
Core File Repair 
* Downloads clean copies from WordPress.org SVN 
* MD5 verification before writing 
* Single file or bulk repair
Security Headers 
* X-Frame-Options, X-Content-Type-Options, X-XSS-Protection 
* Referrer-Policy, Permissions-Policy (per-feature builder) 
* HSTS with preload support 
* Content-Security-Policy with visual builder 
* CSP violation reporting endpoint (REST API) 
* A–F letter grade for your header configuration
User Security 
* User enumeration protection (?author= + REST API) 
* Strong password enforcement 
* Block dangerous usernames (admin, root, etc.) 
* Inactive user auto-lock (configurable threshold) 
* Admin action audit trail 
* Active session manager (view & revoke) 
* GDPR IP anonymization
Post-Hack Recovery 
* Lock PHP execution in uploads and wp-includes 
* Log out all users instantly 
* Force password reset for all users 
* Reinstall free plugins from WordPress.org 
* Delete version-revealing files (readme.html, etc.) 
* Weekly security summary email report
Monitoring & Notifications 
* Activity log (filterable, paginated, CSV export, configurable retention) 
* HTML branded email alerts 
* Slack/webhook notifications (compatible with Make.com, Zapier, Discord) 
* Real-time dashboard stats (auto-refresh every 30s) 
* 7-day login attempt chart
Developer Tools 
* WP-CLI commands (wp xsec status|scan|block-ip|unblock-ip|2fa-reset|export-settings|import-settings) 
* Settings import/export (JSON) 
* Security score with category breakdown
Developed by <a href="https://liveupx.com" rel="nofollow ugc">Liveupx.com</a> 
Cloud hosting partner: <a href="https://xhost.live" rel="nofollow ugc">xHost</a> — by Liveupx.com 
<a href="https://justhunt.co/startups/x-security" rel="nofollow ugc">Featured on JustHunt.co</a>

Liveupx Security

Complete WordPress security — Firewall, 2FA, Malware Scanner, Vulnerability Scanner, Login Protection, Security Headers. 100% free.

Nazmul Hasan Robin

Keep your WordPress site safe with minimal effort. NHR Secure helps you:
<ul>
<li>Hide or protect your admin area from unauthorized access.</li>
<li>Limit login attempts to prevent brute-force attacks.</li>
<li>Hide debug logs to prevent sensitive information disclosure.</li>
<li>Add 2FA to your WordPress site.</li>
<li>Scan core files, plugins, and themes for known vulnerabilities.</li>
<li>Monitor site health with one-click security recommendations.</li>
<li>Protect against SQL injection, XSS, and LFI attacks.</li>
<li>Block malicious IPs and entire countries.</li>
</ul>
<h3>Features at a glance:</h3>
<h3>🔒 Limit Login Attempts</h3>
Stop brute-force attacks by temporarily blocking IPs after repeated failed login attempts. 
– Configurable attempt limit (1-20, default: 5) 
– Blocks based on IP + Username combination 
– Auto-unblock after 2 hours
<h3>🔐 Custom Login Page</h3>
Hide wp-login.php and use a custom login URL. 
– Default custom URL: <code>/hidden-access-52w</code> 
– Blocks direct access to wp-login.php and wp-admin for guests
<h3>🛡️ Protect Debug Log File</h3>
Blocks direct access to <code>/wp-content/debug.log</code> 
– Returns 403 Forbidden for all users
<h3>⚙️ Modern Settings Page</h3>
Configure everything from a beautiful React-powered interface. 
– Located under Tools → NHR Secure 
– Dark Mode support for comfortable viewing 
– Enable/disable each feature
<h3>🔐 Two-Factor Authentication (2FA)</h3>
Enable two-factor authentication for users. 
– Support for Authenticator Apps and Email OTP 
– Enforce 2FA for specific user roles (e.g., Administrators) 
– Recovery Codes for emergency access 
– QR code setup for Authenticator Apps
<h3>🛡️ Vulnerability Checker</h3>
Automatically scan your installed plugins, themes, and WordPress core against a known vulnerability database. 
– Daily automatic scans 
– Alerts for critical security issues 
– Check file integrity
<h3>🖥️ User Session Management</h3>
Monitor and control active user sessions to prevent unauthorized access. 
– View Active Sessions: See IP, location, device, and login time for all logged-in users. 
– Remote Logout: Instantly log out suspicious sessions or all other devices. 
– Idle Timeout: Automatically log out inactive users after a set period.
<h3>🧱 Hardening & Firewall</h3>
Essential security hardening to lock down your WordPress site. 
– Disable XML-RPC: Prevent remote attacks and brute-force attempts. 
– Disable File Editor: Stop file modifications from the dashboard. 
– Hide WP Version: Obscure your WordPress version from attackers. 
– Block User-Agents: Prevent bad bots and scrapers from accessing your site. 
– Disable User Enumeration: Stop attackers from harvesting usernames via REST API.
<h3>📝 Activity Audit Log</h3>
Keep a record of important security events on your site. 
– Tracks logins, failed attempts, file changes, and settings updates. 
– View user, IP, and event details. 
– Configurable log retention policy.
<h3>🏥 Security Health Check & One-Click Secure</h3>
Get an instant overview of your site’s security posture. 
– Security Score: View your overall protection percentage and grade (A+ to F). 
– Health Dashboard: See which security features are active and which need attention. 
– One-Click Secure: Apply recommended security settings instantly. 
– 11 Security Checks: Comprehensive analysis of your security status.
<h3>🛡️ Advanced Firewall (IPS)</h3>
Proactive intrusion prevention system that blocks malicious requests in real-time. 
– SQL Injection Protection: Detect and block SQLi attacks automatically. 
– XSS Prevention: Stop cross-site scripting attempts. 
– LFI Protection: Prevent local file inclusion attacks. 
– Pattern Matching: Advanced regex-based detection for common attack vectors. 
– Automatic Blocking: Suspicious requests are blocked before they reach WordPress.
<h3>🌍 IP & Country Management</h3>
Control access to your site with granular IP and geographic filtering. 
– IP Whitelist: Allow trusted IPs to bypass all security filters. 
– IP Blacklist: Block malicious IPs permanently from your site. 
– CIDR Support: Use CIDR notation for blocking entire IP ranges (e.g., 192.168.1.0/24). 
– Country Blocking: Block access from 90+ countries using GeoIP lookup. 
– Smart Caching: GeoIP lookups are cached for 24 hours for optimal performance. 
– Private IP Detection: Automatically skip local/private IPs.
<h3>⚡ Lightweight & Minimal</h3>
Designed to deliver maximum security with minimal code. No bloat, no complexity. 
– Compatible with most WordPress themes and plugins.
<h3>External Services</h3>
This plugin utilizes the <a href="https://wpvulnerability.com/" rel="nofollow ugc">WPVulnerability</a> API to check for vulnerabilities. 
– Service: WPVulnerability 
– Data: Only plugin slugs and versions are sent. No personal data is collected.

NHR Secure – Login Security, Firewall, 2FA & Audit Log

A lightweight WordPress security plugin to protect your admin area with a custom login URL, hide debug logs, limit login attempts, and add 2FA.

Liveupx Security vs NHR Secure – Login Security, Firewall, 2FA & Audit Log