Liveupx

Liveupx Security is a complete, 100% free WordPress security plugin that rivals paid solutions. No paywalls, ever.
<h4>Core Features</h4>
Login Security 
* Brute force protection with progressive lockouts (1st/2nd/3rd+ strikes escalate automatically) 
* Multi-provider CAPTCHA: Math, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile 
* Honeypot bot detection (wp-login.php + WooCommerce) 
* Passwordless magic link login 
* Two-factor authentication: TOTP (Google Authenticator) + Email OTP 
* Trusted device (30-day bypass cookie) 
* Geolocation login alerts — notify when login comes from a new country 
* Subnet auto-blocking (repeated attacks from /24 range) 
* Custom login URL (hide wp-login.php)
Firewall / WAF 
* PHP-based Web Application Firewall running at priority 1 
* Remote WAF rule feed (auto-updated from liveupx.com) 
* Admin-defined custom firewall rules 
* Per-endpoint rate limiting (REST API, checkout, search, etc.) 
* REST API security controls (block guests, hide /users endpoint) 
* Country/geo blocking with API fallback chain 
* Bad bot blocking with verified bot allowlist (Google, Bing, etc.) 
* Referrer blocking with spam referrer presets 
* Bad query/XSS/SQL injection blocking 
* .htaccess security rules
Malware Scanner 
* Chunked AJAX scanner — scans plugins, themes, uploads, mu-plugins 
* 30+ malware patterns including backdoors, crypto miners, shell injections 
* Heuristic risk scoring (0–100) per suspicious file 
* Auto-quarantine critical findings during scan 
* Scan diff — shows new threats vs last scan 
* Database malware scanner (posts, options, comments, users) 
* File quarantine and permanent delete
Vulnerability Scanner 
* Powered by WPScan API (free tier) 
* Scans all active plugins and active theme for known CVEs 
* CVSS severity scoring (Critical/High/Medium/Low) 
* Dashboard widget showing unresolved critical/high count 
* Dedicated Vulnerabilities admin page
File Integrity 
* WordPress core file integrity check (vs WordPress.org checksums API) 
* Plugin & theme checksum verification (vs WordPress.org checksums) 
* wp-config.php and .htaccess tampering detection 
* Unknown PHP file detection in core directories
Core File Repair 
* Downloads clean copies from WordPress.org SVN 
* MD5 verification before writing 
* Single file or bulk repair
Security Headers 
* X-Frame-Options, X-Content-Type-Options, X-XSS-Protection 
* Referrer-Policy, Permissions-Policy (per-feature builder) 
* HSTS with preload support 
* Content-Security-Policy with visual builder 
* CSP violation reporting endpoint (REST API) 
* A–F letter grade for your header configuration
User Security 
* User enumeration protection (?author= + REST API) 
* Strong password enforcement 
* Block dangerous usernames (admin, root, etc.) 
* Inactive user auto-lock (configurable threshold) 
* Admin action audit trail 
* Active session manager (view & revoke) 
* GDPR IP anonymization
Post-Hack Recovery 
* Lock PHP execution in uploads and wp-includes 
* Log out all users instantly 
* Force password reset for all users 
* Reinstall free plugins from WordPress.org 
* Delete version-revealing files (readme.html, etc.) 
* Weekly security summary email report
Monitoring & Notifications 
* Activity log (filterable, paginated, CSV export, configurable retention) 
* HTML branded email alerts 
* Slack/webhook notifications (compatible with Make.com, Zapier, Discord) 
* Real-time dashboard stats (auto-refresh every 30s) 
* 7-day login attempt chart
Developer Tools 
* WP-CLI commands (wp xsec status|scan|block-ip|unblock-ip|2fa-reset|export-settings|import-settings) 
* Settings import/export (JSON) 
* Security score with category breakdown
Developed by <a href="https://liveupx.com" rel="nofollow ugc">Liveupx.com</a> 
Cloud hosting partner: <a href="https://xhost.live" rel="nofollow ugc">xHost</a> — by Liveupx.com 
<a href="https://justhunt.co/startups/x-security" rel="nofollow ugc">Featured on JustHunt.co</a>

Liveupx Security

Complete WordPress security — Firewall, 2FA, Malware Scanner, Vulnerability Scanner, Login Protection, Security Headers. 100% free.

squishit

Squish Site Patrol gives your WordPress site a complete health check — security hardening, malware scanning, login protection, and page speed in a single clean dashboard.
Two-Factor Authentication (2FA) 
* TOTP-based 2FA with QR code setup (Google Authenticator, Authy, etc.) 
* Custom branded interstitial login page — replaces the default wp-login.php flow 
* Per-user 2FA enrollment with recovery options
Login Protection 
* reCAPTCHA v3 on the login page (free tier, no checkbox required) 
* Geo IP country blocking — restrict logins by country via ipapi.co 
* Magic link login — send a one-time signed login link to your admin email (Patched) 
* Failed login attempt monitoring and alerts (Patched) 
* Detects predictable “admin” username
Security Checks 
* WordPress core version check 
* Plugin update status — flags outdated plugins 
* SSL / HTTPS detection 
* File editor status check (wp-admin editor) 
* wp-config.php permissions check (Patched) 
* XML-RPC status check (Patched) 
* Debug mode detection (Patched) 
* Admin account audit — flags inactive admin accounts (Patched) 
* Database prefix check — flags default wp_ prefix (Patched) 
* Directory listing detection (Patched) 
* HTTP security headers check (Patched)
Malware Scanner 
* Verifies all 3,000+ WordPress core files against official checksums 
* Detects PHP files hidden in your uploads folder 
* Scans for dangerous file types (.exe, .sh, .bat) in uploads 
* User enumeration vulnerability check 
* Flags any modified core files 
* Real-time file change monitoring with baseline comparison (Patched)
Email Breach Detection 
* Checks admin email addresses against HaveIBeenPwned (Patched) 
* Alerts you if any admin account appears in a known breach
Audit Log 
* Tracks logins, failed login attempts, plugin installs, settings changes, and scans 
* 90-day retention with full event history 
* Filter by event type — login, scan, settings, plugin activity and more 
* Recent activity strip on the main dashboard
Page Speed & Core Web Vitals 
* Live Google PageSpeed Insights score 
* Core Web Vitals — LCP, FCP, and CLS 
* Mobile performance scoring 
* Scan any public URL 
* Inline metric explanations
Reporting 
* Weekly HTML email reports with a full scan summary (Patched) 
* Scheduled automatic daily scans (Patched) 
* Email alerts when issues are detected (Patched) 
* SSL certificate expiry alerts (Patched)
Dashboard & UX 
* Clean two-panel layout — Security on the left, Scans & hardening on the right 
* Hardening tab consolidates all Patched checks in one place 
* Issues-only toggle on both panels — hide passing checks, focus on what needs fixing 
* Rescan button with toast notification (no page reload) 
* Dark mode toggle 
* Scan spinner and auto-scan status badge 
* Score cards hidden by default until first scan runs 
* Inline metric tooltips
Performance 
* Aggressive transient caching (12–24hr TTL) across all check classes 
* Zero front-end footprint — all scans run in wp-admin only
<h4>Squish Site Patrol Patched — $15/mo</h4>
Upgrade to Patched for automatic monitoring and advanced protection:
<ul>
<li>Scheduled automatic daily scans</li>
<li>Weekly HTML email reports</li>
<li>Email alerts when issues are found</li>
<li>Magic link login — passwordless one-time login links</li>
<li>Failed login attempt monitoring</li>
<li>SSL certificate expiry alerts</li>
<li>Real-time file change monitoring with baseline comparison</li>
<li>Reset file monitoring baseline after legitimate updates</li>
<li>wp-config.php permissions check</li>
<li>XML-RPC status check</li>
<li>Debug mode detection</li>
<li>HTTP security headers check</li>
<li>Admin account audit — flags inactive admin accounts</li>
<li>Database prefix check — flags default wp_ prefix</li>
<li>Directory listing detection</li>
<li>Email breach check via HaveIBeenPwned</li>
</ul>
<h3>External Services</h3>
<h4>Google PageSpeed Insights API</h4>
Used to analyze page speed and Core Web Vitals for any URL entered by the user. Data sent: the URL being scanned. This call is only made when the user clicks “Run scan”. 
* Service: https://developers.google.com/speed/docs/insights/v5/about 
* Privacy: https://policies.google.com/privacy 
* Terms: https://developers.google.com/terms
<h4>WordPress.org Checksums API</h4>
Used to verify the integrity of WordPress core files by comparing them against official checksums. No user data is sent — only the WordPress version number and locale. 
* Service: https://api.wordpress.org/core/checksums/1.0/ 
* Privacy: https://wordpress.org/about/privacy/
<h4>ipapi.co</h4>
Used to determine the country of origin for login attempts when Geo IP country blocking is enabled. Data sent: the visitor’s IP address. This check only runs on the login page when the feature is active. 
* Service: https://ipapi.co 
* Privacy: https://ipapi.co/privacy/
<h4>HaveIBeenPwned API (Patched only)</h4>
Used to check if admin email addresses appear in known data breach databases. Requires a valid HIBP API key configured in settings. 
* Service: https://haveibeenpwned.com/API/v3 
* Privacy: https://haveibeenpwned.com/Privacy 
* Terms: https://haveibeenpwned.com/API/v3#license
<h4>Freemius</h4>
Used to manage the Patched premium subscription, licensing, and payments. Data sent upon upgrade: site URL, WordPress version, plugin version, and user email if the user opts in. 
* Service: https://freemius.com 
* Privacy: https://freemius.com/privacy/ 
* Terms: https://freemius.com/terms/

Squish Site Patrol

Complete WordPress security, malware scanning, login protection, and performance monitoring in one clean dashboard.

Liveupx Security vs Squish Site Patrol