Mirco Babini

Alfio Piccione

Andrea Capone

Babini Mazzari

NIS2 provides activity logging, file integrity monitoring, access protection and vulnerability scanning to help sites comply with the EU NIS2 directive.
<h3>NIS2 Compliance: The 1st WordPress NIS2 Plugin</h3>
NIS2 is the second iteration of the EU’s Network and Information Security (NIS) directive, a primary cybersecurity law that expands the scope of the original NIS directive to cover more sectors and entities, such as energy, transport, banking, healthcare, and digital infrastructure.
The directive mandates stricter security requirements, includes supply chain security, and assigns personal accountability to management for non-compliance.
<h3>Quick and easy setup</h3>
Choose which modules you want to enable, configure their settings and start monitoring your site in minutes.
Available modules are: 
– Activity Logger: logs important events such as user logins, content changes, plugin/theme installations and more. 
– File Integrity Monitoring: monitors core WordPress files, themes and plugins for unauthorized changes. 
– Access Protection: protects login and admin pages with Google reCAPTCHA v2 and limits access 
– Vulnerability Scanner: scans installed plugins and themes for known vulnerabilities using the WPScan database. 
– Compliance Checklist: provides a checklist of security best practices to help you improve your site’s security posture
<h3>Third party services</h3>
This plugin relies on the following third-party/external services:
Google reCAPTCHA v2 
Used to protect the WordPress login forms against automated abuse and spam. 
– Data sent: when a user interacts with the login form, the plugin loads the reCAPTCHA JavaScript API and sends the user’s IP address and form interaction data to Google’s reCAPTCHA service in order to validate the request. 
– Service provider: Google LLC 
– Terms of Service: https://www.google.com/intl/en/policies/terms/ 
– Privacy Policy: https://policies.google.com/privacy
IP-API.com 
Used to perform basic geolocation based on the visitor’s IP address (e.g., country, city, ISP). 
– Data sent: the visitor’s public IP address is queried against the ip-api.com service. No additional personal or sensitive data is transmitted. 
– Service provider: IP-API.com 
– Terms of Service: https://ip-api.com/docs/legal 
– Privacy Policy: https://ip-api.com/docs/legal
<h3>F.A.Q.</h3>
Does the plugin conflict with security plugins? 
No. NIS2 detects other popular security plugins and integrates with them when possible.

NIS2 Compliance

A comprehensive security compliance plugin implementing logging, monitoring and vulnerability management features.

Sami Ahmed Siddiqui

This plugin helps safeguard your website against two common types of Cross-Site Scripting (XSS) vulnerabilities:
<ul>
<li>Reflected XSS: This happens when harmful scripts are hidden in a website’s URL. If a user clicks a link with such a script, it can run in their browser, potentially stealing their data or taking control of their system.</li>
<li>Self-XSS: This occurs when a user’s own input on your website is displayed back to them in an unsafe way, allowing malicious scripts to run in their browser.</li>
</ul>
This plugin provides several layers of protection:
Blocking: When active, the plugin checks URLs for specific characters. If it finds any of these characters in the URL, it redirects the user to prevent a potential XSS attack. You can customize which characters to block or allow.
<ul>
<li>Opening Round Bracket <code>(</code></li>
<li>Closing Round Bracket <code>)</code></li>
<li>Less than Sign <code><</code></li>
<li>Greater than Sign <code>></code></li>
<li>Opening Square Bracket <code>[</code></li>
<li>Closing Square Bracket <code>]</code></li>
<li>Opening Curly Bracket <code>{</code></li>
<li>Pipe or Vertical Bar <code>|</code></li>
<li>Closing Curly Bracket <code>}</code></li>
</ul>
Encoding: For an extra layer of security, the plugin encodes certain characters found in URL parameters. This stops harmful code from running, even if it’s present in the URL. You can also choose to exclude specific parameters from being encoded.
<ul>
<li>Exclamation Mark <code>!</code></li>
<li>Double Quotation <code>"</code></li>
<li>Single Quotation <code>'</code></li>
<li>Opening Round Bracket <code>(</code></li>
<li>Closing Round Bracket <code>)</code></li>
<li>Asterisk Sign <code>*</code></li>
<li>Less than Sign <code><</code></li>
<li>Greater than Sign <code>></code></li>
<li>Grave Accent “`</li>
<li>Cap Sign <code>^</code></li>
<li>Opening Square Bracket <code>[</code></li>
<li>Closing Square Bracket <code>]</code></li>
<li>Opening Curly Bracket <code>{</code></li>
<li>Pipe or Vertical Bar <code>|</code></li>
<li>Closing Curly Bracket <code>}</code></li>
</ul>
Escaping HTML in <code>$_GET</code>: This plugin automatically makes HTML characters safe within the <code>$_GET</code> variable. This is vital if your website pulls data from URLs and displays it as part of your web page. It helps prevent malicious scripts from being injected through user-provided input.
<h3>Important Notes:</h3>
<ul>
<li>After activating the plugin, thoroughly test your website forms, especially if you use WooCommerce. Make sure the plugin doesn’t interfere with your shopping cart and checkout processes.</li>
<li>We welcome bug reports for this plugin on GitHub: <a href="https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues" rel="nofollow ugc">https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues</a>. Please remember that GitHub is for bug reports only, not general support.</li>
</ul>
By using this plugin and following these recommendations, you can significantly improve your website’s defense against XSS attacks.

Prevent XSS Vulnerability

Very useful plugin.

This WP plugin blocks XSS by encoding harmful URL characters & safely handling HTML in $_GET. Customizable settings for enhanced website security.

NIS2 Compliance vs Prevent XSS Vulnerability