Marc Armengou

<p>PlugSeal gives administrators granular control over what each active plugin is allowed to do, inspired by Android app permissions and Flatseal for Flatpak. Each active plugin is listed in the settings page. For each plugin, administrators can allow or deny individual permissions with immediate effect. All permissions are allowed by default, so no existing functionality is broken until an administrator explicitly restricts it.</p>
<p><strong>Permissions covered:</strong></p>
<ul>
<li><code>db:read</code> / <code>db:write</code> — database queries via $wpdb</li>
<li><code>db:read:users</code> / <code>db:write:users</code> — read and write access to user data (also covers wp_delete_user and wp_update_user)</li>
<li><code>http:outbound</code> — outbound HTTP requests via the WordPress HTTP API</li>
<li><code>options:read</code> / <code>options:write</code> — WordPress options via get_option / update_option (see limitations)</li>
<li><code>email:send</code> — sending email via wp_mail()</li>
<li><code>cron:write</code> — scheduling events via wp_schedule_event()</li>
<li><code>transients:write</code> — writing transients via set_transient()</li>
<li><code>users:create</code> — creating users via wp_create_user() (deletes are covered by db:write:users)</li>
<li><code>rest:register</code> — registering REST API endpoints via register_rest_route()</li>
<li><code>shortcode:register</code> — registering shortcodes via add_shortcode()</li>
<li><code>rewrite:register</code> — registering rewrite rules via add_rewrite_rule()</li>
<li><code>admin:menu</code> — adding entries to the admin menu and submenus</li>
<li><code>dashboard:widget</code> — adding dashboard widgets via wp_add_dashboard_widget()</li>
<li><code>hooks:frontend</code> — hooking into frontend hooks (wp_head, wp_footer, the_content, wp_enqueue_scripts…)</li>
<li><code>hooks:admin</code> — hooking into admin hooks (admin_head, admin_notices, admin_enqueue_scripts…)</li>
<li><code>hooks:auth</code> — hooking into authentication hooks (wp_login, wp_logout, user_register, authenticate…)</li>
<li><code>hooks:content</code> — hooking into content hooks (save_post, delete_post, pre_get_posts, wp_handle_upload…)</li>
<li><code>hooks:lifecycle</code> — hooking into plugin and theme lifecycle hooks (activated_plugin, deactivated_plugin, switch_theme…)</li>
</ul>
<p><strong>Honest limitations:</strong></p>
<p>This plugin intercepts official WordPress APIs by identifying the calling plugin via the PHP call stack. It cannot intercept calls made by WordPress core on behalf of a plugin — for example, when WordPress processes a settings form via <code>options.php</code>, the call stack contains core files rather than the plugin files.</p>
<p>Specific limitations:</p>
<ul>
<li><code>options:read</code> / <code>options:write</code> — work when a plugin calls these APIs directly from its own code (hooks, AJAX, cron). Do not block standard WordPress settings forms processed by <code>options.php</code>.</li>
<li>Filesystem access (<code>file_get_contents</code>, <code>fopen</code>, etc.) is not intercepted.</li>
<li>Direct <code>mysqli</code> connections, <code>eval()</code>, and raw PHP file functions bypass all interceptors.</li>
<li><code>wp_update_user()</code> and <code>wp_delete_user()</code> are covered by <code>db:write:users</code> since they write directly to the users table.</li>
<li><code>admin_init</code> is intentionally excluded from <code>hooks:admin</code> as it is too critical to block safely.</li>
</ul>


PlugSeal

Control what each active plugin is allowed to do. Allow or deny specific permissions per plugin, with immediate effect.

Vladimir Marusic

<p>Maroon Horizon Smart Firewall is built for practical WordPress protection: block bad traffic, scan for malware, quarantine suspicious files, and reduce attack surface — without sending your site files off-server.</p>
<p>Advanced Security Check (Quick Scan) gives you an easy-to-understand Overall Security Rating, plus clear details and explanations for each check so you can quickly see what to improve and raise your security level.</p>
<p>This WordPress.org (FREE) build is fully functional for the FREE feature set and is designed to run locally for those features. Advanced capabilities are provided by a separate commercial PRO plugin (not included in this WordPress.org build).</p>
<p>Outbound network requests (if any) are disclosed under “External Services” and “Privacy”.</p>
<h4>What you get in the FREE plugin (local-only)</h4>
<ul>
<li>Advanced Security Check (Quick Scan) with an Overall Security Rating and easy-to-follow explanations so you can improve your security level step by step.</li>
<li>Manual IP blocking and IP management.</li>
<li>Security patch toggles for common hardening actions.</li>
<li>Malware scanning of uploads and theme directories using local pattern detection (no external signatures).</li>
<li>Quarantine management (restore / delete quarantined files).</li>
<li>Quick file integrity checks (where supported in the FREE workflow).</li>
</ul>
<h4>Local-first design (privacy & control)</h4>
<ul>
<li>Malware scans run on your server.</li>
<li>Scanned file contents are not uploaded by the plugin.</li>
<li>External requests (if any) are limited and disclosed below.</li>
</ul>
<h4>Who it’s for</h4>
<ul>
<li>Site owners who want simple, practical protection without complex configuration.</li>
<li>Agencies and developers who need a clean hardening + scanning toolkit.</li>
<li>Anyone who wants a transparent FREE build, with an optional PRO upgrade path.</li>
</ul>
<h4>PRO features (separate commercial plugin, optional)</h4>
<ul>
<li>AI-Powered Threat Feed (encrypted subnet feed) and automatic sync.</li>
<li>Real-Time AI Threat Detection (AI model signatures).</li>
<li>AI-Powered Deep Scan and scheduled email reports.</li>
</ul>
<h4>Commercial PRO plugin</h4>
<p>The PRO edition is a separate commercial plugin (not included in this WordPress.org build).<br />
Learn more: <a href="https://mh.ie/maroon-horizon-smart-firewall/" rel="nofollow ugc">https://mh.ie/maroon-horizon-smart-firewall/</a></p>
<h3>External Services</h3>
<p>This plugin may perform outbound network requests in the following cases:</p>
<p>1) WordPress.org Core Checksums API (FREE: Core Integrity Scan)<br />
* Service provider: WordPress.org<br />
* Endpoint: https://api.wordpress.org/core/checksums/1.0/<br />
* When: Only when you manually run the Core Integrity Scan from Maroon Horizon -> Scanner.<br />
* Data sent: WordPress version and locale via URL query parameters. Your server IP address is inherently shared as part of the HTTPS request.<br />
* Data received: Official JSON containing WordPress core file checksums, used to verify your local core files. No site files or content are uploaded.<br />
* Privacy: https://wordpress.org/about/privacy/</p>
<p>2) Freemius (optional: licensing, updates, opt-in telemetry)<br />
* Service provider: Freemius (freemius.com)<br />
* When: Only if you opt in to Freemius (for example, to manage licensing and receive updates).<br />
* Data sent: Technical information required for licensing and updates (and, if you opt in, diagnostic/usage metadata), as described by Freemius.<br />
* Data received: License status and update metadata needed to deliver plugin updates.<br />
* Terms: https://freemius.com/terms/<br />
* Privacy: https://freemius.com/privacy/</p>
<p>3) Maroon Horizon service (mh.ie) (PRO only: encrypted threat-feed / AI signature bundles)<br />
* Service provider: Maroon Horizon Ltd – <a href="https://mh.ie" rel="nofollow ugc">https://mh.ie</a><br />
* When: Only in the separate PRO plugin, when you use PRO features that require server-side data (e.g., Threat Feed sync / AI signature updates).<br />
* Data sent: Site URL, install ID, product/plan identifiers, license identifiers/keys, plugin/WP/PHP versions, plus standard HTTPS request metadata (including your server IP).<br />
* Data received: A JSON response containing metadata and a time-limited download URL, followed by encrypted bundles used by the PRO engine. No site files or content are uploaded.<br />
* Terms: https://mh.ie/terms<br />
* Privacy: https://mh.ie/privacy-policy</p>
<h3>Privacy</h3>
<p>Maroon Horizon Smart Firewall is designed to minimize data sharing.</p>
<ul>
<li>Most FREE features run locally and do not transmit your site content.</li>
<li>Malware scanning runs locally on your server; scanned file contents are not uploaded by the plugin.</li>
<li>Any outbound requests (and the data exchanged) are disclosed in the “External Services” section above.</li>
<li>PRO-only services are not included in this WordPress.org build.</li>
</ul>


Maroon Horizon Smart Firewall – Malware Scanner & IP Blocking

Firewall, malware scan & IP blocking for WordPress, with Quick Scan Overall Security Rating, hardening, quarantine and integrity checks. PRO adds AI.

PlugSeal vs Maroon Horizon Smart Firewall – Malware Scanner & IP Blocking