shadowscan

ShadowScan Security Link gives you ShadowScan Guard local WordPress hardening for plugin auto-updates, username enumeration reduction, version/plugin exposure reduction, sensitive-file blocking, and basic connection/self-check diagnostics.
The plugin supports dual backend pairing with both Guard and ShadowScan. Pair with Guard backend for Guard-specific features, or connect to ShadowScan Portal to sync heartbeat status and unlock managed features for sites with an active Essential or Premium plan, or an approved reviewed pricing path. Basic Hosting can stay hosting-only, while ShadowScan Guard local hardening remains available in the plugin until managed entitlements are active.
Pairing the plugin and enabling remote diagnostics each require an explicit administrator acknowledgment in WP Admin. Those checkpoints are covered by the <a href="https://shadowscan.com.au/plugin-addendum" rel="nofollow ugc">ShadowScan Plugin Addendum</a>.
ShadowScan does not install, activate, or configure third-party security tools. If another security plugin is present, the connector only records its presence as metadata.
<h3>External services</h3>
This plugin can connect to external services to sync status, process security workflows, and support optional diagnostics after an admin pairs the site to ShadowScan.
<ul>
<li>Service: ShadowScan API (hosted at Supabase Edge Functions)</li>
<li>URL: <a href="https://axuhxgeafczsoctlzycz.supabase.co/functions/v1/" rel="nofollow ugc">ShadowScan API</a></li>
<li>Used for: ShadowScan pairing, heartbeat sync, command polling, command-result upload, subscription/policy sync, and support contact submissions.</li>
<li>Data sent and when: site URL, WordPress version, PHP version, connector version, Guard Layer/control status, heartbeat timestamps, and command execution metadata whenever the connector syncs with ShadowScan; contact form fields only when an admin submits support contact.</li>
<li>Terms: <a href="https://shadowscan.com.au/terms" rel="nofollow ugc">shadowscan.com.au/terms</a></li>
<li>Privacy: <a href="https://shadowscan.com.au/privacy" rel="nofollow ugc">shadowscan.com.au/privacy</a></li>
<li>
Plugin Addendum: <a href="https://shadowscan.com.au/plugin-addendum" rel="nofollow ugc">shadowscan.com.au/plugin-addendum</a>
</li>
<li>
Service: Guard API (hosted at Supabase Edge Functions)
</li>
<li>URL: <a href="https://dzaidjskedmlrtyqdobg.supabase.co/functions/v1/" rel="nofollow ugc">Guard API</a></li>
<li>Used for: Guard pairing validation, migration token validation, and Guard backend operations.</li>
<li>Data sent and when: pairing codes, migration tokens, and site metadata only when pairing with Guard backend or processing migration scenarios.</li>
<li>Terms: <a href="https://shadowscan.com.au/terms" rel="nofollow ugc">shadowscan.com.au/terms</a></li>
<li>Privacy: <a href="https://shadowscan.com.au/privacy" rel="nofollow ugc">shadowscan.com.au/privacy</a></li>
<li>
Plugin Addendum: <a href="https://shadowscan.com.au/plugin-addendum" rel="nofollow ugc">shadowscan.com.au/plugin-addendum</a>
</li>
<li>
Service: Have I Been Pwned Passwords API
</li>
<li>URL: <a href="https://api.pwnedpasswords.com" rel="nofollow ugc">api.pwnedpasswords.com</a></li>
<li>Used for: optional breached-password checks in password policy enforcement.</li>
<li>Data sent and when: k-anonymity password hash prefix (first 5 SHA-1 characters, no raw passwords) only when a password is checked by the policy flow.</li>
<li>Terms: <a href="https://haveibeenpwned.com/TermsOfUse" rel="nofollow ugc">haveibeenpwned.com/TermsOfUse</a></li>
<li>
Privacy: <a href="https://haveibeenpwned.com/Privacy" rel="nofollow ugc">haveibeenpwned.com/Privacy</a>
</li>
<li>
Service: Sentry
</li>
<li>URL: <a href="https://sentry.io" rel="nofollow ugc">sentry.io</a></li>
<li>Used for: optional error and fatal-event telemetry to assist troubleshooting.</li>
<li>Data sent and when: error event metadata (such as exception messages, stack traces, and runtime context) only after an admin explicitly enables Sentry telemetry in plugin settings and a Sentry DSN is configured; the optional MU diagnostics helper can send early-startup fatal errors only while both Sentry telemetry and remote diagnostics are enabled.</li>
<li>Terms: <a href="https://sentry.io/terms/" rel="nofollow ugc">sentry.io/terms</a></li>
<li>Privacy: <a href="https://sentry.io/privacy/" rel="nofollow ugc">sentry.io/privacy</a></li>
</ul>
<h3>Third-Party Libraries</h3>
This plugin bundles: 
* <a href="https://github.com/antonioribeiro/google2fa" rel="nofollow ugc">pragmarx/google2fa</a> (MIT License) 
* <a href="https://github.com/Bacon/BaconQrCode" rel="nofollow ugc">bacon/bacon-qr-code</a> (BSD-2-Clause; Copyright (c) 2017-present, Ben Scholzen “DASPRiD”)
<h3>Hooks</h3>
<code>shadowscan_log</code> 
Fires when the plugin emits an internal log message. You can hook this in a must-use plugin or theme if you want to capture logs.

ShadowScan Security Link

ShadowScan Guard local WordPress hardening and basic diagnostics, with optional Guard or ShadowScan portal connection for managed features.

Ashar

SecurelyWP

SecurelyWP is a hassle-free security plugin that makes your WordPress site safer the moment you activate it. Most features work out of the box, with optional CAPTCHA and two-factor authentication (2FA) configuration for enhanced protection. It includes strong security features, system details, security headers, CAPTCHA integration, and 2FA to keep your site secure and healthy.
Why Choose SecurelyWP?
<ul>
<li>Works Out of the Box: Most security features activate automatically upon installation.</li>
<li>Comprehensive Protection: Guards against hacking, malicious files, form spam, and unauthorized access.</li>
<li>Lightweight: Designed to run smoothly without affecting your site’s speed or performance.</li>
<li>Free Features: Includes system details, security headers, CAPTCHA, and 2FA to monitor and protect your site.</li>
</ul>
<h3>Features</h3>
<ul>
<li>
Hide WordPress Version
<ul>
<li>Why: Stops hackers from targeting weaknesses in your WordPress version. </li>
<li>Impact: Good protection with no effect on your site’s appearance.</li>
</ul>
</li>
<li>
Disable PHP Execution in Uploads Folder
<ul>
<li>Why: Prevents harmful scripts from running if someone uploads a malicious file. </li>
<li>Impact: Strong defense against file-based attacks.</li>
</ul>
</li>
<li>
Prevent User Enumeration
<ul>
<li>Why: Blocks hackers from guessing usernames through sneaky methods. </li>
<li>Impact: Keeps your user list safe from prying eyes.</li>
</ul>
</li>
<li>
Detect & Warn About “admin” Username
<ul>
<li>Why: Alerts you if your site uses the risky “admin” username. </li>
<li>Impact: Big security boost if you change the username.</li>
</ul>
</li>
<li>
Disable File Editing in Dashboard
<ul>
<li>Why: Stops anyone from modifying your site’s code through the WordPress dashboard. </li>
<li>Impact: Major safeguard against unauthorized code changes.</li>
</ul>
</li>
<li>
Force HTTPS for Login & Admin
<ul>
<li>Why: Ensures your login and admin pages use a secure connection. </li>
<li>Impact: Critical for keeping your credentials safe.</li>
</ul>
</li>
<li>
Basic Brute Force Protection (Lite)
<ul>
<li>Why: Temporarily blocks repeated failed login attempts. </li>
<li>Impact: Strong protection against login attacks.</li>
</ul>
</li>
<li>
System Details
<ul>
<li>Why: Shows important info about your site to monitor its health. </li>
<li>Impact: Keeps you informed about your site’s status.</li>
</ul>
</li>
<li>
Security Headers
<ul>
<li>Why: Adds HTTP headers to improve your site’s security. </li>
<li>Impact: Strengthens your site’s defense with minimal setup.</li>
</ul>
</li>
<li>
CAPTCHA Protection (Cloudflare Turnstile)
<ul>
<li>Why: Adds CAPTCHA to prevent spam and bot submissions. </li>
<li>Impact: Enhances form security with user-friendly CAPTCHA.</li>
</ul>
</li>
<li>
Two-Factor Authentication (2FA)
<ul>
<li>Why: Adds an extra layer of security by requiring a second verification step during login. </li>
<li>Impact: Significantly reduces the risk of unauthorized access. </li>
</ul>
</li>
</ul>
2FA Features: 
– Authenticator App (TOTP): Use apps like Google Authenticator or Authy for time-based codes. 
– Email 2FA: Receive codes via email for verification. 
– Recovery Codes: Generate emergency codes for access if other methods are unavailable. 
– Per-User Settings: Each user can configure their own 2FA preferences. 
– Multisite Support: Super admins can enforce 2FA network-wide. 
– Flexible Options: Choose primary 2FA method from TOTP, Email 2FA, or Recovery Codes.
Supported Forms, Plugins & Multisite for CAPTCHA: 
– Core WordPress: Login, Registration, Lost Password, Comment 
– E-commerce & Membership: WooCommerce Checkout, MemberPress, Ultimate Member, WP-Members 
– Form Plugins: WPForms, Gravity Forms, Contact Form 7 (CF7), Formidable Forms, Forminator, Elementor Pro, Easy Digital Downloads (EDD), Mailchimp for WordPress 
– Community / Forums: BuddyPress, bbPress 
– Multisite: Multisite Signup Forms
<h3>How to Set Up CAPTCHA with Cloudflare Turnstile</h3>
<ol>
<li>Sign Up for Cloudflare: Go to https://www.cloudflare.com/ and create a free account or log in. </li>
<li>Add Your Site: Click “Add a Site” in the dashboard and enter your domain. </li>
<li>Access Turnstile: Navigate to the “Turnstile” section in the Cloudflare dashboard. </li>
<li>Create a Turnstile Widget:
<ul>
<li>Click “Add Widget” </li>
<li>Provide a name (e.g., “SecurelyWP CAPTCHA”) </li>
<li>Add Hostnames (your domain, e.g., example.com) → Click “Add” </li>
<li>Choose the widget type (“Managed”) </li>
</ul>
</li>
<li>Get Your Keys: Copy the Site Key and Secret Key. </li>
<li>Add Keys to SecurelyWP: Go to SecurelyWP > CAPTCHA Settings in WordPress → paste keys → enable CAPTCHA for desired forms. </li>
<li>Test Your CAPTCHA: Visit a form to ensure the CAPTCHA widget appears and works correctly.</li>
</ol>
<h3>How to Set Up Two-Factor Authentication</h3>
<ol>
<li>Access 2FA Settings: Go to “Profile” > “Two-Factor Authentication” in your WordPress dashboard. </li>
<li>Enable 2FA Methods:
<ul>
<li>Authenticator App: Scan the QR code or enter the secret into your app (Google Authenticator, Authy). Verify with a code. </li>
<li>Email 2FA: Enable to receive codes via email. </li>
<li>Recovery Codes: Generate emergency codes. Copy or download codes for safekeeping. </li>
</ul>
</li>
<li>Choose Primary Method: Select your preferred 2FA method (Authenticator App, Email, or Recovery Codes). </li>
<li>Test 2FA: Log out and log in to verify the 2FA prompt appears below the login form. </li>
<li>Multisite (Super Admins): Enable network-wide 2FA enforcement for all users.</li>
</ol>

SecurelyWP – all-in-one security

SecurelyWP is a simple security plugin that protects your WordPress site right after activation—no setup needed for most features.

ShadowScan Security Link vs SecurelyWP – all-in-one security