pieceagency

Sovaryx Login Security strengthens your WordPress site’s login security while staying lightweight and easy to operate.
<h4>Key Features</h4>
<ul>
<li>Dashboard – Security score display with quick overview of your site’s security status</li>
<li>Security Headers Scan – HTTP header validation and security recommendations</li>
<li>REST API Scan – Comprehensive API endpoint security verification (18 checks)</li>
<li>Login Security – Multi-layer login protection including brute force protection (enabled by default), IP restrictions with trusted proxy support, XML-RPC disable option, reCAPTCHA, Email OTP authentication with IP-based rate limiting, and threat intelligence integration</li>
<li>API Protection – REST API rate limiting and user enumeration prevention</li>
</ul>
<h4>Highlights</h4>
<ul>
<li>Lightweight design – Minimal impact on site performance</li>
<li>Multi-language support – English and Japanese</li>
<li>Plugin conflict detection – Automatic detection and warnings</li>
</ul>
<h4>System Requirements</h4>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.7+ / MariaDB 10.2+</li>
</ul>
<h3>External Services</h3>
This plugin connects to external services for certain features. Below is a description of each service, what data is sent, and when.
<h4>Google reCAPTCHA (Optional)</h4>
When you enable reCAPTCHA protection for the login page, this plugin loads Google reCAPTCHA scripts and sends verification requests.
<ul>
<li>Service Provider: Google LLC</li>
<li>What it is used for: Protecting the login page from automated bots and brute force attacks</li>
<li>Data sent: User IP address, browser information, and interaction data for bot detection</li>
<li>When data is sent: When the login page is loaded and when a login form is submitted</li>
<li>Terms of Service: https://policies.google.com/terms</li>
<li>Privacy Policy: https://policies.google.com/privacy</li>
</ul>
<h4>Threat Intelligence Services (Optional)</h4>
When threat intelligence features are enabled in Login Security settings, the plugin queries external threat databases to check visitor IP addresses for malicious activity. This helps protect your login page from known attackers.
Spamhaus 
* What it is used for: Checking if an IP is listed in spam/threat databases 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Website: https://www.spamhaus.org 
* Terms: https://www.spamhaus.org/legal/
AbuseIPDB 
* What it is used for: Checking IP abuse reports 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Terms of Service: https://www.abuseipdb.com/legal 
* Privacy Policy: https://www.abuseipdb.com/privacy
Project Honey Pot 
* What it is used for: Identifying harvesters, spammers, and malicious bots 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Website: https://www.projecthoneypot.org 
* Terms: https://www.projecthoneypot.org/terms_of_service_use.php
Cloudflare Radar 
* What it is used for: Checking if an IP address is associated with malware, botnets, phishing, or spam 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Terms of Service: https://www.cloudflare.com/terms/ 
* Privacy Policy: https://www.cloudflare.com/privacypolicy/
IP2Location / IP2Proxy 
* What it is used for: Detecting proxy, VPN, and Tor connections from visitor IP addresses 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Terms of Service: https://www.ip2location.com/terms 
* Privacy Policy: https://www.ip2location.com/privacy-policy

Sovaryx Login Security

A free WordPress security plugin focused on login protection, security diagnostics, and API protection.

WPFastSec

HT Security is a complete security suite for WordPress, offering multiple layers of protection for your website.
Important – External Service: 
This plugin queries the National Vulnerability Database (NVD) API to check for known CVE vulnerabilities. Requests are made to: 
* API URL: https://services.nvd.nist.gov/rest/json/cves/2.0 
* Terms of Use: https://nvd.nist.gov/general/legal-disclaimer 
* Privacy Policy: https://www.nist.gov/privacy-policy 
* Frequency: Automatic check every 12 hours or manual on-demand 
* Data sent: Name and version of WordPress/installed plugins (no personal data is sent)
The NVD API query is essential for the plugin’s CVE vulnerability detection functionality.
<h4>Key Features</h4>
<ul>
<li>Security Headers – HSTS, X-Frame-Options, Content-Security-Policy, and more</li>
<li>Login Alerts – Email notifications for successful and failed login attempts with rate limiting</li>
<li>Core Integrity Check – Verify WordPress core files against official checksums with 24h cache</li>
<li>CVE Vulnerability Detection – Check WordPress Core and active plugins against NVD database</li>
<li>User Enumeration Protection – Block user enumeration via REST API and author parameters</li>
<li>Maintenance Mode – Maintenance mode with authorized IP whitelist (IPv4, IPv6, CIDR support)</li>
<li>File Permissions Audit – Audit and automatic correction of critical file permissions</li>
<li>Plugin Security Indicators – Visual badges on plugins page showing vulnerability status</li>
</ul>
<h4>CVE Detection Features</h4>
<ul>
<li>Integration with NVD (National Vulnerability Database) API 2.0</li>
<li>Check WordPress Core and active plugins for known vulnerabilities</li>
<li>Intelligent batch processing with rate limiting</li>
<li>8 layers of anti-false-positive validation</li>
<li>Vulnerability badges on plugins page (enable/disable option)</li>
<li>Dismissible alerts per user</li>
<li>Email notification when vulnerabilities are detected</li>
<li>Automatic check every 12 hours</li>
<li>NVD API Key support (increased rate limit)</li>
</ul>
<h4>Security Improvements in v1.5.0</h4>
<ul>
<li>IP Spoofing Fix – Properly detects real IP behind Cloudflare, proxies, and load balancers</li>
<li>Capability Check Fix – Authorization verified before processing</li>
<li>Rate Limiting by IP – More granular rate limiting for login alerts</li>
<li>Input Validation – Maximum length validation for feedback form</li>
</ul>
<h3>Supported Languages</h3>
<ul>
<li>English (US) – 100%</li>
<li>English (UK) – 100%</li>
<li>Português do Brasil – 100%</li>
<li>Português de Portugal – 100%</li>
<li>Español – 100%</li>
</ul>
<h3>License</h3>
This plugin is licensed under the GNU General Public License v2.0 or later. For more information, visit https://www.gnu.org/licenses/gpl-2.0.html.

HT Security


A quality security plugin! I recommend it


Perfect Plugin Security

Complete Security Suite: Security Headers, CVE Detection, Core Integrity Check, Login Alerts, and Maintenance Mode.

Sovaryx Login Security vs HT Security