pieceagency

<p>Sovaryx Login Security strengthens your WordPress site’s login security while staying lightweight and easy to operate.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Dashboard</strong> – Security score display with quick overview of your site’s security status</li>
<li><strong>Security Headers Scan</strong> – HTTP header validation and security recommendations</li>
<li><strong>REST API Scan</strong> – Comprehensive API endpoint security verification (18 checks)</li>
<li><strong>Login Security</strong> – Multi-layer login protection including brute force protection (enabled by default), IP restrictions with trusted proxy support, XML-RPC disable option, reCAPTCHA, Email OTP authentication with IP-based rate limiting, and threat intelligence integration</li>
<li><strong>API Protection</strong> – REST API rate limiting and user enumeration prevention</li>
</ul>
<h4>Highlights</h4>
<ul>
<li>Lightweight design – Minimal impact on site performance</li>
<li>Multi-language support – English and Japanese</li>
<li>Plugin conflict detection – Automatic detection and warnings</li>
</ul>
<h4>System Requirements</h4>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.7+ / MariaDB 10.2+</li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to external services for certain features. Below is a description of each service, what data is sent, and when.</p>
<h4>Google reCAPTCHA (Optional)</h4>
<p>When you enable reCAPTCHA protection for the login page, this plugin loads Google reCAPTCHA scripts and sends verification requests.</p>
<ul>
<li><strong>Service Provider:</strong> Google LLC</li>
<li><strong>What it is used for:</strong> Protecting the login page from automated bots and brute force attacks</li>
<li><strong>Data sent:</strong> User IP address, browser information, and interaction data for bot detection</li>
<li><strong>When data is sent:</strong> When the login page is loaded and when a login form is submitted</li>
<li><strong>Terms of Service:</strong> https://policies.google.com/terms</li>
<li><strong>Privacy Policy:</strong> https://policies.google.com/privacy</li>
</ul>
<h4>Threat Intelligence Services (Optional)</h4>
<p>When threat intelligence features are enabled in Login Security settings, the plugin queries external threat databases to check visitor IP addresses for malicious activity. This helps protect your login page from known attackers.</p>
<p><strong>Spamhaus</strong><br />
* What it is used for: Checking if an IP is listed in spam/threat databases<br />
* Data sent: Visitor IP address<br />
* When data is sent: When a visitor accesses the site and threat intelligence is enabled<br />
* Website: https://www.spamhaus.org<br />
* Terms: https://www.spamhaus.org/legal/</p>
<p><strong>AbuseIPDB</strong><br />
* What it is used for: Checking IP abuse reports<br />
* Data sent: Visitor IP address<br />
* When data is sent: When a visitor accesses the site and threat intelligence is enabled<br />
* Terms of Service: https://www.abuseipdb.com/legal<br />
* Privacy Policy: https://www.abuseipdb.com/privacy</p>
<p><strong>Project Honey Pot</strong><br />
* What it is used for: Identifying harvesters, spammers, and malicious bots<br />
* Data sent: Visitor IP address<br />
* When data is sent: When a visitor accesses the site and threat intelligence is enabled<br />
* Website: https://www.projecthoneypot.org<br />
* Terms: https://www.projecthoneypot.org/terms_of_service_use.php</p>
<p><strong>Cloudflare Radar</strong><br />
* What it is used for: Checking if an IP address is associated with malware, botnets, phishing, or spam<br />
* Data sent: Visitor IP address<br />
* When data is sent: When a visitor accesses the site and threat intelligence is enabled<br />
* Terms of Service: https://www.cloudflare.com/terms/<br />
* Privacy Policy: https://www.cloudflare.com/privacypolicy/</p>
<p><strong>IP2Location / IP2Proxy</strong><br />
* What it is used for: Detecting proxy, VPN, and Tor connections from visitor IP addresses<br />
* Data sent: Visitor IP address<br />
* When data is sent: When a visitor accesses the site and threat intelligence is enabled<br />
* Terms of Service: https://www.ip2location.com/terms<br />
* Privacy Policy: https://www.ip2location.com/privacy-policy</p>


Sovaryx Login Security

A free WordPress security plugin focused on login protection, security diagnostics, and API protection.

SRWorks LLC

<p><strong>ArmorLite</strong> is a free, lightweight WordPress security plugin built for performance. Firewall with 600+ built-in patterns, brute force protection, bot detection, security headers, and login monitoring. No bloat, no unnecessary database queries, no external API calls during normal operation.</p>
<h4>Free Features</h4>
<ul>
<li><strong>Firewall</strong> — Pure PHP string-matching firewall with 600+ built-in patterns covering SQL injection, XSS, path traversal, shell access, and more. Five categories (Request URI, Query String, User Agent, Referrer, IP Address). Three matching modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggle and hit counts.</li>
<li><strong>Brute Force Protection</strong> — Session-based login tracking with automatic IP lockouts after configurable failed attempts. Login activity log with IP, location, status badges, and usernames tried. 7-day log retention.</li>
<li><strong>Bot Protection</strong> — Automated bot detection for login, registration, and password reset forms using honeypot fields, timestamp validation, and JavaScript token verification. Blocks bots before they can attempt brute force attacks.</li>
<li><strong>Security Headers</strong> — Four managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection) with dual delivery via PHP and .htaccess. Header probe system avoids duplicates.</li>
<li><strong>IP Whitelist</strong> — Whitelist trusted IPs to bypass all security checks including brute force lockouts and firewall blocking.</li>
<li><strong>Obfuscation</strong> — Author slug randomization to prevent user enumeration and email obfuscation to protect addresses from scrapers.</li>
<li><strong>Dashboard</strong> — Real-time stats, blocks over time chart, protection status cards, and WordPress dashboard widget.</li>
<li><strong>XML-RPC & REST API Protection</strong> — Disable XML-RPC and protect the REST API from user enumeration.</li>
<li><strong>Firewall Log</strong> — View blocked requests with IP, matched rule, request URI, and timestamps. 7-day log retention.</li>
<li><strong>Tools</strong> — Health checks with database integrity verification, one-click table repair, and debug mode.</li>
</ul>
<h4>Upgrade to ArmorPro</h4>
<p>Need more protection? <a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">ArmorPro</a> adds:</p>
<ul>
<li>WAF Engine (blocks attacks before WordPress loads)</li>
<li>Two-Factor Authentication (TOTP) with backup codes</li>
<li>Passkey Authentication (Face ID, Touch ID, Windows Hello)</li>
<li>Custom Login URL (hide wp-login.php)</li>
<li>IP Blacklist with auto-blacklist for repeat offenders</li>
<li>Country Blocking with GeoIP</li>
<li>HSTS, Content-Security-Policy, and Permissions-Policy headers</li>
<li>Email Notifications and digest summaries</li>
<li>Extended log retention (90 days)</li>
<li>Custom firewall patterns</li>
<li>Export/import settings</li>
</ul>
<p><a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">Learn more about ArmorPro</a></p>
<h3>External Services</h3>
<p>This plugin connects to external third-party services in the following situations:</p>
<h4>Anonymous Usage Data (Optional)</h4>
<p>This plugin can optionally share anonymous usage data to help improve ArmorLite. This is disabled by default and requires explicit opt-in from the Settings page.</p>
<ul>
<li>When it is called: Daily heartbeat (if opted in)</li>
<li>Data sent: WordPress version, PHP version, active plugin features (no personal data)</li>
<li>Service: https://api.srworks.co</li>
<li>Privacy: https://srworks.co/privacy</li>
</ul>
<p>No personal data is collected or stored by this service.</p>
<h3>Privacy Policy</h3>
<p>ArmorLite stores the following data locally in your WordPress database:</p>
<ul>
<li>IP addresses of visitors who trigger security rules or attempt to log in</li>
<li>Timestamps of security events</li>
<li>Usernames used in login attempts</li>
</ul>
<p>This data is stored to help you monitor and protect your website. You can clear all logs at any time from the Tools tab. When the plugin is uninstalled, all data is automatically deleted.</p>
<p>No visitor data is sent to external services during normal operation. Anonymous usage data sharing is optional and disabled by default.</p>
<h3>Support</h3>
<p>Need help with ArmorLite? Have a feature request or found a bug?</p>
<p>Visit our support page: https://srworks.co/contact</p>
<h3>Credits</h3>
<p>Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com). Used under GPLv2.</p>
<p>Charts powered by Chart.js (https://www.chartjs.org), MIT License.</p>
<p>Tooltips powered by Tippy.js (https://atomiks.github.io/tippyjs), MIT License.</p>


SRWorks ArmorPro Lite

Free WordPress security with firewall, brute force protection, bot detection, security headers, IP whitelist, and login monitoring. No bloat.

Sovaryx Login Security vs SRWorks ArmorPro Lite