squishit

Squish Site Patrol gives your WordPress site a complete health check — security hardening, malware scanning, login protection, and page speed in a single clean dashboard.
Two-Factor Authentication (2FA) 
* TOTP-based 2FA with QR code setup (Google Authenticator, Authy, etc.) 
* Custom branded interstitial login page — replaces the default wp-login.php flow 
* Per-user 2FA enrollment with recovery options
Login Protection 
* reCAPTCHA v3 on the login page (free tier, no checkbox required) 
* Geo IP country blocking — restrict logins by country via ipapi.co 
* Magic link login — send a one-time signed login link to your admin email (Patched) 
* Failed login attempt monitoring and alerts (Patched) 
* Detects predictable “admin” username
Security Checks 
* WordPress core version check 
* Plugin update status — flags outdated plugins 
* SSL / HTTPS detection 
* File editor status check (wp-admin editor) 
* wp-config.php permissions check (Patched) 
* XML-RPC status check (Patched) 
* Debug mode detection (Patched) 
* Admin account audit — flags inactive admin accounts (Patched) 
* Database prefix check — flags default wp_ prefix (Patched) 
* Directory listing detection (Patched) 
* HTTP security headers check (Patched)
Malware Scanner 
* Verifies all 3,000+ WordPress core files against official checksums 
* Detects PHP files hidden in your uploads folder 
* Scans for dangerous file types (.exe, .sh, .bat) in uploads 
* User enumeration vulnerability check 
* Flags any modified core files 
* Real-time file change monitoring with baseline comparison (Patched)
Email Breach Detection 
* Checks admin email addresses against HaveIBeenPwned (Patched) 
* Alerts you if any admin account appears in a known breach
Audit Log 
* Tracks logins, failed login attempts, plugin installs, settings changes, and scans 
* 90-day retention with full event history 
* Filter by event type — login, scan, settings, plugin activity and more 
* Recent activity strip on the main dashboard
Page Speed & Core Web Vitals 
* Live Google PageSpeed Insights score 
* Core Web Vitals — LCP, FCP, and CLS 
* Mobile performance scoring 
* Scan any public URL 
* Inline metric explanations
Reporting 
* Weekly HTML email reports with a full scan summary (Patched) 
* Scheduled automatic daily scans (Patched) 
* Email alerts when issues are detected (Patched) 
* SSL certificate expiry alerts (Patched)
Dashboard & UX 
* Clean two-panel layout — Security on the left, Scans & hardening on the right 
* Hardening tab consolidates all Patched checks in one place 
* Issues-only toggle on both panels — hide passing checks, focus on what needs fixing 
* Rescan button with toast notification (no page reload) 
* Dark mode toggle 
* Scan spinner and auto-scan status badge 
* Score cards hidden by default until first scan runs 
* Inline metric tooltips
Performance 
* Aggressive transient caching (12–24hr TTL) across all check classes 
* Zero front-end footprint — all scans run in wp-admin only
<h4>Squish Site Patrol Patched — $15/mo</h4>
Upgrade to Patched for automatic monitoring and advanced protection:
<ul>
<li>Scheduled automatic daily scans</li>
<li>Weekly HTML email reports</li>
<li>Email alerts when issues are found</li>
<li>Magic link login — passwordless one-time login links</li>
<li>Failed login attempt monitoring</li>
<li>SSL certificate expiry alerts</li>
<li>Real-time file change monitoring with baseline comparison</li>
<li>Reset file monitoring baseline after legitimate updates</li>
<li>wp-config.php permissions check</li>
<li>XML-RPC status check</li>
<li>Debug mode detection</li>
<li>HTTP security headers check</li>
<li>Admin account audit — flags inactive admin accounts</li>
<li>Database prefix check — flags default wp_ prefix</li>
<li>Directory listing detection</li>
<li>Email breach check via HaveIBeenPwned</li>
</ul>
<h3>External Services</h3>
<h4>Google PageSpeed Insights API</h4>
Used to analyze page speed and Core Web Vitals for any URL entered by the user. Data sent: the URL being scanned. This call is only made when the user clicks “Run scan”. 
* Service: https://developers.google.com/speed/docs/insights/v5/about 
* Privacy: https://policies.google.com/privacy 
* Terms: https://developers.google.com/terms
<h4>WordPress.org Checksums API</h4>
Used to verify the integrity of WordPress core files by comparing them against official checksums. No user data is sent — only the WordPress version number and locale. 
* Service: https://api.wordpress.org/core/checksums/1.0/ 
* Privacy: https://wordpress.org/about/privacy/
<h4>ipapi.co</h4>
Used to determine the country of origin for login attempts when Geo IP country blocking is enabled. Data sent: the visitor’s IP address. This check only runs on the login page when the feature is active. 
* Service: https://ipapi.co 
* Privacy: https://ipapi.co/privacy/
<h4>HaveIBeenPwned API (Patched only)</h4>
Used to check if admin email addresses appear in known data breach databases. Requires a valid HIBP API key configured in settings. 
* Service: https://haveibeenpwned.com/API/v3 
* Privacy: https://haveibeenpwned.com/Privacy 
* Terms: https://haveibeenpwned.com/API/v3#license
<h4>Freemius</h4>
Used to manage the Patched premium subscription, licensing, and payments. Data sent upon upgrade: site URL, WordPress version, plugin version, and user email if the user opts in. 
* Service: https://freemius.com 
* Privacy: https://freemius.com/privacy/ 
* Terms: https://freemius.com/terms/

Squish Site Patrol

Complete WordPress security, malware scanning, login protection, and performance monitoring in one clean dashboard.

FreelanceBo Group S.r.l.s

FreelanceBo Sentra Control is a comprehensive WordPress security plugin that connects your site to the Sentra central console, providing enterprise-grade protection.
<h4>Features</h4>
<ul>
<li>Web Application Firewall (WAF) – Block malicious requests, SQL injection, XSS, and other common attacks</li>
<li>Malware Scanner – Scan WordPress core files, themes, and plugins for known malware signatures</li>
<li>Vulnerability Scanner – Check installed plugins and themes against known vulnerability databases</li>
<li>Brute Force Protection – Limit login attempts and block attackers automatically</li>
<li>File Integrity Monitoring – Detect unauthorized changes to WordPress core files</li>
<li>IP Blocklist – Manage blocked IPs manually or automatically based on threat detection</li>
<li>Security Events Log – Track all security events with detailed logging</li>
<li>Central Console – Manage multiple WordPress sites from a single dashboard</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Install and activate the plugin on your WordPress site</li>
<li>Connect to your Sentra central console by entering the server URL and API key in Settings</li>
<li>The plugin automatically starts monitoring your site and reporting to the console</li>
<li>View scan results, manage firewall rules, and review security events from either the WordPress admin panel or the central console</li>
</ol>
<h4>Requirements</h4>
<ul>
<li>WordPress 5.8 or higher</li>
<li>PHP 7.4 or higher</li>
<li>A Sentra central console account (available at freelancebo.it)</li>
</ul>
<h3>External Services</h3>
This plugin relies on the following external services:
<h4>FreelanceBo Sentra Control Console</h4>
This plugin connects to a self-hosted FreelanceBo Sentra Control central console for centralized security monitoring and management. This connection is essential for the plugin to function.
What data is sent: 
* Site URL, WordPress version, PHP version, and installed plugins/themes list (during heartbeat and scans) 
* Security events (firewall blocks, failed login attempts, malware detections, file integrity changes) 
* Scan results (malware scan, vulnerability scan, integrity scan findings)
When data is sent: 
* On plugin activation and periodically via heartbeat (every 5 minutes) 
* When security events occur (login attempts, firewall blocks) 
* When scans are triggered (manually or via scheduled cron) 
* When the admin manages firewall rules, blocklists, or settings
Service provider: FreelanceBo Group S.r.l.s., Bologna, Italy 
* Service URL: <a href="https://sentra.freelancebo.it" rel="nofollow ugc">https://sentra.freelancebo.it</a> 
* Terms of Service: <a href="https://sentra.freelancebo.it/terms" rel="nofollow ugc">https://sentra.freelancebo.it/terms</a> 
* Privacy Policy: <a href="https://sentra.freelancebo.it/privacy" rel="nofollow ugc">https://sentra.freelancebo.it/privacy</a>
The console server URL is configurable by the user in the plugin settings. All data is transmitted over HTTPS. Data is stored on EU-based servers in compliance with GDPR.
<h4>WordPress.org API</h4>
The vulnerability scanner module uses the official WordPress.org API to retrieve information about installed plugins, themes, and WordPress core version. This is necessary to check for known vulnerabilities and outdated software.
What data is sent: 
* Plugin slugs, theme slugs, and WordPress core version
When data is sent: 
* When a vulnerability scan is triggered (manually or via scheduled cron)
Service provider: WordPress.org 
* API endpoint: <a href="https://api.wordpress.org" rel="nofollow ugc">https://api.wordpress.org</a> 
* Terms of Service: <a href="https://wordpress.org/about/privacy/" rel="ugc">https://wordpress.org/about/privacy/</a> 
* Privacy Policy: <a href="https://wordpress.org/about/privacy/" rel="ugc">https://wordpress.org/about/privacy/</a>

FreelanceBo Sentra Control

Security agent connecting to FreelanceBo Sentra Control console for WAF, malware scanning, brute force protection, and vulnerability scanning.

Squish Site Patrol vs FreelanceBo Sentra Control