SRWorks LLC

ArmorLite is a free, lightweight WordPress security plugin built for performance. Firewall with 600+ built-in patterns, brute force protection, bot detection, security headers, and login monitoring. No bloat, no unnecessary database queries, no external API calls during normal operation.
<h4>Free Features</h4>
<ul>
<li>Firewall — Pure PHP string-matching firewall with 600+ built-in patterns covering SQL injection, XSS, path traversal, shell access, and more. Five categories (Request URI, Query String, User Agent, Referrer, IP Address). Three matching modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggle and hit counts.</li>
<li>Brute Force Protection — Session-based login tracking with automatic IP lockouts after configurable failed attempts. Login activity log with IP, location, status badges, and usernames tried. 7-day log retention.</li>
<li>Bot Protection — Automated bot detection for login, registration, and password reset forms using honeypot fields, timestamp validation, and JavaScript token verification. Blocks bots before they can attempt brute force attacks.</li>
<li>Security Headers — Four managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection) with dual delivery via PHP and .htaccess. Header probe system avoids duplicates.</li>
<li>IP Whitelist — Whitelist trusted IPs to bypass all security checks including brute force lockouts and firewall blocking.</li>
<li>Obfuscation — Author slug randomization to prevent user enumeration and email obfuscation to protect addresses from scrapers.</li>
<li>Dashboard — Real-time stats, blocks over time chart, protection status cards, and WordPress dashboard widget.</li>
<li>XML-RPC & REST API Protection — Disable XML-RPC and protect the REST API from user enumeration.</li>
<li>Firewall Log — View blocked requests with IP, matched rule, request URI, and timestamps. 7-day log retention.</li>
<li>Tools — Health checks with database integrity verification, one-click table repair, and debug mode.</li>
</ul>
<h4>Upgrade to ArmorPro</h4>
Need more protection? <a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">ArmorPro</a> adds:
<ul>
<li>WAF Engine (blocks attacks before WordPress loads)</li>
<li>Two-Factor Authentication (TOTP) with backup codes</li>
<li>Passkey Authentication (Face ID, Touch ID, Windows Hello)</li>
<li>Custom Login URL (hide wp-login.php)</li>
<li>IP Blacklist with auto-blacklist for repeat offenders</li>
<li>Country Blocking with GeoIP</li>
<li>HSTS, Content-Security-Policy, and Permissions-Policy headers</li>
<li>Email Notifications and digest summaries</li>
<li>Extended log retention (90 days)</li>
<li>Custom firewall patterns</li>
<li>Export/import settings</li>
</ul>
<a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">Learn more about ArmorPro</a>
<h3>External Services</h3>
This plugin connects to external third-party services in the following situations:
<h4>Anonymous Usage Data (Optional)</h4>
This plugin can optionally share anonymous usage data to help improve ArmorLite. This is disabled by default and requires explicit opt-in from the Settings page.
<ul>
<li>When it is called: Daily heartbeat (if opted in)</li>
<li>Data sent: WordPress version, PHP version, active plugin features (no personal data)</li>
<li>Service: https://api.srworks.co</li>
<li>Privacy: https://srworks.co/privacy</li>
</ul>
No personal data is collected or stored by this service.
<h3>Privacy Policy</h3>
ArmorLite stores the following data locally in your WordPress database:
<ul>
<li>IP addresses of visitors who trigger security rules or attempt to log in</li>
<li>Timestamps of security events</li>
<li>Usernames used in login attempts</li>
</ul>
This data is stored to help you monitor and protect your website. You can clear all logs at any time from the Tools tab. When the plugin is uninstalled, all data is automatically deleted.
No visitor data is sent to external services during normal operation. Anonymous usage data sharing is optional and disabled by default.
<h3>Support</h3>
Need help with ArmorLite? Have a feature request or found a bug?
Visit our support page: https://srworks.co/contact
<h3>Credits</h3>
Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com). Used under GPLv2.
Charts powered by Chart.js (https://www.chartjs.org), MIT License.
Tooltips powered by Tippy.js (https://atomiks.github.io/tippyjs), MIT License.

SRWorks ArmorPro Lite

Free WordPress security with firewall, brute force protection, bot detection, security headers, IP whitelist, and login monitoring. No bloat.

Yoyal Limbu

BruteFort is your WordPress site’s complete login security solution focused on four core protections: Rate Limit, Custom Login URL, Geo Blocking, and IP Restriction.
Protect against brute force attacks, hide your login page with a custom URL, block countries with geo rules, and control access using IP whitelists/blacklists – all in one lightweight, performance-optimized plugin.
Whether you’re running a blog, a WooCommerce store, or a membership site, BruteFort keeps bots, hackers, and unauthorized users out while maintaining fast page speeds.
<h4>🔐 Core Security Features</h4>
🛡️ Rate Limit & Brute Force Protection 
– Limit repeated login attempts per IP 
– Configure attempt windows and lockout duration 
– Apply progressive lockouts for repeated abuse 
– Reduce automated credential stuffing and bot attacks
🔗 Custom Login URL (Hide wp-login.php) 
– Replace the default <code>/wp-login.php</code> endpoint with your custom slug 
– Return 404 for direct <code>wp-login.php</code> requests 
– Reduce scanner and bot traffic on known login endpoints 
– Keep login access private for authorized users
🌐 Geo Blocking (Country-Based Restrictions) 
– Block or allow login attempts by country 
– Blacklist mode: Block specific countries from accessing wp-login.php 
– Whitelist mode: Only allow login from selected countries 
– IP geolocation detection (Cloudflare compatible) 
– Perfect for region-specific sites or blocking high-risk countries
📍 IP Restriction (Whitelist & Blacklist) 
– Enforce custom IP allow/deny rules for login protection 
– Add individual IPs or CIDR ranges 
– Instantly block suspicious IPs 
– Whitelist your own IP to prevent lockouts 
– Bulk IP management with easy interface
📊 Real-Time Monitoring & Logs 
– View failed login attempts in real-time 
– Track IP addresses, usernames, and timestamps 
– Filter logs by status, date, or IP 
– Manual unlock for accidentally locked users 
– Export logs for security audits
⚡ Performance & Compatibility 
– Lightweight and performance-optimized 
– Works with Cloudflare, proxy servers, and CDNs 
– Compatible with most security plugins 
– Dark mode UI support 
– No impact on page load speeds
<h4>🎯 Perfect For</h4>
<ul>
<li>WooCommerce stores protecting customer data and preventing unauthorized access</li>
<li>Membership sites restricting access by geographic location</li>
<li>Corporate websites blocking countries where business doesn’t operate</li>
<li>Blog owners hiding login page from automated bots and scanners</li>
<li>Agencies managing multiple client sites with different security requirements</li>
<li>High-traffic sites experiencing frequent brute force attacks</li>
<li>International sites wanting region-specific login restrictions</li>
</ul>
<h4>🚀 Why Choose BruteFort?</h4>
<ul>
<li>Core protection stack: Rate Limit + Custom Login URL + Geo Blocking + IP Restriction</li>
<li>Easy to use: Simple, intuitive interface with no complex configuration</li>
<li>Performance-focused: Minimal resource usage, no site slowdown</li>
<li>SEO-friendly: Properly handles redirects and 404s</li>
<li>Privacy-conscious: No external API calls for basic features (optional geo API)</li>
<li>Regular updates: Actively maintained with new features added regularly</li>
</ul>

BruteFort – Rate Limit, Custom Login URL, Geo Blocking & IP Restriction

BruteFort - Rate Limit, Custom Login URL, Geo Blocking & IP Restriction for complete WordPress login security.

SRWorks ArmorPro Lite vs BruteFort – Rate Limit, Custom Login URL, Geo Blocking & IP Restriction