SRWorks LLC

ArmorLite is a free, lightweight WordPress security plugin built for performance. Firewall with 600+ built-in patterns, brute force protection, bot detection, security headers, and login monitoring. No bloat, no unnecessary database queries, no external API calls during normal operation.
<h4>Free Features</h4>
<ul>
<li>Firewall — Pure PHP string-matching firewall with 600+ built-in patterns covering SQL injection, XSS, path traversal, shell access, and more. Five categories (Request URI, Query String, User Agent, Referrer, IP Address). Three matching modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggle and hit counts.</li>
<li>Brute Force Protection — Session-based login tracking with automatic IP lockouts after configurable failed attempts. Login activity log with IP, location, status badges, and usernames tried. 7-day log retention.</li>
<li>Bot Protection — Automated bot detection for login, registration, and password reset forms using honeypot fields, timestamp validation, and JavaScript token verification. Blocks bots before they can attempt brute force attacks.</li>
<li>Security Headers — Four managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection) with dual delivery via PHP and .htaccess. Header probe system avoids duplicates.</li>
<li>IP Whitelist — Whitelist trusted IPs to bypass all security checks including brute force lockouts and firewall blocking.</li>
<li>Obfuscation — Author slug randomization to prevent user enumeration and email obfuscation to protect addresses from scrapers.</li>
<li>Dashboard — Real-time stats, blocks over time chart, protection status cards, and WordPress dashboard widget.</li>
<li>XML-RPC & REST API Protection — Disable XML-RPC and protect the REST API from user enumeration.</li>
<li>Firewall Log — View blocked requests with IP, matched rule, request URI, and timestamps. 7-day log retention.</li>
<li>Tools — Health checks with database integrity verification, one-click table repair, and debug mode.</li>
</ul>
<h4>Upgrade to ArmorPro</h4>
Need more protection? <a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">ArmorPro</a> adds:
<ul>
<li>WAF Engine (blocks attacks before WordPress loads)</li>
<li>Two-Factor Authentication (TOTP) with backup codes</li>
<li>Passkey Authentication (Face ID, Touch ID, Windows Hello)</li>
<li>Custom Login URL (hide wp-login.php)</li>
<li>IP Blacklist with auto-blacklist for repeat offenders</li>
<li>Country Blocking with GeoIP</li>
<li>HSTS, Content-Security-Policy, and Permissions-Policy headers</li>
<li>Email Notifications and digest summaries</li>
<li>Extended log retention (90 days)</li>
<li>Custom firewall patterns</li>
<li>Export/import settings</li>
</ul>
<a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">Learn more about ArmorPro</a>
<h3>External Services</h3>
This plugin connects to external third-party services in the following situations:
<h4>Anonymous Usage Data (Optional)</h4>
This plugin can optionally share anonymous usage data to help improve ArmorLite. This is disabled by default and requires explicit opt-in from the Settings page.
<ul>
<li>When it is called: Daily heartbeat (if opted in)</li>
<li>Data sent: WordPress version, PHP version, active plugin features (no personal data)</li>
<li>Service: https://api.srworks.co</li>
<li>Privacy: https://srworks.co/privacy</li>
</ul>
No personal data is collected or stored by this service.
<h3>Privacy Policy</h3>
ArmorLite stores the following data locally in your WordPress database:
<ul>
<li>IP addresses of visitors who trigger security rules or attempt to log in</li>
<li>Timestamps of security events</li>
<li>Usernames used in login attempts</li>
</ul>
This data is stored to help you monitor and protect your website. You can clear all logs at any time from the Tools tab. When the plugin is uninstalled, all data is automatically deleted.
No visitor data is sent to external services during normal operation. Anonymous usage data sharing is optional and disabled by default.
<h3>Support</h3>
Need help with ArmorLite? Have a feature request or found a bug?
Visit our support page: https://srworks.co/contact
<h3>Credits</h3>
Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com). Used under GPLv2.
Charts powered by Chart.js (https://www.chartjs.org), MIT License.
Tooltips powered by Tippy.js (https://atomiks.github.io/tippyjs), MIT License.

SRWorks ArmorPro Lite

Free WordPress security with firewall, brute force protection, bot detection, security headers, IP whitelist, and login monitoring. No bloat.

Huzoor Bux

RedSecLabs

Safeguard your WordPress website from evolving malware, brute force attacks, hidden backdoors, and zero-day vulnerabilities.
<h3>Guardian Gaze Security – Malware Scanner, AI Backdoor Detection & Login Protection</h3>
Guardian Gaze is a research-driven WordPress security plugin designed to help website owners, developers, and agencies protect their sites from malware infections, AI-detected backdoors, brute-force attacks, unauthorized file changes, and emerging WordPress vulnerabilities.
Built by <a href="https://www.redseclabs.com" rel="nofollow ugc">RedSecLabs</a>, a cybersecurity firm specializing in threat research and detection engineering, Guardian Gaze focuses on: 
• Continuous WordPress security monitoring 
• AI/LLM-assisted malware and backdoor detection 
• Login protection and brute force prevention 
• IP management and traffic filtering 
• WordPress security hardening 
• Clear visibility into your site’s security posture 
Detection logic is supported by ongoing threat intelligence updates, ensuring protection adapts to new and evolving attack techniques. 
Guardian Gaze delivers practical website security for WordPress without aggressive lockouts, excessive alerts, or heavy resource usage.
<h3>Key Features</h3>
WordPress Malware Detection & <a href="https://www.guardiangaze.com/wp/documentation/ai-based-scanner" rel="nofollow ugc">AI-Based Backdoor Scan</a> 
Guardian Gaze includes a built-in <a href="https://www.guardiangaze.com/wp/documentation/malware-scan" rel="nofollow ugc">WordPress malware scanner</a> that analyzes WordPress core files, plugins, and themes for suspicious or unauthorized changes. 
• Detects modified or infected files 
• Identifies malware injections, malicious code, and hidden backdoors 
• AI/LLM-assisted backdoor scanning to detect suspicious code patterns 
• Highlights changes in WordPress core, plugin, or theme integrity 
• Designed for continuous monitoring — not one-time scans 
• Helps users review findings before taking action 
This approach combines traditional detection techniques with AI-assisted analysis for improved backdoor detection and malware discovery in WordPress.
<a href="https://www.guardiangaze.com/wp/documentation/ip-management" rel="nofollow ugc">IP Management & Traffic Filtering</a> 
Manage and reduce unwanted or abusive traffic. 
• Block or allow IP addresses manually 
• Automatically flag suspicious IP behavior 
• Reduce bot noise, vulnerability scanners, and automated attacks 
Ideal for sites experiencing repeated probing or targeted WordPress attacks.
<a href="https://www.guardiangaze.com/wp/documentation" rel="nofollow ugc">Central Security Dashboard</a> 
View real-time WordPress security events and activity: 
• Latest malware scan results 
• Login attempts and security logs 
• Blocked and flagged IP addresses 
• Alerts, notifications, and system status 
Built for both beginners and developers managing multiple WordPress sites.
<a href="https://www.guardiangaze.com/wp/documentation/scheduled-scanning" rel="nofollow ugc">Scheduled Scanning</a> 
Automate malware scans and stay ahead of threats. 
• Weekly, daily, or hourly scan schedules 
• Configure scan recipients and frequency 
• Receive scan results via email 
• Monitor your site’s security regularly
<a href="https://www.guardiangaze.com/wp/documentation/file-integrity" rel="nofollow ugc">File Integrity Monitoring</a> 
Monitor and alert on unauthorized file changes. 
• Detects modified or infected files 
• Highlights changes in WordPress core, plugin, or theme integrity 
• Helps users understand findings before taking action
Continuous Threat Intelligence Updates 
Guardian Gaze receives updated detection logic, indicators, and malware patterns through the Guardian Gaze Security Intelligence API. 
These updates help: 
• Improve malware detection accuracy 
• Adapt to new WordPress security threats 
• Maintain performance and stability
Privacy & Data Use 
Guardian Gaze uses external services only for security functionality such as license validation, threat intelligence updates, optional reporting, and IP geolocation (if enabled). 
• No unnecessary data collection 
• No passwords or sensitive content transmitted 
• Secure WordPress-native API communication 
• Optional features can be disabled 
• Only security metadata required for functionality is processed 
Guardian Gaze follows a privacy-first design.
<h3>External Services Used</h3>
Guardian Gaze connects to the following services to provide security features and functionality:
<h4>1. Guardian Gaze API – wp-api.guardiangaze.com</h4>
Used for license validation, malware pattern updates, threat intelligence updates, and optional email reporting. 
Data Sent: 
• Admin email 
• Site URL 
• API key 
• Plugin version and definitions version 
• IP addresses (for global blocking features) 
• Scan report data (if email reporting is enabled) 
Terms of Service: https://www.guardiangaze.com/terms-of-service/ 
Privacy Policy: https://www.guardiangaze.com/privacy-policy/
<h4>2. Guardian Gaze API – www.guardiangaze.com</h4>
Used for plugin registration. 
Data Sent: 
• Site URL 
Terms of Service: https://www.guardiangaze.com/terms-of-service/ 
Privacy Policy: https://www.guardiangaze.com/privacy-policy/
<h4>3. WordPress.org API – api.wordpress.org</h4>
Used for WordPress core file integrity checks and version validation. 
Data Sent: 
• WordPress version 
• Locale / language 
Terms of Service: https://wordpress.org/about/privacy/ 
Privacy Policy: https://wordpress.org/about/privacy/
<h4>4. Guardian Gaze Country API – wp-api.guardiangaze.com/country.php</h4>
Used for IP address geolocation. 
Data Sent: 
• Visitor IP address 
Terms of Service: https://www.guardiangaze.com/terms-of-service/ 
Privacy Policy: https://www.guardiangaze.com/privacy-policy/
Important Notes 
• All API calls use WordPress wp_remote_get() and wp_remote_post() 
• Data is transferred over HTTPS whenever available 
• No user passwords or sensitive content is collected or transmitted 
• Geolocation lookups are cached to limit external requests
<h3>About RedSecLabs</h3>
<a href="https://www.redseclabs.com" rel="nofollow ugc">RedSecLabs</a> is a cybersecurity company focused on threat research, detection engineering, and building defensive tools for real-world scenarios. 
Guardian Gaze reflects this philosophy by offering a transparent, research-backed WordPress security plugin with AI-assisted backdoor detection, built for long-term reliability and practical protection.

Guardian Gaze Security – AI Based Malware Scanner, Firewall and Login Protection

Safeguard your WordPress website from evolving malware, brute force attacks, hidden backdoors, and zero-day vulnerabilities.

SRWorks ArmorPro Lite vs Guardian Gaze Security – AI Based Malware Scanner, Firewall and Login Protection