SRWorks LLC

<p><strong>ArmorLite</strong> is a free, lightweight WordPress security plugin built for performance. Firewall with 600+ built-in patterns, brute force protection, bot detection, security headers, and login monitoring. No bloat, no unnecessary database queries, no external API calls during normal operation.</p>
<h4>Free Features</h4>
<ul>
<li><strong>Firewall</strong> — Pure PHP string-matching firewall with 600+ built-in patterns covering SQL injection, XSS, path traversal, shell access, and more. Five categories (Request URI, Query String, User Agent, Referrer, IP Address). Three matching modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggle and hit counts.</li>
<li><strong>Brute Force Protection</strong> — Session-based login tracking with automatic IP lockouts after configurable failed attempts. Login activity log with IP, location, status badges, and usernames tried. 7-day log retention.</li>
<li><strong>Bot Protection</strong> — Automated bot detection for login, registration, and password reset forms using honeypot fields, timestamp validation, and JavaScript token verification. Blocks bots before they can attempt brute force attacks.</li>
<li><strong>Security Headers</strong> — Four managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection) with dual delivery via PHP and .htaccess. Header probe system avoids duplicates.</li>
<li><strong>IP Whitelist</strong> — Whitelist trusted IPs to bypass all security checks including brute force lockouts and firewall blocking.</li>
<li><strong>Obfuscation</strong> — Author slug randomization to prevent user enumeration and email obfuscation to protect addresses from scrapers.</li>
<li><strong>Dashboard</strong> — Real-time stats, blocks over time chart, protection status cards, and WordPress dashboard widget.</li>
<li><strong>XML-RPC & REST API Protection</strong> — Disable XML-RPC and protect the REST API from user enumeration.</li>
<li><strong>Firewall Log</strong> — View blocked requests with IP, matched rule, request URI, and timestamps. 7-day log retention.</li>
<li><strong>Tools</strong> — Health checks with database integrity verification, one-click table repair, and debug mode.</li>
</ul>
<h4>Upgrade to ArmorPro</h4>
<p>Need more protection? <a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">ArmorPro</a> adds:</p>
<ul>
<li>WAF Engine (blocks attacks before WordPress loads)</li>
<li>Two-Factor Authentication (TOTP) with backup codes</li>
<li>Passkey Authentication (Face ID, Touch ID, Windows Hello)</li>
<li>Custom Login URL (hide wp-login.php)</li>
<li>IP Blacklist with auto-blacklist for repeat offenders</li>
<li>Country Blocking with GeoIP</li>
<li>HSTS, Content-Security-Policy, and Permissions-Policy headers</li>
<li>Email Notifications and digest summaries</li>
<li>Extended log retention (90 days)</li>
<li>Custom firewall patterns</li>
<li>Export/import settings</li>
</ul>
<p><a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">Learn more about ArmorPro</a></p>
<h3>External Services</h3>
<p>This plugin connects to external third-party services in the following situations:</p>
<h4>Anonymous Usage Data (Optional)</h4>
<p>This plugin can optionally share anonymous usage data to help improve ArmorLite. This is disabled by default and requires explicit opt-in from the Settings page.</p>
<ul>
<li>When it is called: Daily heartbeat (if opted in)</li>
<li>Data sent: WordPress version, PHP version, active plugin features (no personal data)</li>
<li>Service: https://api.srworks.co</li>
<li>Privacy: https://srworks.co/privacy</li>
</ul>
<p>No personal data is collected or stored by this service.</p>
<h3>Privacy Policy</h3>
<p>ArmorLite stores the following data locally in your WordPress database:</p>
<ul>
<li>IP addresses of visitors who trigger security rules or attempt to log in</li>
<li>Timestamps of security events</li>
<li>Usernames used in login attempts</li>
</ul>
<p>This data is stored to help you monitor and protect your website. You can clear all logs at any time from the Tools tab. When the plugin is uninstalled, all data is automatically deleted.</p>
<p>No visitor data is sent to external services during normal operation. Anonymous usage data sharing is optional and disabled by default.</p>
<h3>Support</h3>
<p>Need help with ArmorLite? Have a feature request or found a bug?</p>
<p>Visit our support page: https://srworks.co/contact</p>
<h3>Credits</h3>
<p>Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com). Used under GPLv2.</p>
<p>Charts powered by Chart.js (https://www.chartjs.org), MIT License.</p>
<p>Tooltips powered by Tippy.js (https://atomiks.github.io/tippyjs), MIT License.</p>


SRWorks ArmorPro Lite

Free WordPress security with firewall, brute force protection, bot detection, security headers, IP whitelist, and login monitoring. No bloat.

Nazmul Hasan Robin

<p>Keep your WordPress site safe with minimal effort. NHR Secure helps you:</p>
<ul>
<li>Hide or protect your admin area from unauthorized access.</li>
<li>Limit login attempts to prevent brute-force attacks.</li>
<li>Hide debug logs to prevent sensitive information disclosure.</li>
<li>Add 2FA to your WordPress site.</li>
<li>Scan core files, plugins, and themes for known vulnerabilities.</li>
<li>Monitor site health with one-click security recommendations.</li>
<li>Protect against SQL injection, XSS, and LFI attacks.</li>
<li>Block malicious IPs and entire countries.</li>
</ul>
<h3><strong>Features at a glance:</strong></h3>
<h3>🔒 Limit Login Attempts</h3>
<p>Stop brute-force attacks by temporarily blocking IPs after repeated failed login attempts.<br />
– Configurable attempt limit (1-20, default: 5)<br />
– Blocks based on IP + Username combination<br />
– Auto-unblock after 2 hours</p>
<h3>🔐 Custom Login Page</h3>
<p>Hide wp-login.php and use a custom login URL.<br />
– Default custom URL: <code>/hidden-access-52w</code><br />
– Blocks direct access to wp-login.php and wp-admin for guests</p>
<h3>🛡️ Protect Debug Log File</h3>
<p>Blocks direct access to <code>/wp-content/debug.log</code><br />
– Returns 403 Forbidden for all users</p>
<h3>⚙️ Modern Settings Page</h3>
<p>Configure everything from a beautiful React-powered interface.<br />
– Located under <strong>Tools <span aria-hidden="true" class="wp-exclude-emoji">→</span> NHR Secure</strong><br />
– <strong>Dark Mode</strong> support for comfortable viewing<br />
– Enable/disable each feature</p>
<h3>🔐 Two-Factor Authentication (2FA)</h3>
<p>Enable two-factor authentication for users.<br />
– Support for <strong>Authenticator Apps</strong> and <strong>Email OTP</strong><br />
– <strong>Enforce 2FA</strong> for specific user roles (e.g., Administrators)<br />
– <strong>Recovery Codes</strong> for emergency access<br />
– QR code setup for Authenticator Apps</p>
<h3>🛡️ Vulnerability Checker</h3>
<p>Automatically scan your installed plugins, themes, and WordPress core against a known vulnerability database.<br />
– Daily automatic scans<br />
– Alerts for critical security issues<br />
– Check file integrity</p>
<h3>🖥️ User Session Management</h3>
<p>Monitor and control active user sessions to prevent unauthorized access.<br />
– <strong>View Active Sessions:</strong> See IP, location, device, and login time for all logged-in users.<br />
– <strong>Remote Logout:</strong> Instantly log out suspicious sessions or all other devices.<br />
– <strong>Idle Timeout:</strong> Automatically log out inactive users after a set period.</p>
<h3>🧱 Hardening & Firewall</h3>
<p>Essential security hardening to lock down your WordPress site.<br />
– <strong>Disable XML-RPC:</strong> Prevent remote attacks and brute-force attempts.<br />
– <strong>Disable File Editor:</strong> Stop file modifications from the dashboard.<br />
– <strong>Hide WP Version:</strong> Obscure your WordPress version from attackers.<br />
– <strong>Block User-Agents:</strong> Prevent bad bots and scrapers from accessing your site.<br />
– <strong>Disable User Enumeration:</strong> Stop attackers from harvesting usernames via REST API.</p>
<h3>📝 Activity Audit Log</h3>
<p>Keep a record of important security events on your site.<br />
– Tracks logins, failed attempts, file changes, and settings updates.<br />
– View user, IP, and event details.<br />
– Configurable log retention policy.</p>
<h3>🏥 Security Health Check & One-Click Secure</h3>
<p>Get an instant overview of your site’s security posture.<br />
– <strong>Security Score:</strong> View your overall protection percentage and grade (A+ to F).<br />
– <strong>Health Dashboard:</strong> See which security features are active and which need attention.<br />
– <strong>One-Click Secure:</strong> Apply recommended security settings instantly.<br />
– <strong>11 Security Checks:</strong> Comprehensive analysis of your security status.</p>
<h3>🛡️ Advanced Firewall (IPS)</h3>
<p>Proactive intrusion prevention system that blocks malicious requests in real-time.<br />
– <strong>SQL Injection Protection:</strong> Detect and block SQLi attacks automatically.<br />
– <strong>XSS Prevention:</strong> Stop cross-site scripting attempts.<br />
– <strong>LFI Protection:</strong> Prevent local file inclusion attacks.<br />
– <strong>Pattern Matching:</strong> Advanced regex-based detection for common attack vectors.<br />
– <strong>Automatic Blocking:</strong> Suspicious requests are blocked before they reach WordPress.</p>
<h3>🌍 IP & Country Management</h3>
<p>Control access to your site with granular IP and geographic filtering.<br />
– <strong>IP Whitelist:</strong> Allow trusted IPs to bypass all security filters.<br />
– <strong>IP Blacklist:</strong> Block malicious IPs permanently from your site.<br />
– <strong>CIDR Support:</strong> Use CIDR notation for blocking entire IP ranges (e.g., 192.168.1.0/24).<br />
– <strong>Country Blocking:</strong> Block access from 90+ countries using GeoIP lookup.<br />
– <strong>Smart Caching:</strong> GeoIP lookups are cached for 24 hours for optimal performance.<br />
– <strong>Private IP Detection:</strong> Automatically skip local/private IPs.</p>
<h3>⚡ Lightweight & Minimal</h3>
<p>Designed to deliver maximum security with minimal code. No bloat, no complexity.<br />
– Compatible with most WordPress themes and plugins.</p>
<h3>External Services</h3>
<p>This plugin utilizes the <a href="https://wpvulnerability.com/" rel="nofollow ugc">WPVulnerability</a> API to check for vulnerabilities.<br />
– <strong>Service:</strong> WPVulnerability<br />
– <strong>Data:</strong> Only plugin slugs and versions are sent. No personal data is collected.</p>


NHR Secure – Login Security, Firewall, 2FA & Audit Log

A lightweight WordPress security plugin to protect your admin area with a custom login URL, hide debug logs, limit login attempts, and add 2FA.

SRWorks ArmorPro Lite vs NHR Secure – Login Security, Firewall, 2FA & Audit Log