Pranshtech Solutions Private Limited

<p>TotalWeb offers a multi-layered approach to WordPress security, combining advanced protection mechanisms with an intuitive administrative interface. From real-time monitoring to proactive threat detection and prevention, TotalWeb empowers website administrators to maintain a secure online presence.</p>
<h3>Features</h3>
<h3>1. Login Security</h3>
<ul>
<li><strong>Login Attempt Tracking:</strong> Monitors and logs all login attempts, both successful and failed, including IP addresses and usernames.</li>
<li><strong>Two-Factor Authentication (2FA):</strong> Enhances login security using TOTP-based 2FA with WooCommerce support.</li>
<li><strong>IP and User Lockouts:</strong> Automatically locks IP addresses and users after a configurable number of failed login attempts.</li>
<li><strong>Login Log Management:</strong> View, filter, bulk delete, and export login attempt logs to CSV.</li>
</ul>
<h3>2. CAPTCHA Integration</h3>
<ul>
<li><strong>Multi-form CAPTCHA Protection:</strong> Adds CAPTCHA to:
<ul>
<li>Login Form  </li>
<li>Registration Form  </li>
<li>Lost Password Form  </li>
<li>Reset Password Form  </li>
<li>Comment Form  </li>
<li>WooCommerce Forms  </li>
</ul>
</li>
<li><strong>Supported CAPTCHA Types:</strong> reCAPTCHA v2, reCAPTCHA v3, hCaptcha, and Math CAPTCHA.</li>
<li><strong>Contact Form 7 Integration:</strong> Seamlessly injects CAPTCHA into CF7 forms.</li>
</ul>
<h3>3. File and Database Security</h3>
<ul>
<li><strong>Comprehensive File Scanning:</strong> Scans core files, plugins, and themes for modifications, new files, and deletions.</li>
<li><strong>Scheduled & On-Demand Scans:</strong> Run daily scheduled scans or manual scans anytime.</li>
<li><strong>Customizable Monitoring:</strong> Configure file types, exclusions, and email alerts.</li>
<li><strong>REST API Integration:</strong> Initiate scans and check status programmatically.</li>
<li><strong>MD5 Hash Verification:</strong> Detects unauthorized file changes.</li>
<li><strong>Database Backup & Restore:</strong> Perform manual or automated backups and restore previous versions.</li>
<li><strong>Database Prefix Change:</strong> Enhances security by changing the WP database prefix.</li>
<li><strong>SQL Injection Protection:</strong> Blocks suspicious queries and monitors DB activity.</li>
<li><strong>Query Monitoring:</strong> Detects and blocks suspicious SQL patterns.</li>
<li><strong>WordPress Hardening:</strong> Disable insecure WP features such as:
<ul>
<li>File Editor  </li>
<li>Unfiltered HTML (non-admins)  </li>
<li>XML-RPC  </li>
<li>Force SSL  </li>
<li>Hide WP version  </li>
<li>Block PHP execution in uploads  </li>
<li>Block dangerous file types  </li>
<li>Protect sensitive files (e.g., wp-config.php, .htaccess)</li>
</ul>
</li>
<li><strong>REST API Controls:</strong> Manage security settings and logs via API.</li>
</ul>
<h3>4. Malware Scanner</h3>
<ul>
<li><strong>Malicious Code Detection:</strong> Scans core, themes, plugins, and uploads for malware signatures.</li>
<li><strong>Manual & Scheduled Scans:</strong> Flexible scanning options.</li>
<li><strong>Issue Tracking:</strong> Detects modified, missing, unknown, and infected files.</li>
<li><strong>Email Reports:</strong> Sends alerts when malware is detected.</li>
</ul>
<h3>5. Firewall</h3>
<ul>
<li><strong>Web Application Firewall (WAF):</strong> Supports custom regex rules and ModSecurity CRS patterns.</li>
<li><strong>IP Blacklist/Whitelist:</strong> Block malicious IPs or allow trusted ones.</li>
<li><strong>Geo-Blocking:</strong> Restrict access by country.</li>
<li><strong>Rate Limiting & DDoS Protection:</strong> Limits requests per IP.</li>
<li><strong>Comment Spam IP Monitoring:</strong> Auto-blocks frequent spam IPs.</li>
<li><strong>Bad Bot Protection:</strong> Blocks known scrapers and bots.</li>
<li><strong>Smart 404 Blocking:</strong> Blocks IPs generating excessive 404 errors.</li>
<li><strong>General Firewall Options:</strong>
<ul>
<li>Disable RSS/ATOM feeds  </li>
<li>Block proxy comment submissions  </li>
<li>Advanced string filtering  </li>
<li>Enable 6G Firewall rules  </li>
<li>Block unauthorized REST requests  </li>
<li>Block blank user-agent or referrer POST requests  </li>
</ul>
</li>
</ul>
<h3>6. Redirects</h3>
<ul>
<li><strong>Custom 301 Redirects:</strong> Manage permanent redirect rules.</li>
<li><strong>Admin Interface:</strong> Add, edit, and delete redirects easily.</li>
<li><strong>URL Validation:</strong> Prevents duplicates and formatting issues.</li>
</ul>
<h3>7. Security Hardening</h3>
<ul>
<li><strong>HTTP Security Headers:</strong> Configure:
<ul>
<li>HSTS  </li>
<li>X-Frame-Options  </li>
<li>Content Security Policy (CSP)  </li>
<li>Referrer-Policy  </li>
</ul>
</li>
<li><strong>Role-Based Access Restrictions:</strong> Limit access to specific plugin features.</li>
<li><strong>One-Click Setup Wizard:</strong> Apply recommended hardening automatically.</li>
</ul>
<h3>8. Audit Logging</h3>
<ul>
<li><strong>Logs:</strong>
<ul>
<li>Logins (success/failure)</li>
<li>User profile changes</li>
<li>Role/capability changes</li>
<li>Plugin/theme activation/deactivation/updates</li>
<li>Theme switches</li>
</ul>
</li>
<li>Daily summaries.</li>
<li>Email alerts for important events.</li>
<li>Dashboard widget with recent events.</li>
<li>REST API access to logs.</li>
</ul>


TotalWeb – Security, Firewall & Malware Scanner

TotalWeb strengthens your site security with malware defense, brute-force protection, firewall rules, and smart hardening controls.

WebFiable

<p><strong>Improve your site’s security posture and configuration health with monitoring and recommendations.</strong></p>
<p>Webfiable Info is the on-site companion for the Webfiable security service (https://webfiable.com). It securely gathers information about your site’s WordPress version, plugins, themes, and basic site metadata and registers your site with Webfiable so you can receive ongoing reports via email. You stay in control: consent is explicit, and the public endpoint is opt-in and verified on save.</p>
<p>During the white march period, there is no separate signup or billing – the plugin registers your site automatically from the settings screen and you can use the service for free. A subscription may be required in the future; we will notify administrators well in advance.</p>
<h3>Features</h3>
<ul>
<li><strong>One-click registration</strong>: Enter a report recipient email, grant consent, and enable the endpoint; Webfiable Info verifies the endpoint and registers the site automatically.</li>
<li><strong>Opt-in endpoint</strong>: The public <code>/webfiable</code> endpoint is disabled by default and verified when enabled. If verification or registration fails, the plugin safely disables it.</li>
<li><strong>Consent-aware behavior</strong>: Turning off consent simply saves your choice and disables the endpoint; you can re-enable later.</li>
<li><strong>Lightweight by design</strong>: No heavy background jobs; the endpoint serves inventory on demand and runs in milliseconds.</li>
<li><strong>Secure by default</strong>: Uses hybrid encryption (AES-256 + RSA-2048) to transport data.</li>
<li><strong>Part of the Webfiable service</strong>: Currently in white march (early access) and free to use; a subscription may be required in the future. Learn more at https://webfiable.com.</li>
</ul>
<h3>Security Features</h3>
<p>Webfiable Info is built with security at its core, ensuring that your website’s data is protected at every stage:</p>
<ul>
<li><strong>Hybrid Encryption</strong>: Combines AES and RSA. The inventory is encrypted with AES-256-CBC; the AES key is encrypted with RSA-2048.</li>
<li><strong>Fresh IV per response</strong>: Each response uses a new IV so ciphertext is always unique.</li>
<li><strong>Public endpoint, private content</strong>: The <code>/webfiable</code> endpoint can be accessed by anyone, but the payload is encrypted for Webfiable only.</li>
<li><strong>Rate limiting</strong>: Basic per-IP rate limiting reduces abuse.</li>
</ul>
<h3>Why It Is Secure</h3>
<ol>
<li><strong>Strong transport</strong>: AES-256 for data, RSA-2048 for the key – only Webfiable can decrypt.</li>
<li><strong>Unique IVs</strong>: Each response is unique even for identical content.</li>
<li><strong>Minimal inventory</strong>: Only software inventory and basic metadata needed for analysis; no credentials or content are collected.</li>
</ol>
<h3>License</h3>
<p>This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.</p>


Webfiable Info

Connect your site to Webfiable (webfiable.com) to track config health and get security recommendations. Public early access (white march). Free.

TotalWeb – Security, Firewall & Malware Scanner vs Webfiable Info