Sachin D

Uptrue Monitor keeps an eye on your WordPress site from the inside, detecting threats and misconfigurations that external uptime monitors will never catch.
It works by running scheduled checks on your server and either sending findings to your Uptrue dashboard or emailing you a free monthly health report — no Uptrue account required to get started.
No inbound ports. No firewall changes. Works behind Cloudflare.
<h4>What it monitors</h4>
File Security 
* PHP files injected into your /uploads/ directory 
* JavaScript files injected into /uploads/ 
* Executable files (.sh, .exe, .py, .bat) in /uploads/ 
* WordPress core file modifications (wp-login.php, wp-settings.php, wp-admin/admin.php) 
* Active theme file changes (functions.php) 
* .htaccess and wp-config.php modification detection 
* World-writable directory permissions
User & Access Security 
* New administrator and editor accounts 
* Login failure tracking (brute force detection) 
* REST API user enumeration exposure 
* Application passwords in use 
* XML-RPC enabled status 
* Two-factor authentication plugin detection
Content Integrity 
* Foreign-language content injection — detects Chinese, Russian, Arabic, Hindi, Thai, Japanese, Korean, Hebrew, Bengali, and Georgian characters in page titles, slugs, and content (SEO spam detection) 
* New pages and posts published since last check
Configuration & Health 
* Plugin updates available 
* Theme updates available 
* WordPress core auto-update status 
* Backup plugin presence 
* Debug mode (WP_DEBUG) status 
* Spam comment volume 
* Database size 
* Disk usage
<h4>Two ways to use it</h4>
Standalone (free, no account needed) 
Install the plugin and get a free monthly health report delivered to your WordPress admin email. No signup required.
Connected to Uptrue (real-time alerts) 
Add your Uptrue API token to get real-time alerts, a live security dashboard, AI-powered fix suggestions, and full historical reports. Create a free account at <a href="https://uptrue.io" rel="nofollow ugc">uptrue.io</a>.
<h4>How it works</h4>
The plugin runs on a schedule using WordPress cron (every 60–240 minutes, configurable). On each run it collects site health data and either pushes it to Uptrue or stores it locally for the monthly report. There are no inbound connections — your server always initiates the outbound request.
<h4>Privacy</h4>
This plugin does not contact any external service until you explicitly opt in by saving an Uptrue API token in Uptrue → Settings. With no token saved, the plugin runs only local checks on your server and (optionally) emails the monthly health report to your WordPress admin email. No data leaves your server in standalone mode. Saving a token is treated as your explicit consent for the plugin to begin transmitting site health data to Uptrue. Clearing the token field stops all transmission immediately. See the Third Party Services section below for the full list of fields sent.
<h3>Third Party Services</h3>
This plugin transmits data to Uptrue (https://uptrue.io), a website monitoring service operated by Vision Software Solutions Limited, Brentford, United Kingdom.
When data is transmitted:
<ol>
<li>When you save an API token — a one-time connectivity self-test is performed to verify the connection. This only runs after you have entered a token and clicked Save.</li>
<li>On each scheduled cron run (every 60–240 minutes) — site health data is pushed to Uptrue.</li>
</ol>
No data is transmitted if no API token is saved. The plugin makes no outbound connections on activation or deactivation.
Data transmitted includes:
<ul>
<li>WordPress version and PHP version</li>
<li>List of active and inactive plugins with version numbers and available update status</li>
<li>Active theme name, version, and available update status</li>
<li>Admin and editor user accounts: login name, email address, roles, and registration date</li>
<li>Recently published pages and posts: title, slug, status, and author ID</li>
<li>Results of file scans: PHP, JavaScript, and executable files found in /uploads/; .htaccess and wp-config.php modification flags; core file modification flags; theme file modification flags; world-writable directory paths</li>
<li>Security configuration: XML-RPC status, REST API user enumeration exposure, application passwords in use, auto-update settings, two-factor authentication plugin presence, backup plugin presence, daily login failure count, spam comment count, disk usage percentage and free space</li>
<li>Foreign-language content detection: post IDs, titles, slugs, detected language, and URLs of any pages with non-Latin content</li>
<li>Site URL, database size, and basic site statistics (total pages, posts, users by role)</li>
</ul>
Uptrue Terms of Service: https://uptrue.io/terms 
Uptrue Privacy Policy: https://uptrue.io/privacy

Uptrue Monitor

Monitor your site from the inside — file injections, rogue admin users, foreign-language content, brute force attacks, and security misconfigurations.

Paul

Shield Security

Most security plugins hand you a dashboard full of alerts and expect you to know what to do next. Shield works differently.
It blocks threats automatically, repairs what it can on its own, and then shows you exactly what still needs your attention — ranked by impact, not volume. Less noise. More action.
<h4>🤖 Security That Runs Itself</h4>
The most powerful thing Shield does is what it handles without you:
<ul>
<li>Automatic IP Blocking — every visitor is quietly scored as they interact with your site. Failed logins, firewall blocks, silentCAPTCHA failures, and other signals accumulate into a reputation score. When a visitor’s score crosses the threshold, Shield blocks them — automatically, without you lifting a finger</li>
<li>Automatic File Repair — when a file integrity scan finds a changed WordPress core file, Shield pulls the original from WordPress.org and restores it. Detected and fixed, without waiting for you to act</li>
<li>Automatic Bot Recognition — Shield identifies legitimate crawlers (Google, Bing, DuckDuckGo, Yandex, Apple) and known services (ManageWP, Pingdom, Stripe, CloudFlare) and never blocks them. Your SEO and monitoring tools keep working</li>
</ul>
<h4>🧭 Guided Security, Not Just a Dashboard</h4>
Shield organises your security into four focused areas so you always know where to look:
<ul>
<li>Queue — things that need your attention, ranked by priority. Not everything at once — just what matters right now</li>
<li>Investigate — dig into blocked IPs, security events, and the specific signals that triggered each one</li>
<li>Configure — guided setup for each protection area, with clear recommendations matched to your site</li>
<li>Reports — a clear view of what Shield has blocked, detected, and repaired over time</li>
</ul>
The goal: guide you quickly towards action, not bury you in data.
<h4>🛡️ Free Protection</h4>
Bot Blocking & Firewall
<ul>
<li><code>silentCAPTCHA</code> — blocks bad bots on login, registration, lost password, and comment forms using passive signals invisible to real visitors. No CAPTCHA keys. No external requests. No JavaScript that breaks your forms. Everything runs on your server (GDPR friendly).</li>
<li>Firewall rules blocking common WordPress attack patterns — SQL injection probes, known exploit signatures, suspicious request parameters</li>
<li>XML-RPC protection — disable or restrict entirely, including pingbacks and trackbacks</li>
<li>REST API firewall — block unauthenticated requests</li>
<li>Fake crawler detection — identifies bots spoofing legitimate search engines</li>
</ul>
Login & Account Security
<ul>
<li>Two-factor authentication (2FA) — email codes, Google Authenticator, or YubiKey OTP for all users</li>
<li>Brute force protection with configurable login attempt limits and cooldown</li>
<li>Session locking — tie sessions to a browser or IP to stop account theft after a successful login</li>
<li>User enumeration blocking — closes off <code>?author=</code> probes used to harvest usernames before an attack</li>
</ul>
Scanning & Integrity
<ul>
<li>Core file scanning — compares WordPress core against official checksums and repairs changed files automatically</li>
<li>Suspicious PHP detection — flags PHP files in locations where they have no business being</li>
<li>Abandoned plugin detection — identifies unmaintained plugins most likely to carry unpatched vulnerabilities</li>
</ul>
Visibility & Control
<ul>
<li>Security Admin PIN — lock Shield’s own settings so other administrators cannot quietly weaken your configuration</li>
<li>Security activity log — logins, user changes, plugin and theme events, post edits, and suspicious requests: Everything in one clear view</li>
<li>IP Rules — automatic & manual block and bypass rules, CIDR range support, full per-IP request history</li>
</ul>
<h4>🤝 CrowdSec Integration</h4>
Shield is the only WordPress security plugin with a native CrowdSec integration. CrowdSec aggregates threat signals from millions of sites into a shared IP reputation network — your site blocks known attackers before they ever probe you, using intelligence far beyond your own traffic history.
<h4>✨ ShieldPRO</h4>
<ul>
<li>Passkeys — phishing-resistant, passwordless login for users</li>
<li>Backup login codes — emergency 2FA access when a device is lost</li>
<li>AI-based malware scanner — detects known and unknown PHP malware</li>
<li>Plugin & theme file scanning — compares installed files against WordPress.org originals, flagging unauthorised changes</li>
<li>Vulnerability scanning — active checks across all installed plugins and themes</li>
<li>Broader spam protection — WooCommerce, EDD, Contact Form 7, Ninja Forms, Elementor, and more</li>
<li>Traffic rate limiting — cap request rates per IP to absorb high-volume bot floods</li>
<li>User suspension — manual or automatic suspension of idle accounts</li>
<li>MainWP integration</li>
<li>White Label — rename and rebrand Shield for client sites</li>
</ul>
<h4>Who It’s For</h4>
Shield suits site owners, agencies, and MSPs who want protection that runs itself — not a plugin that demands constant attention to be useful.
If you have been burned by security plugins that generate more noise than protection, or dashboards that tell you everything is wrong without telling you what to fix, Shield was built to be the alternative.

Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning

Smart WordPress security that blocks bots automatically, guides you to what matters, and repairs problems — without drowning you in noise.

Uptrue Monitor vs Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning