Diamond Sierra Site Defense

Diamond Sierra Site Defense checks your site once a day and tells you – in plain English – what is wrong and how to fix it. Everything below is free, with no account to sign up for, and no firewall rules held back for paying users.

Daily malware scan

• Compares every WordPress core file against the official checksums from WordPress.org.
• Compares plugins and themes from the WordPress.org directory against their official copies, so tampered files (supply-chain attacks) are caught and verified files are skipped.
• Signature scan of themes, plugins, must-use plugins and uploads for web shells, obfuscated eval() backdoors, droppers, hidden-admin code and more.
• Detects ClickFix / fake CAPTCHA pages that trick visitors into running commands on their own computer, clipboard hijacking scripts, and EtherHiding loaders that pull code from BSC/Polygon smart contracts.
• Detects injected remote import() calls in files and on the live homepage.
• Fetches your homepage like a visitor coming from Google, and again as Googlebot, to catch injections and SEO spam that hide from logged-in users.
• Tracks new and changed PHP files between scans.
• Risky plugin alerts with no setup and no API key: plugins removed from WordPress.org for a security issue, security updates waiting (found in the plugin’s changelog) and plugins abandoned for over two years.
• Optional: checks whether Google Safe Browsing is warning visitors away from the site (off until you turn it on).
• Runs in small steps, so it works on shared hosting without timeouts.

Fixes

• Restore a modified core, plugin or theme file with the verified original from WordPress.org.
• Quarantine suspicious files – restorable from the Quarantine tab.
• A verification scan runs automatically after a fix to confirm the malware is really gone.

Firewall

• Blocks SQL injection, XSS, path traversal, remote file inclusion, command injection and PHP object injection.
• Blocks executable and disguised PHP uploads and SVGs with embedded scripts.
• Blocks vulnerability scanners and probes for .env, .git, wp-config backups and known shell names.
• Inspects JSON sent to the REST API and cookies, not just forms.
• Repeat offenders are blocked automatically.
• Log-only mode: see what would be blocked before anything is. New installs log for their first week, then start blocking on their own.

Login protection

• Two-factor login with any authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy…), with one-time backup codes.
• CAPTCHA on the login, registration, lost-password and comment forms: a built-in math question (no account needed), Cloudflare Turnstile, Google reCAPTCHA v2 or hCaptcha – with step-by-step instructions for getting the keys. A CAPTCHA outage or a wrong key never locks you out.
• Refuses passwords found in known data breaches (Have I Been Pwned, k-anonymity – the password never leaves your site).
• Custom login URL – move the login page off wp-login.php so bots can’t find it.
• Login form honeypot that blocks automated login bots with nothing for real visitors to solve.
• Limits failed logins per IP and per account, with escalating lockouts. IPs an account has used before are never locked out, so nobody can lock you out of your own site.
• Trap usernames (like “admin”) get bots locked out on the first try.
• Generic error messages that don’t reveal whether a username exists.

Email alerts

• Scan found a serious problem (and, if you like, an all-clear after every scan).
• An administrator signed in from a new IP.
• A new administrator account was created, or someone was promoted to administrator.
• Diamond Sierra Site Defense itself was deactivated – malware often switches security plugins off first.
• Plugin, theme and WordPress updates are waiting (only when a new one appears).
• An IP or an account was locked out after failed logins (optional, at most once an hour).

Hardening

• Disable XML-RPC, the file editor, application passwords and username enumeration.
• Block PHP execution in uploads, sensitive files and directory listing.
• Security headers and hidden version numbers.
• A security score that explains every check, each with its own Apply button.

Also

• Works alongside Wordfence, All-In-One Security, Solid Security, Sucuri, MalCare, Defender, Shield, Loginizer and others: Site Defense pauses its own firewall and login limits so the same visitor isn’t blocked twice, and keeps scanning.
• Multisite: network-activate it to protect every site. The scanner and settings are for super admins only.
• Results in Tools → Site Health, and WP-CLI commands to get back in after a lockout (wp site-defense unblock, reset-login-url, 2fa-reset).

Diamond Sierra Site Defense Pro

An optional add-on for people who clean hacked sites or look after many: one-click database cleanup, “Fix automatically”, the post-hack recovery kit, protection against stolen login cookies, supply-chain and WooCommerce checkout watches, CVE matching, an alert centre with Slack/Discord, an activity log and white-labelling. Everything listed above stays free. Details at diamondsierra.com

External services

Diamond Sierra Site Defense connects to these services. Apart from the WordPress.org checks, each one is off until you turn it on.

• WordPress.org (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org, plugins.svn.wordpress.org, themes.svn.wordpress.org) – to download official checksums, theme packages and clean copies of files when you restore or repair them, and to read the public directory entry of each installed plugin (whether it was closed, when it was last updated, and the changelog of a waiting update). Only the names and versions of WordPress, your plugins and your themes are sent – the same information WordPress itself sends when it checks for updates. Terms
• Have I Been Pwned – Pwned Passwords (api.pwnedpasswords.com) – only if you turn on “Block breached passwords”. When a password is set, and once a day at login, the first 5 characters of the password’s SHA-1 hash are sent; the password itself and the rest of the hash never leave your site. Terms and privacy
• Cloudflare Turnstile (challenges.cloudflare.com) – only if you choose Turnstile as the CAPTCHA. Its script is loaded on the protected forms, and on submit the visitor’s token and IP address are sent to Cloudflare to check them. Terms · Privacy
• Google reCAPTCHA (www.google.com/recaptcha) – only if you choose reCAPTCHA as the CAPTCHA. Its script is loaded on the protected forms, and on submit the visitor’s token and IP address are sent to Google to check them. Terms · Privacy
• hCaptcha (js.hcaptcha.com, api.hcaptcha.com) – only if you choose hCaptcha as the CAPTCHA. Its script is loaded on the protected forms, and on submit the visitor’s token and IP address are sent to hCaptcha to check them. Terms · Privacy
• Google Safe Browsing – only if you turn on the blocklist check under Settings → Malware scanner. Once per scan, your site’s address is sent to Google to find out whether it is blocklisted. With an API key the request goes to safebrowsing.googleapis.com; without a key, and only if you also tick “Check without a key”, it goes to transparencyreport.google.com. Nothing else is sent. Terms · Privacy

Privacy

• Everything Site Defense records stays in your own database. Nothing is sent to us. The only outside connections are the ones listed under External services.
• The firewall and login logs store the visitor’s IP address, the address they requested and their browser’s user agent, so you can see who was blocked and why. Log lines are deleted after 30 days, and the log never grows past 20,000 lines.
• Blocked IPs are kept until their block ends.
• For each user it keeps the last 10 IP addresses they logged in from (so nobody is locked out of their own account and new-IP alerts work), and, if they turn on two-factor login, the authenticator secret and hashed backup codes.
• The plugin sets no cookies of its own.
• Only administrators (super admins on multisite) can see the logs and settings.
• Deleting the plugin removes its tables, settings, user data and quarantined files.