SecureLite Security

Most security plugins give you a list of switches and leave you hoping they work. SecureLite adds a button that finds out.

Run Attack Simulation fires thirteen real but harmless checks at your own site over loopback — SQL injection, XSS, directory traversal, user enumeration, brute force, malicious and executable uploads, XML-RPC abuse, scanner signatures, a planted malware sample, PHP execution in your uploads folder, and whether your .git directory or readme.html can be downloaded by anyone — then reports, per protection, whether it actually blocked, is switched off, or failed. Where a setting would fix it, an Enable & re-test button is right there. The result is a printable report you can hand to a client.

Everything runs on your site. There is no reverse proxy in front of your domain, so your caching, your CDN and your visitors’ real IP addresses all keep working exactly as they did.

Protection

• Firewall — inspects query strings, POST bodies, cookies, URLs and user agents for SQL injection, XSS, directory traversal and known scanner tools. Monitor mode first, then block when you’re confident. Editors and authors can save a post that explains javascript: links or quotes an onclick= attribute without the firewall refusing it.
• Malicious upload blocking — a virtual patch for the executable-upload vulnerability class, including PHP disguised with an image extension.
• Brute-force lockout — persistent per-IP and per-username, surviving cache flushes. Addresses that keep coming back are locked for longer each time, up to 24 hours. Guesses at “admin” count double. Login errors never disclose whether a username exists. A locked username still opens for the right password, so nobody can lock you out of your own account by knowing your login name.
• Two-factor authentication — TOTP (RFC 6238), per-user enrollment, works with any authenticator app. You cannot switch it on until you have entered a code your app actually produced, and ten single-use recovery codes are issued at the same time.
• Hidden login URL — serve wp-login.php at a secret slug and 404 the default. The new address is tested before it is kept, and emailed to you.
• Malware and injection scanning — every WordPress core file is compared with the official release, so a web shell dropped into wp-includes or the site root, or a changed core file, is reported as Critical with certainty. PHP, JavaScript and HTML elsewhere get signature and heuristic scanning for backdoors, web shells and packed payloads, and matches in wordpress.org plugins are checked against the official release so unmodified library code is not reported as malware. The database is scanned for injected fake-captcha and redirect scripts that a file scanner would never find.
• File-integrity monitoring — event-driven, with a lightweight sweep over the paths attackers actually touch: wp-config.php, .htaccess, mu-plugins, dropins, theme functions.php, and any PHP appearing in uploads.
• Rate limiting — caps requests per IP before the page renders, with a tighter budget for unauthenticated admin-ajax.
• Uploads PHP check — the exact rule, for Apache/LiteSpeed (.htaccess) or nginx, that stops PHP executing in your uploads folder, and an Attack Simulation check that confirms your server enforces it. SecureLite never edits .htaccess or any other server configuration file itself.
• Posture scoring — a local security score with prioritized findings and one-click fixes.
• Notifications — a daily summary and two immediate alerts, sent by your own site. Never one email per blocked request.
• Post-hack recovery — log everyone out, regenerate salts, reset passwords, rename the user 1 account.
• Trusted IPs — exempt your own address or office range from the lockout and rate limiter, so you can’t shut yourself out.
• Works behind Cloudflare and proxies — a Cloudflare preset and a trusted-proxy list, so lockouts see each visitor’s real address. Forwarded IP headers are only believed when the connection really comes from a trusted proxy, so they cannot be forged to dodge a lockout.
• Clean removal — the only file SecureLite writes is wp-config.php, and only when you switch a setting that lives there (the file editor, your trusted-IP line, regenerating keys and salts). Deactivating gives those lines back and reactivating restores them; uninstalling removes them, its tables and its settings entirely. Nothing of this plugin outlives it.

What’s coming next

SecureLite is new, and these are planned — no dates promised, and nothing already in the plugin will ever move behind a paywall:

• An emailed unlock link on the lockout screen, so getting back in never needs FTP.
• Optional alerts when an installed plugin has a known vulnerability, clearly disclosed and off unless you turn it on.
• A dashboard for agencies looking after many sites.

Tell us what you’d like next in the support forum.

What this plugin is not

A PHP plugin cannot stop a volumetric DDoS, and SecureLite does not claim to. For that you want Cloudflare or server-level rate limiting in front of the site. SecureLite owns the depth on the site itself.

External Services

SecureLite does not send telemetry and does not require an account or an API key. All processing happens on your own server and all security data stays in your own database.

WordPress.org checksums. During a malware scan, SecureLite requests the official file checksums for your WordPress release from https://api.wordpress.org/core/checksums/1.0/ (sending the WordPress version and locale), and for wordpress.org plugins that matched a scanner pattern from https://downloads.wordpress.org/plugin-checksums/ (sending the plugin’s folder name and version). When core files do not match the installed release, it also asks https://api.wordpress.org/core/version-check/1.7/ for the newest WordPress version (nothing is sent) so it can recognise files from a half-finished update. No site address, user data or file content is sent. Responses are cached for seven days, the newest-version answer for twelve hours. These are WordPress.org services: Terms of Service, Privacy Policy.