VaultShift

VaultShift hardens your WordPress site with a unified security dashboard, real-time threat monitoring, and tools that run locally on your server. Every core module is included and works out of the box after you activate your Free or Cloud key from myapps.wontonee.com.

Optional VaultShift Cloud services (signature sync, IP reputation, cloud spam scoring) stay off by default until you enable them under Settings.

Malware & file integrity scanner

• Full-site file scans in the background — no need to keep a browser tab open
• Daily or weekly scheduled scans, plus on-demand manual scans
• WordPress core checksum verification against the official release
• Quarantine suspicious files instead of deleting immediately
• Security score and scan history on the dashboard
• Automatic scan triggers when attacks are detected

Web Application Firewall (WAF)

• Runs as a must-use plugin before WordPress loads, blocking threats early
• Learning, active, and paranoid modes
• Built-in rule sets plus optional cloud rule updates (when Cloud is enabled)
• Block and allow lists, rate limiting, and WAF event logging
• Geo-blocking by country and optional VPN/proxy blocking

Login protection

• Brute-force lockout after failed attempts
• Optional custom login URL to hide wp-login.php
• Google reCAPTCHA v3 when you add your own site keys
• Two-factor authentication (TOTP) for administrator accounts

WordPress hardening

• One-click checklist: disable file editor, limit REST user enumeration, security headers, and more
• Sensible defaults with per-toggle control
• WordPress Site Health tests for scan freshness, WAF status, and backup directory

Activity log

• Tamper-evident log of logins, file changes, plugin updates, and security events
• Filterable admin view and REST API access
• Helps with audits and incident response

Spam protection

• Honeypot, heuristics, and scoring for comments and registration
• Optional cloud spam check when VaultShift Cloud is enabled
• Integrations for common form plugins

Backup & restore

• Create compressed backups of your database and wp-content
• Scheduled or manual backups with retention controls
• Restore from backup history with progress tracking

VaultShift Cloud (optional)

Enable Cloud services under Settings when you want enhanced protection backed by VaultShift servers:

• Up-to-date malware signatures
• IP reputation and VPN/proxy detection
• Cloud-based spam scoring

Remote calls are opt-in only — nothing is sent until you turn Cloud on.

Free vs Cloud keys

VaultShift requires a cloud key to activate (Free or Cloud tier). Keys tie your site to myapps for plan validation. All local security features remain on your server; Cloud keys unlock optional remote services when you choose to enable them.

External services

This plugin may connect to external services when configured or when you opt in.

VaultShift Cloud

Optional malware signature updates, IP reputation checks, VPN/proxy detection, and cloud-based spam scoring when Cloud services is enabled under Settings.

Sends visitor IP addresses, comment metadata/content (when cloud spam check is enabled), and site identification data when those features run.

Service: VaultShift Cloud API at https://myapps.wontonee.com/v1
Terms of use: https://wontonee.com/terms/
Privacy policy: https://wontonee.com/privacy/

myapps cloud keys (VaultShift activation)

Used when you activate a Free or Cloud key during setup or under Settings.

Sends your cloud key and site domain to register and validate your plan.

Service: https://myapps.wontonee.com/api/vaultshift
Terms of use: https://wontonee.com/terms/
Privacy policy: https://wontonee.com/privacy/

Google reCAPTCHA

Used when you enter reCAPTCHA v3 site and secret keys under Login Protection.

Sends the visitor IP address and reCAPTCHA token to Google for verification when someone logs in or registers.

Terms of use: https://policies.google.com/terms
Privacy policy: https://policies.google.com/privacy

ipapi.co

Used for country-based geo-blocking when you configure blocked country codes under Firewall.

Sends the visitor IP address when determining country code.

Terms of use: https://ipapi.co/terms/
Privacy policy: https://ipapi.co/privacy/

WordPress.org API

Used during malware scans to verify WordPress core file checksums against the official release.

Sends WordPress version and locale.

Terms of use: https://wordpress.org/about/gpl/
Privacy policy: https://wordpress.org/about/privacy/