Stops firewall false positives on checkouts, forms, webhooks and editors' posts, and no longer blocks common integrations and SEO tools by default. Recommended for all users.<\/p>","1.5.0":"
Fixes stale files behind CDNs, real visitor addresses behind Cloudflare, country blocking without a CDN, two-factor sign-in counted as failures, and wider malware and database scanning. Recommended for all users.<\/p>","1.4.11":"
Fixes backups of data containing the % character, restores the weekly automatic scan, and removes every feature limit. Requires WordPress 6.6. Recommended for all users.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3739917,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3739917,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3739917,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3739917,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.5.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3739912,"resolution":"1","location":"assets","locale":"","width":1600,"height":1000},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3739912,"resolution":"2","location":"assets","locale":"","width":1600,"height":1000},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3739912,"resolution":"3","location":"assets","locale":"","width":1600,"height":1000},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3739912,"resolution":"4","location":"assets","locale":"","width":1600,"height":1000}},"screenshots":{"1":"Dashboard overview with the admin-bar Security Score and at-a-glance module status.","2":"Firewall panel \u2014 web application firewall, sign-in lockout, bot management and active virtual patches.","3":"Malware scanner \u2014 findings list with one-click quarantine and repair.","4":"Live Traffic monitor \u2014 real-time request feed with user-agent classification."}},"plugin_section":[],"plugin_tags":[1174,55021,600,1909,18199],"plugin_category":[54],"plugin_contributors":[285881],"plugin_business_model":[],"class_list":["post-371092","plugin","type-plugin","status-publish","hentry","plugin_tags-firewall","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor-authentication","plugin_tags-waf","plugin_category-security-and-spam-protection","plugin_contributors-totalsecuritywp","plugin_committers-totalsecuritywp"],"banners":{"banner":"https:\/\/ps.w.org\/loyal-security\/assets\/banner-772x250.png?rev=3739917","banner_2x":"https:\/\/ps.w.org\/loyal-security\/assets\/banner-1544x500.png?rev=3739917","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/loyal-security\/assets\/icon-128x128.png?rev=3739917","icon_2x":"https:\/\/ps.w.org\/loyal-security\/assets\/icon-256x256.png?rev=3739917","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/loyal-security\/assets\/screenshot-1.png?rev=3739912","caption":"Dashboard overview with the admin-bar Security Score and at-a-glance module status."},{"src":"https:\/\/ps.w.org\/loyal-security\/assets\/screenshot-2.png?rev=3739912","caption":"Firewall panel \u2014 web application firewall, sign-in lockout, bot management and active virtual patches."},{"src":"https:\/\/ps.w.org\/loyal-security\/assets\/screenshot-3.png?rev=3739912","caption":"Malware scanner \u2014 findings list with one-click quarantine and repair."},{"src":"https:\/\/ps.w.org\/loyal-security\/assets\/screenshot-4.png?rev=3739912","caption":"Live Traffic monitor \u2014 real-time request feed with user-agent classification."}],"raw_content":"\n
Loyal Security - Firewall & Malware Scanner is an all-in-one WordPress security suite: a dual-mode web application\nfirewall, malware scanner with file integrity monitoring, server hardening, two-factor\nauthentication, backups, and audit logging \u2014 in a single self-contained plugin.<\/p>\n\n
Every protection runs on your own server with the rules bundled in the plugin. No Node.js, no\nbuild step: the admin dashboard is a React app powered by WordPress core's own bundled\n wp-element, and every PHP class is loaded by a built-in autoloader. Install it, activate it,\nand it works. A small number of features use outside services; each one is listed under\n\"External services\" below, with what it sends and how to switch it off.<\/p>\n\n
Everything in this plugin is free and fully functional \u2014 nothing is locked, limited or\ntime-restricted.<\/strong> Loyal Security Pro is a separate plugin, sold and downloaded from our\nwebsite, that adds automation and agency tools on top.<\/p>\n\n Loyal Security Pro is a separate plugin for people running security across many sites. It is\nnot needed for anything listed above. It adds:<\/p>\n\n Loyal Security connects to the services below. Nothing else is contacted, and no request\ncarries your site's URL, your visitors' personal data, or your content unless stated here.\nRequests the plugin makes identify themselves as Our own service, used for:<\/p>\n\n Terms of use: https:\/\/loyalsecuritywp.com\/terms.html \u2014 Privacy policy: https:\/\/loyalsecuritywp.com\/privacy.html<\/p>\n\n On by default.<\/strong> When a user logs in, the plugin checks whether the password appears in known\ndata breaches, using k-anonymity: only the first five characters of the password's SHA-1 hash\nare sent \u2014 never the password, the username or the email address. It never blocks a login; the\nuser sees a warning. Switch it off with Settings \u2192 Identity & Access \u2192 \"Breach Check\".<\/p>\n\n Terms of use: https:\/\/haveibeenpwned.com\/TermsOfUse \u2014 Privacy policy: https:\/\/haveibeenpwned.com\/Privacy<\/p>\n\n Only if you choose Turnstile as the login CAPTCHA and enter your keys. The Turnstile script\nloads on the login form, and on submission the visitor's CAPTCHA token and IP address are sent\nto Cloudflare to verify it.<\/p>\n\n Terms of use: https:\/\/www.cloudflare.com\/website-terms\/ \u2014 Privacy policy: https:\/\/www.cloudflare.com\/privacypolicy\/ \u2014 Turnstile privacy addendum: https:\/\/www.cloudflare.com\/turnstile-privacy-policy\/<\/p>\n\n Only if you choose reCAPTCHA v3 as the login CAPTCHA and enter your keys. The reCAPTCHA script\nloads on the login form, and on submission the visitor's CAPTCHA token and IP address are sent\nto Google to verify it.<\/p>\n\n Terms of service: https:\/\/policies.google.com\/terms \u2014 Privacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\n Only if you enter your own Safe Browsing API key (Settings \u2192 Hardening). The plugin then sends\nyour site's home URL to check whether Google has flagged it. Nothing is sent without a key.<\/p>\n\n Terms of service: https:\/\/developers.google.com\/terms \u2014 Privacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\n File integrity checks download the official checksums of WordPress core and of the installed\nWordPress.org plugins (plugin slug and version). When you choose to repair or reinstall, the\nofficial WordPress core or plugin package, or a single core file, is downloaded. These are the\nsame public services WordPress uses for updates.<\/p>\n\n File Integrity Monitoring is on by default and its check also runs on a weekly schedule, so\nthese checksums are fetched automatically as well as when you start a check yourself. Switch\nthe automatic run off in Settings \u2192 File Integrity Monitoring (the scheduled check, or the\nwhole module).<\/p>\n\n Privacy policy: https:\/\/wordpress.org\/about\/privacy\/ \u2014 WordPress.org does not publish a separate\nterms of service for these endpoints; they are the same public APIs WordPress core itself uses,\nand the software is governed by the GPL: https:\/\/wordpress.org\/about\/license\/<\/p>\n\n Only when an administrator clicks \"Scan\" on the Content Security Policy screen. To suggest\nwhich domains your policy should allow, the scanner loads a few of your own pages and the\nexternal stylesheets those pages already use (for example a Google Fonts or CDN stylesheet),\nwith a plain request that carries no site data. Those providers' own terms apply to those\nfiles, exactly as when a visitor loads your site.<\/p>\n\n To confirm that a visitor claiming to be a search-engine crawler (Googlebot, Bingbot\u2026) really\nis one, the plugin performs a reverse and forward DNS lookup of that visitor's IP address\nthrough your server's normal DNS resolver. The result is cached.<\/p>\n\n\n Server requirements:<\/strong> PHP 8.0 or later. Optimized Mode (recommended) needs either\n auto_prepend_file support (mod_php\/CGI) or a writable No. The dashboard uses WordPress's bundled React via ES modules, so there's nothing to\ncompile \u2014 and no Composer install either, since the plugin ships its own lightweight\nautoloader.<\/p><\/dd>\n Yes. The dashboard lives entirely in wp-admin, so it's completely independent of your active\ntheme.<\/p><\/dd>\n Optimized Mode runs the firewall before WordPress even loads, so malicious requests are\nblocked before the WordPress bootstrap, database connection, or plugin\/theme loading happen.\nStandard Mode, used automatically when the prepend can't be deployed, still runs as early as\npossible inside WordPress.<\/p><\/dd>\n The Optimized Mode prepend is written to fail open: if its configuration or any of its files\nare missing or unreadable, it does nothing rather than breaking the site. The Setup Wizard\nalso self-tests the deployment and automatically rolls back if the test fails.<\/p><\/dd>\n No. Every feature in this plugin is complete and has no time, usage or licence limits.\nLoyal Security Pro is a separate plugin that adds its own features (listed above); installing\nit unlocks nothing in this one.<\/p><\/dd>\n By default, three: our threat-intelligence feed (twice a day, to keep the firewall and scanner\nrules current), Have I Been Pwned's Pwned Passwords range API (at login, k-anonymous), and\nWordPress.org's own checksum service (with the weekly file-integrity check, the same service\nWordPress uses for updates). All three can be switched off in Settings. Everything else \u2014\nCAPTCHA, Safe Browsing, bypass reports, the CSP scanner \u2014 is off until you enable it or click\nit. See \"External services\" above for exactly what each one sends.<\/p><\/dd>\n You can, but running two firewalls or two file scanners at once is generally redundant and\ncan occasionally conflict (for example, both plugins trying to write competing rules to\n.htaccess). We recommend deactivating other firewall plugins before activating Loyal\nSecurity's.<\/p><\/dd>\n Yes. If Wordfence, Sucuri Security or iThemes\/Solid Security is or has been installed on the\nsite, Loyal Security can read the IP block and allow lists those plugins stored in your own\ndatabase, so you do not have to type them in again. It only ever reads, never writes to or\nchanges the other plugin's data, nothing is sent anywhere, and it runs only when an\nadministrator starts it from the Firewall screen. Those product names are used here solely to\nidentify whose stored lists are being read; Loyal Security is not affiliated with, endorsed by,\nor connected to any of them.<\/p><\/dd>\n Please report it privately rather than in the public support forum so it can be fixed before\ndetails become public.<\/p><\/dd>\n By default, deleting Loyal Security keeps your security data (logs, scan history, settings)\nin the database in case you reinstall it. Any deployed server-level changes \u2014 the firewall\nprepend, .htaccess rules, wp-config markers \u2014 are always reverted on delete regardless. If you\nwant a full data wipe instead, enable \"Delete all data on uninstall\" under Settings before\nremoving the plugin.<\/p><\/dd>\n Country rules use the visitor's country from Cloudflare (when your site is behind Cloudflare)\nor from a trusted proxy you configured. Otherwise they look the address up in a table bundled\nwith the plugin: IP Geolocation by DB-IP<\/a>, \"IP to Country Lite\", licensed\nunder CC BY 4.0<\/a> and converted to a compact\nlookup format (details in The plugin's admin screens, and notification emails that include a country, link to DB-IP as its\nlicence asks. The page a visitor sees when a country rule blocks them can show the same link: turn\non \"geo credit on block page\" in the Firewall settings. It is off by default because a plugin may\nnot add links to your public site without your consent.<\/p><\/dd>\n Yes. Requests that come from Cloudflare's published addresses are recognised automatically, so\nbans, rate limits and logs use the real visitor's address (\"Trust Cloudflare\", on by default).\nCloudflare's own addresses are never banned or allowlisted. For another proxy or load balancer,\nadd its address under Firewall \u2192 Trusted proxies.<\/p><\/dd>\n\n<\/dl>\n\n\nFeatures<\/h4>\n\n
\n
wp loyal-security status | scan | firewall | backup | twofa<\/code>.<\/li>\n<\/ul>\n\nLoyal Security Pro<\/h4>\n\n
\n
External services<\/h3>\n\n
LoyalSecurity\/<version><\/code> instead of\nWordPress's default user agent (which includes the site's URL).<\/p>\n\nLoyal Security threat-intelligence service (licensekit.loyalsecuritywp.com)<\/h4>\n\n
\n
Have I Been Pwned \u2014 Pwned Passwords (api.pwnedpasswords.com)<\/h4>\n\n
Cloudflare Turnstile (challenges.cloudflare.com)<\/h4>\n\n
Google reCAPTCHA (www.google.com)<\/h4>\n\n
Google Safe Browsing (safebrowsing.googleapis.com)<\/h4>\n\n
WordPress.org (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org)<\/h4>\n\n
Stylesheets your pages already load (CSP scanner)<\/h4>\n\n
DNS (your server's resolver)<\/h4>\n\n
\n
loyal-security<\/code> folder to \/wp-content\/plugins\/<\/code>, or install it directly from\nPlugins \u2192 Add New<\/strong>.<\/li>\n.user.ini<\/code> (PHP-FPM). Where neither\nis available, the firewall automatically falls back to Standard Mode \u2014 no manual\nconfiguration required.<\/p>\n\n\n\n
Does this require Node.js or a build step?<\/h3><\/dt>\n
Does it work with both block and classic themes?<\/h3><\/dt>\n
Will this slow down my site?<\/h3><\/dt>\n
What happens if the firewall itself breaks?<\/h3><\/dt>\n
Is anything in this plugin limited or locked?<\/h3><\/dt>\n
Which outside services does the plugin contact?<\/h3><\/dt>\n
Can I use this alongside another security plugin?<\/h3><\/dt>\n
Can I bring my IP block and allow lists over from another security plugin?<\/h3><\/dt>\n
Where do I report a security vulnerability in the plugin itself?<\/h3><\/dt>\n
What happens to my data if I delete the plugin?<\/h3><\/dt>\n
Where does the country data come from?<\/h3><\/dt>\n
data\/geo\/NOTICE.txt<\/code>). The table is updated with each plugin release,\nand looking an address up never contacts any outside service.<\/p>\n\nDoes it work behind Cloudflare?<\/h3><\/dt>\n
1.5.1<\/h4>\n\n
\n
1.5.0<\/h4>\n\n
\n
1.4.14<\/h4>\n\n
\n
1.4.13<\/h4>\n\n
\n
loyal-security\/v1<\/code> and the management capability is manage_loyal_security<\/code>, replacing identifiers that still carried the plugin's former name. Any role an administrator had granted access to is moved across automatically on update.<\/li>\n<\/ul>\n\n1.4.12<\/h4>\n\n
\n
$wpdb->prepare()<\/code>, with the table name passed as an identifier placeholder.<\/li>\n1.4.11<\/h4>\n\n
\n
%<\/code> character in the database (e.g. in posts or options) was written to the backup incorrectly and came back as a long placeholder code after a restore. Backups taken with 1.4.11 or later restore it correctly; restoring a backup taken with an earlier version does not repair values that were already stored incorrectly in that backup.<\/li>\n1.4.10<\/h4>\n\n
\n
1.4.9<\/h4>\n\n
\n
1.4.8<\/h4>\n\n
\n
Tested up to<\/code> bumped to the current WordPress release.<\/li>\n<\/ul>","raw_excerpt":"Firewall, malware scanner, file integrity monitoring, hardening, 2FA, backups, and audit logging \u2014 one self-contained plugin.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/371092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=371092"}],"author":[{"embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/totalsecuritywp"}],"wp:attachment":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=371092"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=371092"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=371092"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=371092"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=371092"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=371092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}