ATV Web Security

ATV Web Security puts your WordPress website into a “protected” state where visitors can still read and use the site, but nothing can persist changes to it — not plugins, not compromised administrators, not direct database access, and not a PHP shell.

51). Detection is only useful if you can tell an attack from WordPress doing its job. ATV Web Security can send metadata about a finding to Groq, using your own free API key, and show a plain-language verdict beside it: benign, suspicious or unknown, with a confidence, a risk level and a one-sentence reason.

New files are reviewed as they are found; intrusion events can be reviewed with one click or automatically every five minutes. The verdict appears in the Integrity tab, the intrusion log and the dashboard widgets, so the answer sits next to the finding. The feature is optional, off by default, metadata-only, advisory and fail-open — see “AI false-positive filtering (Groq)” below for setup, payload and limits.

How it works — multiple independent layers:

• WordPress protection — plugin/theme/core operations, file editors, user creation, option writes and administrator actions are intercepted and denied.

• Database protection (manual) — revokes the database account’s write privileges at the MySQL/MariaDB server level through a separate privileged account, keeping row-level INSERT/UPDATE/DELETE for allowed flows. The site account’s own GRANT authority is never consumed, and an SQL firewall blocks writes when privileges cannot be changed. No tier turns this on.

• Filesystem protection (manual) — makes wp-config.php and.htaccess read-only and marks them plus the signing key immutable with chattr where supported, restoring the original permissions when switched off. wp-admin, wp-includes, plugins and themes stay writable so WordPress can update, with changes caught by integrity monitoring and the new-file watch. No tier turns this on.

• Upload protection — executable uploads are blocked by extension, MIME and content, and the uploads directory is hardened so scripts cannot execute there.

• API protection — REST, AJAX, XML-RPC, WP-CLI and cron-based mutation is blocked; reads remain available.

• PHP firewall integration — a small mu-plugin rejects traffic under wp-includes, blocks links to private files and neutralises low-level PHP tricks.

• Integrity monitoring — baseline hashes of core, configuration and plugin files are verified periodically and on demand.

• New-file and new-table watch — a scheduled scan reports files and database tables that were not there before. Each finding shows the path, detection time and size, with Dismiss and Delete after review; anything a WordPress core, plugin, theme or translation update explains is listed with its cause instead of being announced. Installs and updates performed outside WordPress are recognised too. Scan interval, email delivery and recipients are set on the Integrity tab.

• AI false-positive filtering (optional) — sends file-change and intrusion-event metadata to Groq with your own API key and labels each finding benign, suspicious or unknown with a confidence, risk level and one-sentence reason. Reviews are advisory: nothing is deleted, quarantined, blocked or dismissed automatically, every request fails open, and the feature stays off until you add a key.

• Access rules (optional) — AbuseIPDB-powered IP reputation blocking and a login-country rule, both off by default, with an IP/CIDR allowlist, fail-open lookups and caching.

• Backend lock — the plugin has its own top-level menu; once protection is ON and a master password is set, the settings stay behind a lock screen until that password is entered (12-hour unlock, forged-cookie safe, brute-force rate limited). The master password accepts 8-64 letters, digits and symbols and is the single password accepted to turn protection OFF.

• Email verification code (Two-Factor, optional) — a six-digit code emailed to administrators in addition to the WordPress password, entered on the login form itself. Codes last 10 minutes, can be resent once a minute (five per quarter hour), and the account locks for 15 minutes after five wrong entries. If the mailer cannot deliver, login stays blocked on purpose; recover with wp atvws otp disable.

• Passkeys / WebAuthn (optional) — registers a hardware-backed credential with Windows Hello / TPM, Touch ID, a phone or a security key. The private key never reaches the site, a cookie, JavaScript or a backup. With enforcement on, protected administrator logins are accepted only from a device whose passkey verifies; an account with no passkey is never blocked, and recovery stays available. A passkey also satisfies the device lock and replaces the emailed code.

• Trusted device lock (optional) — binds protected actions to one computer with a one-time token in a secure HttpOnly, SameSite cookie. Other computers get a “link your device” screen that requires the master password, and linking/unlinking always requires it. The Recovery tab stays reachable, so a lost device cannot lock the owner out permanently.

• Behavior policy (optional) — scores privileged activity per source IP over 24 hours and locks the session when the risk crosses a threshold: failed unlock (15), failed disable attempt (25), failed restore attempt (20), failed login (20), refused passkey login (10). The owner is never scored and can clear a lock with the master password.

• Cryptomining defence — strips miner script tags from rendered pages, refuses WordPress HTTP requests to pool domains, scans wp-content for native executables and miner markers, and searches posts and options for injected script blocks. The scans are report-only; nothing is quarantined by a heuristic match.

• Detection & monitoring — a signed login-page script/stylesheet baseline, a self-probe for exposed backups, dumps, dotfiles and debug logs, honeypot decoys with escalating temporary bans, and a local inventory of outdated, abandoned or delisted plugins and themes.

• Snapshot backup and restore — a signed copy of every file WordPress can change plus a full database dump with real CREATE TABLE schema. A snapshot is only saved after it validates row dumps, row counts and a working siteurl. Keep unlimited named snapshots plus one automatic daily snapshot; nothing is deleted automatically. Restore requires protection and both manual write locks to be off, refuses a damaged or incomplete snapshot, quarantines extra files, drops extra tables, replays every row in a transaction and rolls back with the exact MySQL error on failure.

• Live progress — snapshot create, snapshot restore and integrity scans show a stage, item count and percentage while the operation runs.

• Total protection score — one number out of 100 on the Dashboard and on every screen. Points are earned only for verified active settings, so the score drops when a layer stops working, and the Dashboard lists what is still pending, what it is worth and which tab fixes it.

• Setup tour — a guided walkthrough through Diagnostics, Set protection level, Snapshot and the remaining configuration screens.

• Clear layout — screens are grouped into Everyday, Configure, Check and Incident, with a live protection badge, plain-language button descriptions and destructive actions separated from safe ones.

• Recoverable — reset a forgotten master password from the plugin’s runtime directory (emergency-reset.key + emergency-reset.php) or with wp atvws password reset. Both sign out every session and are logged. WordPress account passwords can only be reset from WP-CLI, and email-code settings can be switched off with wp atvws otp disable.

Protection tiers:

• MEDIUM and STRONG apply the same WordPress-level layers: WordPress, REST, AJAX, XML-RPC, upload, PHP shielding, integrity, CLI and cryptomining defence. Neither touches database grants or file permissions.

• LIMITED means protection is on but a core layer is switched off or failed to verify; the dashboard shows which one.

Database and filesystem write protection are separate manual switches on the Dashboard. No tier turns them on, and changing tiers leaves them as they were; both require protection to be on. The database lock revokes write grants where a privileged MySQL account is configured (the wizard or ATVWS_DB_ADMIN_* constants) and reports partial when only the SQL firewall applies; the site account’s GRANT authority is never consumed.

htaccess read-only and marks them plus the signing key immutable via chattr where available, restoring the original modes when switched off. wp-admin, wp-includes, plugins and themes stay writable so WordPress can update, with changes reported by integrity monitoring and the new-file watch.

Choosing or changing a tier requires the master password, so a hijacked admin session cannot quietly weaken the site. Every layer also has its own switch for fine-tuning, and picking a new tier resets those switches. The old names STANDARD, AUTO and HARDENED still work and map to Medium and Strong.

Allowed writes:

Persistent visitor flows (comments, contact forms, WooCommerce, user registration) are BLOCKED by default. Re-enable only what the site needs from the “Allowed Writes” page; everything else stays blocked.

Turning protection OFF is deliberately difficult: submit a form, confirm a checkbox, type the exact phrase and re-enter your account password (plus an optional passphrase). md.

AI false-positive filtering (Groq)

ATV Web Security can ask an AI model to review a finding and suggest whether it looks like ordinary activity or deserves a closer look. The feature is optional, off by default, and uses your own Groq account: there is no shared key and no request is paid for or proxied by the plugin author.

It reviews new files that no WordPress, plugin, theme or translation update explains, and intrusion events (BLOCKED, DETECTED or BYPASSED) that the plugin cannot judge with a deterministic rule. Every review returns benign, suspicious or unknown, a confidence percentage, a risk level and a one-sentence reason, shown beside the file on the Integrity tab and beside the event in the intrusion log.

Reviews are advice, not action. Nothing is deleted, quarantined, blocked, dismissed or emailed differently because of a review. The optional “Auto-explain high-confidence benign files” switch only changes how an alert is presented after its confidence threshold is met, and Dismiss and Delete remain manual.

How to configure it:

• Create a free API key at https://console.groq.com/keys.

• Open ATV Web Security → Integrity and find the AI false-positive filtering (Groq) card.

• Paste the key into Groq API key, tick Enable AI triage, leave Model on Automatic — best free model (or choose any model your key can access), then click Save AI settings.

• Click Test connection. The plugin validates the key against Groq’s model list and tests a model the account can actually use, so a retired model id does not fail silently.

• Choose Review new files and Review intrusion events. Intrusion review mode is On demand by default, which adds a Show AI review button to each unreviewed event; Automatic runs a background review every five minutes.

• Click Triage pending now to label findings already waiting.

What is sent — metadata only:

• New file: path relative to the installation, extension, directory, size, modification time, and whether it is in uploads, a known cache directory, plugins or themes.

• Intrusion event: outcome, layer, action, target (150 characters, with query values named token, key, nonce, password, pass or auth replaced by [REDACTED] ), target kind, static-asset and plugin/theme/uploads flags, whether a user was attached, role, hour of day, and an HMAC-SHA256 hash of the IP address.

Never sent: file contents, POST bodies, database rows, usernames or passwords, raw IP addresses, or any other site content.

Reliability and limits:

• Every request fails open. If Groq is unreachable, the key is rejected or the daily quota (100 requests by default) is reached, alerts stay exactly as they were and the card shows the last error.

• After an HTTP 429 the plugin pauses requests for 90 seconds and writes one warning per distinct failure per 30 minutes instead of flooding the Security Log.

• Reviews are cached per finding, so nothing is re-sent on every run; labels from older prompts are refreshed automatically. Clearing Enable AI triage stops all requests.

See External services below for the data-processing details and Groq’s terms and privacy policy.

External services

This plugin can connect to two external services. Both are optional and off by default, and each is used only while the corresponding feature is on: AbuseIPDB for IP intelligence and Groq for AI-assisted false-positive filtering.

AbuseIPDB

AbuseIPDB provides an IP reputation and geolocation look-up for the site-wide IP reputation block and the login country check, only when those features are switched on. The visitor’s IP address and your AbuseIPDB API key are sent when a protected request is checked. No other data is sent.

Lookups are rate-limited and cached; if a lookup fails, the request is allowed (fail-open) and the failure is logged.

This service is provided by “AbuseIPDB LLC”.

• Terms of use: https://www.abuseipdb.com/legal

• Privacy policy: https://www.abuseipdb.com/privacy

Groq

Groq provides the hosted language model behind the optional AI false-positive filtering feature, used only after you paste your own Groq API key on the Integrity tab and enable AI triage. The plugin author does not run a proxy, hold a shared key, or receive the data.

Groq runs an inference service for open language models. The plugin sends metadata about one finding and receives a JSON review: verdict, confidence, risk level and a one-sentence reason, stored beside the finding. No result is required for the site to work; if a request fails, the finding stays as it was and the failure is logged (fail-open).

Data sent: your API key in the request header, plus the metadata described in the AI section above — for a new file, the relative path, extension, directory, size, modification time and location flags; for an intrusion event, the outcome, layer, action, target (150 characters, secret query values redacted), target hints, user/role flags, hour of day and an HMAC-SHA256 hash of the IP address. No file contents, POST bodies, database rows, usernames, passwords, raw IP addresses or other site content are sent.

Calls stop at 100 per day by default and pause after HTTP 429.

This service is provided by “Groq LLC”.

• Terms of use: https://console.groq.com/docs/legal/services-agreement

• Privacy policy: https://groq.com/privacy-policy

• API keys: https://console.groq.com/keys