CloudScale Cyber & DevTools

Attackers do not choose targets. Scanners probe every WordPress site for flaws published hours earlier. CloudScale Cyber & DevTools puts the layers banks rely on in front of your site, free.

It stops the attack, tells you in plain language what is wrong, and gives you the exact steps to fix it.

What it is

One plugin that does the work of a firewall, a login guard, a malware and integrity scanner, and a security reviewer, and shows the results in one place. It is written for the person who looks after the site, who may not be a security specialist. You do not need to know what a finding means before you read it: each one says what is wrong, why it matters here, and what to do.

It runs inside WordPress on your own server. Nothing leaves your site until you turn on a feature that needs it.

How you use it

• See where you stand. After activating, open Cyber & Devtools in the admin menu. The Home tab shows a setup checklist and what needs attention across the whole site, worst first. Each line links straight to the control that fixes it.

• Protect the login first. The login form is the most attacked part of any WordPress site. On the Login Security tab, turn on two-factor or passkeys for administrators and move the login address.

• Turn on the firewall safely. Start the firewall in Log only and watch what it would have refused on your real traffic. When that looks right, switch it to Block.

• Run an audit. Site Audit checks your configuration, database and plugin health and explains every finding. Most findings come with a one-click Quick Fix you can undo, or a Fix Recipe with the exact commands to run.

• Let it watch. Turn on CVE Alerts and connect Telegram, email or a webhook. From then on you hear about a new flaw in something you have installed, with what to do about it.

What happens when a new flaw is published

Say a flaw is published in a plugin you use, and no update has reached your site yet. The daily check matches it against what you have installed and alerts you. Where a signed virtual patch exists for that flaw, the firewall can refuse the attack while you wait.

CVE Shields can close the plugin’s anonymous endpoints until the fixed version is installed. Once you update, Upgrade Verification checks that the site still works, and File Integrity confirms your files match the official release.

Why your site needs this now

• Most WordPress vulnerabilities are in plugins and themes, so a site is only as safe as its least maintained plugin.

• AI makes new exploits cheaper and faster to write. Your defence uses AI too.

• A hacked site can be blacklisted by search engines, used to send spam or used to steal visitors’ data. Cleaning up costs far more than preventing it.

Stop attacks before they do damage

• Request Firewall: 21 rules against SQL injection, cross-site scripting and code execution, before WordPress handles requests.

• Virtual Patching: narrow, signed rules that block a published flaw in a plugin or theme you have installed until you update. Each patch is checked automatically, reviewed by an AI agent, and is a description, never code.

• CVE Shields: close a vulnerable plugin’s anonymous endpoints until the fixed version is installed, then lift themselves.

• IP Reputation, Rate Limiting and Country Blocking shut out known bad traffic and floods.

• Fake Crawler Check: proves that a visitor claiming to be Googlebot or Bingbot really is, with no delay for visitors.

• Content Security Policy: start in Report-Only, see what real browsers would have blocked, and allow a source with one click.

• Comment Guard keeps comment spam out.

• Edge WAF Push sends the addresses you block to Cloudflare, so they are refused at the edge.

• Edge Gateway (optional): the OWASP Core Rule Set in front of your web server, on the same server, with no DNS change. If it stops, traffic goes back to the web server.

Hear about it first, with the fix

• Vulnerability feed: daily checks of your plugins, themes, core and server software.

• PHP Advisory Alerts: warn you that a PHP security release is coming, and say whether your server is affected.

• Certificate Expiry Warning: flags a certificate before it lapses.

• Alerts by Telegram, email or webhook.

• Quick Fixes: one-click hardening with undo.

• Fix Recipes: the exact commands to run, bundled in the plugin and never downloaded, so what you run is what shipped.

Lock down every login

• 2FA by authenticator app or email, and passkeys with Face ID, Touch ID or Windows Hello. You can make it mandatory for administrators.

• A hidden login address, lockouts and breached-password checks that never send the password.

• Emergency Lockdown: one switch for when someone may already be in. It stops new administrators, plugin changes and application password logins, and signs other administrators out.

• A documented way back in if you are ever locked out, from a wp-config.php safe mode to WP-CLI commands.

Prove your site is clean

• File Integrity: compares every core and WordPress.org plugin file with the official checksums, with repair and quarantine.

• Database malware scan looks for malicious code hiding in your database, where a file scan cannot see it.

• Upgrade Verification: after any change to WordPress, PHP, a theme or a plugin, it checks that the front page, login, REST API and admin still work.

• Threat Monitor, Persistence Watch, Activity Log and Live Traffic show what is changing and who is knocking.

AI that reviews your site like a penetration tester

• AI Cyber Audit: reviews your configuration, plugins, users, headers, DNS and TLS, then scores each finding and ranks what to fix first.

• Deep Dive: adds live checks and AI triage of suspicious plugin code, separating real risks from false alarms.

• Active Vulnerability Verification (optional, subscription): safe test requests to your own site prove whether a flaw is reachable, and each scan is compared with the last so you can see a fix worked.

• Use your own Anthropic Claude, Google Gemini or OpenAI key, including Gemini’s free tier, or choose Managed AI and hold no key at all.

Why people choose it

• Every protection layer is free. Two-factor, passkeys, the firewall, virtual patching and country blocking are not held back for a paid tier.

• It never acts behind your back. Nothing deletes or deactivates a plugin, and fixes are yours to apply and undo.

What is paid

Only two things, and both are optional. Managed AI is about $10 USD a month through PayPal if you would rather not hold an API key. Active Vulnerability Verification needs the same subscription.

Everything else is free.

Developer tools included

• Code block with syntax highlighting, Mermaid diagrams and charts, all served from your own site.

• Export to PDF, SMTP Mail, Server Logs, Performance Monitor, and a SQL Query Tool.

External services

Nothing below is contacted on a default install: each service stays idle until you configure or click something. API keys are your own and go only to that service. Unless an entry says otherwise, no post content, visitor data, database contents, passwords or credentials are sent.

A visitor’s page load triggers nothing except Telegram alerts you set up.

Full reference

WordPress.org APIs (integrity checks)

org

org plugin-checksums/, theme/, and on Repair only release/ and plugin/ zips

Data sent: WordPress version and locale, or a plugin or theme’s slug and version.

When: A File Integrity check, Site Audit scan or Update Risk Assessor run. Off by default.

Privacy policy (no separate terms are published for these APIs)

CloudScale lookups and data lists (optional, off by default)

Service: CloudScale Consulting

consulting:

• /whoami: the plugin’s name and version. At most daily after you turn on CVE Alerts (Security tab), or on Check my address.

• /vuln-lookup and /v1/software-releases: one component per request, never your hostname, site URL or plugin list. During a scan you start, and daily once CVE Alerts is on (Security tab).

• /v1/pwned-range/: the first 5 hex characters of the password’s SHA-1 hash, never the password or full hash. On setting a password, if you choose Warn or Block.

• /v1/php-advisories, /ip-reputation-feed, /v1/virtual-patches and /v1/plugin-models: nothing. Hourly at most, once you turn on the matching feature.

Privacy policy · Terms

CloudScale Managed AI and Active Verification (optional, paid subscription)

Service: CloudScale Consulting, the plugin author

consulting: /v1/messages, /v1/messages-async, /v1/images, /v1/openai-chat, /nuclei-scan, /checkout, /checkout-start, /status, /cancel, /refund-request, /recover, /recover/verify, /contact; /billing-portal and /manage open in your browser.

Data sent: AI features: as Anthropic below, or a post’s title and summary for an image. Billing and messages: your email address, site URL, message and any PayPal reference. Active Verification: the domain and a scan id; CloudScale’s servers then send real HTTP requests to a site you own.

Every request carries your licence key, plugin name and version. Never your own API keys.

When: When you run an AI feature with Managed AI on, or click a billing, message or verification button; status at most every 10 minutes with a licence key stored.

Privacy policy · Terms

CloudScale Fix Recipe Usage and Fix Order (optional, opt-in, off by default)

Service: CloudScale Consulting, the plugin author

consulting: /remediation-event and /remediation-plan

Data sent: Licence key, versions, and the recipe used or failed check identifiers. Never your site URL, IP address or file contents.

When: If you opt in to recipe usage, or click “Ask CloudScale what order to fix these in”. The reply is never code.

Privacy policy · Terms

Cloudflare IP ranges (trusted-proxy list)

Service: Cloudflare, Inc.

com/client/v4/ips

Data sent: Nothing.

When: Weekly, after you choose Cloudflare under Visitor IP Source. Off by default.

Privacy policy · Terms

Cloudflare API (optional: cache purge, comment rate limit, edge blocking)

Service: Cloudflare, Inc.

com/client/v4/zones (purge_cache; /rulesets/phases/http_ratelimit/entrypoint, /rulesets/{id}/rules/; /firewall/access_rules/rules)

Data sent: Your API token, plus URLs to invalidate, one rate-limit rule, or blocked IPs.

When: With a zone ID and token: on publish or by button; Edge WAF Push (off by default) every 5 minutes.

Privacy policy · Terms

OpenStreetMap basemaps (attack-origin map)

Service: OpenStreetMap Foundation

org and its a, b, c subdomains

Data sent: Tile coordinates, plus what a browser sends with any image (IP address, user agent).

When: While an administrator views the map, from their browser.

Privacy policy · Terms

Wordfence Intelligence API (optional, your API key)

Service: Defiant, Inc. (Wordfence)

com/api/intelligence/v3/vulnerabilities/scanner

Data sent: Nothing about your site; matched locally.

When: During a security scan with a key.

Privacy policy · Terms

Anthropic Claude API (optional, your API key)

Service: Anthropic PBC

com/v1/messages

Data sent: AI audits: site URL; plugin, theme, PHP and server versions; security settings and check results; usernames of administrators with a weak login or no two-factor; for the deep dive, flagged PHP snippets and file paths. Site Audit: sample post titles and URLs. Site Optimizer: DB table and column names, or text you paste.

Thumbnails: post title and summary.

When: An AI-labelled button, “Test connection” or a scheduled scan you enabled, with Anthropic selected.

Privacy policy · Terms

Google Gemini API (optional, your API key)

Service: Google LLC

com/v1beta/models/

Data sent: As Anthropic above.

When: As Anthropic above, with Gemini selected.

Privacy policy · Terms

OpenAI API (optional, your API key)

com

com/v1/images/generations

Data sent: Your post title and excerpt, for an image prompt. AI features: as Anthropic above.

When: “Generate” in the AI Image Generator, “Test connection”, or AI features with OpenAI selected.

com/policies/terms-of-use/

PayPal API (optional, Managed AI checkout)

Service: PayPal Holdings, Inc.

com/sdk/js (browser SDK).

Data sent: Your email address, the amount, a reference and return addresses. The SDK load carries CloudScale’s public client ID.

When: You start or check a PayPal subscription.

Privacy policy · Terms

Telegram API (optional, alert notifications)

Service: Telegram Messenger Inc.

org, Bot API methods sendMessage and getUpdates

Data sent: The alert text and your site URL. Alerts can include PHP errors, the username tried, IP address, country, request path, user agent and scan summaries.

When: An enabled alert fires. “Fetch Chat ID” sends only your token.

Privacy policy · Terms

GitHub / GitLab (optional, GitHub Sync)

Service: GitHub, Inc. and GitLab Inc.

com (or your self-hosted GitLab host)

Data sent: Repository owner, name, branch and file path; no token or site data.

When: An editor links a file or clicks Sync; daily for linked blocks.

GitHub: Privacy policy · Terms

GitLab: Privacy policy · Terms

DB-IP GeoIP Database (optional, Visitor Map)

com

gz)

Data sent: A GET for the file; no IP address reaches DB-IP.

When: On “Download / Update GeoIP Database”, then monthly.

Privacy policy · Terms

Uptime heartbeat (optional, off by default, your own endpoint)

Endpoint: An https URL you set, not CloudScale.

Data sent: Site URL, time, your token, plugin version and health signals. No names, emails, paths or IPs.

When: Every 5 minutes once on; while deactivated too if you install the loader.

Your own server addresses (optional, your own endpoint)

Endpoints: Addresses you enter, never CloudScale: the alert webhook URL, csdt_fpm_probe_url and csdt_devtools_cf_origin_refresh_url.

Data sent: Signed JSON alerts to the webhook; otherwise a GET with your host name and page path.

When: On an alert, FPM status view or Cloudflare purge. Nothing while empty.