About this plugin
org | Full version / Shop
Digiter Security Lite adds practical local protections and checks to single-site WordPress. All bundled features are free, without a license, account, trial period or external service.
Included free
- Optional login throttling: five failed password sign-ins from a direct IP connection within 15 minutes trigger a 15-minute cooldown. A successful sign-in clears that connection’s counter.
- Executable filename protection for WordPress upload and sideload handlers, including double extensions such as file.php.jpg and server configuration filenames.
- Review of HTTPS URL configuration, WordPress debug display, built-in file editor settings and login counter storage.
- Administrator-controlled SHA-256 baseline for seven fixed files in the WordPress root, with explicit comparisons showing changed, added, removed, skipped or unchanged files.
- Optional Full version shop link and manual installation instructions on the plugin screen and Plugins list.
No telemetry, remote assets, private updater, remote code installation, advertising on public pages or threat-feed connection is included.
Login protection and recovery
Login throttling is off until an administrator enables it. It uses only the server-provided REMOTE_ADDR. It ignores X-Forwarded-For and other forwarded headers.
Shared networks and reverse proxies can share a counter; enable it only when your server supplies the correct direct visitor address. An invalid or missing address does not trigger throttling. A database failure also fails open rather than blocking every visitor; confirm that Login storage is available.
The throttle covers password sign-ins that use WordPress’s authenticate filter. Existing sessions, application passwords, alternative authentication that bypasses this filter, direct server access and distributed attacks using many addresses are outside its scope. It does not rate-limit every HTTP request.
A request already being processed when a cooldown is set can complete. Cooldowns do not extend when a blocked sign-in is retried. An administrator can reset cooldowns from the plugin screen.
If locked out, wait 15 minutes or rename the digiter-security-lite directory under wp-content/plugins using your hosting file manager. Restore the folder name and reactivate after regaining access. Test login protection on staging before enabling it on a shared or proxied production site.
Upload protection
The filename guard is on after first activation. It supplements WordPress’s own checks and preserves existing upload errors. It blocks executable extensions including PHP, PHTML, PHAR, CGI, ASP, scripts and executable binaries, including these extensions within a double-extension filename.
config. It is not a content scanner, quarantine service or server firewall. SFTP, direct filesystem writes, existing files and upload handlers that bypass WordPress filters are not covered.
This guard does not grant permission to upload file types otherwise disallowed by WordPress.
Integrity baseline
ini. A baseline must be recorded deliberately after verifying these files against trusted originals. It is not automatically refreshed when files change.
An unchanged file is not necessarily safe: a baseline made on a compromised site will record the compromised files.
The check reads file hashes only. It does not modify, restore, quarantine or display file contents. php in a parent directory), symlinks, unreadable files and files larger than 8 MB are excluded.
This resource safeguard is not a paid restriction. Comparisons run only when an administrator clicks Compare files now; the last result is timestamped. WordPress updates may legitimately change the baseline files.
Review changes before recording a new trusted baseline.
Optional Full version
Use Buy Full version in the Plugins list or Security Lite screen to open Digiter Shop directly from WordPress. Select Digiter Security Ultimate and review its current features, price and renewal terms. org and follow the order email or Customer Account instructions to download the Full ZIP and license.
Back up your site and test on staging. Deactivate Lite, install the Full ZIP through Plugins > Add New > Upload Plugin, activate Full and enter the license in its License screen. Lite settings and baselines are independent and are not imported into Full.
The separate Full product provides its own advanced security modules. Full product documentation describes current capabilities and purchase requirements. Those modules are not bundled or locked inside Lite.
The commercial screenshot is a clearly identified reference, not a representation of Lite’s included features. Following a shop link is optional and opens the website in your browser. Lite never downloads or installs commercial code.
Privacy and retention
Processing is local. The plugin’s dgsclt_attempts database table stores an HMAC of the direct IP address, failure count and timestamps. It stores no raw IP addresses, usernames, passwords, emails or request bodies.
Pseudonymous connection identifiers can still be personal data. Records expire after 24 hours and are deleted when the hourly WordPress cron task executes. Successful sign-in clears the connection’s record.
Administrators can clear all records with Reset login cooldowns. Disabling login protection or deactivating the plugin also clears them.
Settings, baseline hashes and the last comparison are stored in dgsclt_settings, dgsclt_baseline and dgsclt_comparison. Deactivation preserves these options. Uninstall removes all three options, the plugin table and its scheduled cleanup.
No data is sent to Digiter. The optional shop and documentation sites have their own privacy policies.
Compatibility and source
2 or later, MySQL/MariaDB. Multisite and SQLite are unsupported. htaccess or other server configuration.
Configuration observations are not a certificate test or a guarantee against compromise. Use backups, maintained software and suitable server security alongside these checks.
All readable PHP and CSS source is included; no build step or third-party library is required. 0-or-later. Screenshot 2 is the unmodified Full-edition screenshot provided by the owner.