About this plugin
Liveupx Security is a complete, 100% free WordPress security plugin that rivals paid solutions. No paywalls, ever.
Core Features
Login Security
* Brute force protection with progressive lockouts (1st/2nd/3rd+ strikes escalate automatically)
* Multi-provider CAPTCHA: Math, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile
php + WooCommerce)
* Passwordless magic link login
* Two-factor authentication: TOTP (Google Authenticator) + Email OTP
* Trusted device (30-day bypass cookie)
* Geolocation login alerts — notify when login comes from a new country
* Subnet auto-blocking (repeated attacks from /24 range)
php)
Firewall / WAF
* PHP-based Web Application Firewall running at priority 1
com)
* Admin-defined custom firewall rules
)
* REST API security controls (block guests, hide /users endpoint)
* Country/geo blocking with API fallback chain
)
* Referrer blocking with spam referrer presets
* Bad query/XSS/SQL injection blocking
htaccess security rules
Malware Scanner
* Chunked AJAX scanner — scans plugins, themes, uploads, mu-plugins
* 30+ malware patterns including backdoors, crypto miners, shell injections
* Heuristic risk scoring (0–100) per suspicious file
* Auto-quarantine critical findings during scan
* Scan diff — shows new threats vs last scan
* Database malware scanner (posts, options, comments, users)
* File quarantine and permanent delete
Vulnerability Scanner
* Powered by WPScan API (free tier)
* Scans all active plugins and active theme for known CVEs
* CVSS severity scoring (Critical/High/Medium/Low)
* Dashboard widget showing unresolved critical/high count
* Dedicated Vulnerabilities admin page
File Integrity
org checksums API)
org checksums)
htaccess tampering detection
* Unknown PHP file detection in core directories
Core File Repair
org SVN
* MD5 verification before writing
* Single file or bulk repair
Security Headers
* X-Frame-Options, X-Content-Type-Options, X-XSS-Protection
* Referrer-Policy, Permissions-Policy (per-feature builder)
* HSTS with preload support
* Content-Security-Policy with visual builder
* CSP violation reporting endpoint (REST API)
* A–F letter grade for your header configuration
User Security
author= + REST API)
* Strong password enforcement
)
* Inactive user auto-lock (configurable threshold)
* Admin action audit trail
* Active session manager (view & revoke)
* GDPR IP anonymization
Post-Hack Recovery
* Lock PHP execution in uploads and wp-includes
* Log out all users instantly
* Force password reset for all users
org
)
* Weekly security summary email report
Monitoring & Notifications
* Activity log (filterable, paginated, CSV export, configurable retention)
* HTML branded email alerts
com, Zapier, Discord)
* Real-time dashboard stats (auto-refresh every 30s)
* 7-day login attempt chart
Developer Tools
* WP-CLI commands (wp xsec status|scan|block-ip|unblock-ip|2fa-reset|export-settings|import-settings)
* Settings import/export (JSON)
* Security score with category breakdown
com
com
co