Rapid Security Manager

Rapid Security Manager is a local-first WordPress security plugin with a source-aware Web Application Firewall, encrypted TOTP two-factor authentication, structured Content Security Policy, security headers, WordPress hardening, local WAF and CSP logs, optional local GeoIP enrichment, and diagnostics.

No Rapid Security Manager account or online security service is required. Security events and uploaded GeoIP data remain on the WordPress installation. Rapid Security Manager does not include telemetry, does not send logs to the developer, does not bundle a GeoIP database, and does not use an online GeoIP lookup API.

The Free plugin owns the shared request engine and WAF event handling used by compatible add-ons. Optional hourly CSP Log email notifications use a shared Free/Core mail service and one Rapid Security Manager WordPress Cron task. The Diagnostics page performs no external HTTP self-tests and does not automatically change security settings.

Current Free features include:

• Optional per-user TOTP two-factor authentication using standard authenticator apps.

• Pre-authentication login challenge: after a correct password, WordPress authentication cookies are issued only after the required TOTP/recovery verification succeeds.

• Authenticated encryption for stored TOTP secrets using AES-256-GCM or Sodium Secretbox; Rapid Security Manager intentionally has no plaintext/Base64 secret-storage fallback.

• Ten one-time recovery codes by default, stored only as password hashes and shown in plaintext only once through a short-lived display token.

• Optional trusted devices with rolling 30-day validity after each successful sign-in, random browser tokens stored only as keyed hashes, per-user management, rename/removal, and automatic revocation after password changes.

• TOTP replay protection using the last successfully consumed time step, plus per-user/per-client-IP failed-attempt throttling.

• Account-owner setup and management from the WordPress user profile; administrators may reset another user’s 2FA for recovery but cannot view or provision that user’s secret.

• Basic Web Application Firewall with Log Only and Enforce modes.

• Source-aware SQL injection, XSS, LFI/directory traversal, sensitive request-path and malicious scanner User-Agent rules.

• Editable one-pattern-per-line User-Agent and suspicious-request lists with current-default restoration and non-destructive migration of earlier additional patterns.

• Manual IPv4/IPv6 IP/CIDR allow and block rules using the centralized Client IP resolver.

• Narrow WordPress classic editor, block editor, comment and WordPress 7.1 media field exemptions that do not create a broad authenticated/admin/REST bypass.

• Grouped local WAF Log with 30-day default retention, a 10,000-row hard cap, search, pagination and configurable display columns.

• WAF Log stores rule metadata, short evidence labels and redacted request targets including query strings; DB-IP country enrichment is added when a local database is installed.

• Optional, off-by-default redacted samples of the original field that triggered a detection, up to 16 KiB, with a configurable Payload display column and display-only Default Settings restoration.

• Configurable observation-only logging for excessive request rates, failed authentication, password-reset requests and unique-path 404 reconnaissance. These Free monitors never block requests or IP addresses, even in Enforce mode.

• Short-lived keyed-hash counters in a separate Free/Core table, with bounded grouped WAF Log updates at every completed threshold batch and per-feature handoff only while a compatible add-on actively replaces that monitor. The settings page shows only monitors still owned by Free/Core.

• Uninstall setting to keep the Free/Core WAF Log as a Unix-timestamp-suffixed database archive instead of deleting it; complete deletion remains the default.

• Extensible Free/Core WAF rule registry for later Pro rules without a duplicate WAF engine.

• Central Client IP resolver shared by security modules.

• REMOTE_ADDR trust anchor with opt-in trusted proxy detection.

• Verified Cloudflare CF-Connecting-IP handling and right-to-left X-Forwarded-For trust-chain evaluation.

• IPv4/IPv6 address and CIDR support with additional administrator-defined trusted proxy ranges.

• Background Cloudflare IPv4/IPv6 range refresh with bundled fallback ranges and no remote lookup during normal requests.

• Dedicated Network admin page for client-IP detection and trusted proxy configuration.

• GeoIP admin page with secure DB-IP Lite Country.mmdb upload, replacement and removal.

• Staged DB-IP validation before replacement, including MMDB type and country lookup self-tests.

• Local DB-IP Lite Country lookup is the only built-in provider; compatible add-ons can register another local provider through the shared fallback-aware GeoIP engine.

• Request-local GeoIP cache plus external persistent object-cache support without creating per-IP WordPress transients.

• Security Headers with Runtime and Apache/LiteSpeed Cache Compatibility delivery.

• X-Content-Type-Options, optional X-Frame-Options, Referrer-Policy, optional HSTS and Permissions-Policy.

• Structured front-end Content Security Policy.

• Report Only and Enforce CSP modes.

• WordPress 7.1 compatible worker-src support that retains blob: for client-side media processing.

• Local same-site CSP report endpoint with exact site-host validation.

• CSP report request-size and batch limits.

• Atomic database-backed CSP report rate limiting.

• Grouped local CSP Log with retention and a maximum of 200 grouped entries.

• Security-focused CSP logging stores the client IP address and User-Agent locally while discarding URL query strings, fragments and credentials.

• Guided CSP source review from clickable Blocked URI values, with a nonce-protected modal and global allowances for network origins and other valid CSP source expressions.

• Frame-ancestors violations use best-effort short-lived iframe request correlation: the protected site origin is shown as Blocked URI, the observed embedding origin is shown as Source, and a correlated HTTP(S) origin can be manually added to frame-ancestors after an explicit security warning.

• Optional CSP Log email notifications checked hourly through one shared Rapid Security Manager WordPress Cron event; existing log history is baselined when notifications are enabled, so only later new or updated browser reports are summarized.

• CSP notification emails use the Free/Core plain-text mail service, default to the WordPress administrator email address, and intentionally omit client IP addresses, User-Agent values and raw CSP report payloads.

• The Free CSP Log displays the latest reporting client IP stored for each grouped entry. No Pro add-on or license is required, and add-on display preferences cannot hide this Core column.

• WordPress Hardening with opt-in XML-RPC, REST user enumeration, author-query enumeration, generator output and file-editor protections.

• Grouped Basic Diagnostics with OK, Warning, Issue and Info states, system summary, navigation links and a sanitized support report.

• Public add-on API used by the separate Rapid Security Manager Pro plugin.

1 Document-Isolation-Policy headers on editor screens.

Privacy and local data

Rapid Security Manager is designed to process security data on the WordPress installation:

• WAF and CSP logs are stored locally with bounded retention and storage limits.

• WAF logging stores normalized security metadata, short evidence labels and pre-redacted request targets. Optional triggered-field payload samples are disabled by default, limited to 16 KiB and stored only after known credential redaction. No complete request, uploaded file content or opaque raw body is recorded.

• Free observation-only WAF thresholds use automatically expiring keyed-hash counters for client, account and path grouping. The counter table does not store plaintext IP addresses, account names or request paths; threshold events written to the normal WAF Log follow its existing retention and local-data rules.

• CSP logging discards URL credentials, query strings and fragments before storage.

• CSP notification emails omit client IP addresses, User-Agent values and raw report payloads.

• TOTP secrets are stored using authenticated encryption. Recovery codes and trusted-device tokens are stored only in hashed form.

• GeoIP lookups use an administrator-uploaded local database. Rapid Security Manager does not submit visitor IP addresses to an online GeoIP service.

• Rapid Security Manager contains no telemetry or tracking code.

Site administrators remain responsible for selecting appropriate log retention, access controls, privacy notices and legal bases for their jurisdiction.

External services

com/ips-v6. This is used only to verify whether a direct peer is a genuine Cloudflare proxy before trusting the CF-Connecting-IP header.

The scheduled download is enabled only when trusted proxy detection and Cloudflare support are both enabled. The request exposes the site’s outbound connection IP address and sends a Rapid Security Manager/WordPress User-Agent containing the plugin version. It does not send visitor IP addresses, site content, credentials, cookies or Rapid Security Manager logs.

If the service is unavailable or returns invalid data, Rapid Security Manager keeps using its bundled fallback ranges.

Cloudflare provides this service under its Website Terms and Privacy Policy.

Third-party resources

0. It does not include a MaxMind or DB-IP GeoIP database. txt.