About this plugin
ArmorPro protects WordPress with a full security stack that runs before your site does. Every feature is free and unlimited. There is no premium tier, no locked panels, and no upgrade prompts.
Attacks get blocked at the PHP engine level, roughly a millisecond into the request, before WordPress loads a single file.
Features
- WAF Engine — Runs before WordPress loads via PHP’s auto_prepend_file, adding roughly 1ms of overhead. Blocks malicious requests at the PHP engine level before any WordPress code executes. Detects and configures Apache, NGINX, and LiteSpeed automatically, and falls back to the standard firewall when enhanced mode is unavailable. Enable it from the Firewall tab with one click.
- Firewall — 600+ built-in patterns covering SQL injection, XSS, path traversal, and shell access, matched across five categories (Request URI, Query String, User Agent, Referrer, IP Address) in three modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggles, hit counts, and your own custom patterns. Pure PHP, so it works on any server without.htaccess.
- Brute Force Protection — Session-based login tracking with automatic lockouts after a configurable number of failures. Repeat offenders can be auto-blacklisted with an optional expiry. Login activity log records IP, country, status, and the usernames tried.
- Two-Factor Authentication — TOTP for Google Authenticator, Authy, 1Password, and any compatible app. QR code setup, ten backup recovery codes, and role-based enforcement with a grace period.
- Passkey Authentication — Passwordless login with Face ID, Touch ID, Windows Hello, or a hardware security key (WebAuthn/FIDO2). Multiple passkeys per user with friendly names and clone detection.
- Bot Protection — Honeypot fields, timestamp validation, and JavaScript token verification on login, registration, and password reset forms. Bots are stopped before they can attempt a single password.
- Access Control — IP whitelist and blacklist with inline notes. Country blocking in allow or block mode, backed by a locally stored DB-IP country database.
- Custom Login URL — Move wp-login.php to any slug you choose. The default login returns a 404.
- Security Headers — Seven managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection, HSTS, Content-Security-Policy, Permissions-Policy) delivered via PHP and optionally.htaccess, with a header probe that avoids duplicating what your server already sends.
- Email Notifications — Daily and weekly security digests, plus event alerts for lockouts, blacklistings, and administrator logins.
- Privacy Hardening — Author slug randomization to stop user enumeration, and email obfuscation to keep addresses away from scrapers. XML-RPC and REST API protection included.
- Dashboard — Real-time stats, a blocks-over-time chart, protection status cards, and a WordPress dashboard widget.
- Tools — Health checks with database integrity verification, one-click table repair, settings export and import, CSV log export, and debug mode.
Privacy by default
Visitor IP addresses never leave your server. Geolocation is resolved against a DB-IP country database stored locally on your own site, not by calling a third-party lookup API. ArmorPro collects no usage statistics and has no license key.
See External Services for the detail.
External Services
ArmorPro makes the outbound requests below. Visitor IP addresses are never sent to any external service.
Country Database Download (DB-IP)
To show the country for logged IPs and to power country blocking, ArmorPro downloads DB-IP’s free “IP to Country Lite” database straight from DB-IP and stores it on your server. All lookups then happen locally.
- When: once shortly after activation, via WP-Cron, then checked weekly and downloaded again when DB-IP publishes its monthly update
- Data sent: nothing beyond a standard file download request
- Service: https://download.db-ip.com, run by DB-IP (https://db-ip.com)
- Database license: Creative Commons Attribution 4.0 (https://creativecommons.org/licenses/by/4.0/)
- DB-IP terms: https://db-ip.com/db/lite.php
Individual IP addresses are never sent to this or any other service.
Update Checks (direct download from srworks.co only)
co checks for new versions itself. org handles its updates.
- When: whenever WordPress checks for plugin updates
- Data sent: nothing beyond a standard request for the update information and, when you update, the plugin file
- Service: https://api.srworks.co
- Terms: https://srworks.co/terms, Privacy: https://srworks.co/privacy
ArmorPro sends no usage statistics and has no license check.
Privacy Policy
ArmorPro stores the following in your WordPress database:
- IP addresses of visitors who trigger a security rule or attempt to log in
- Timestamps of security events
- Usernames used in login attempts
- Country codes resolved locally from the DB-IP country database
Clear all logs at any time from the Tools tab. Log retention is 90 days and old entries are pruned daily. ini directives ArmorPro added.
Visitor IP addresses are never transmitted off your server.
Support
co/contact
Credits
com), used under GPLv2.
org), MIT License.
org), MIT License.
de/jquery-qrcode/), MIT License.
0.