Dwarpal Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Dwarpal (Dwarpal WP Security Plugin) protects your WordPress site from common threats, including:
- Firewall Protection – Automatically blocks malicious requests containing SQL injection, XSS, code injection, and directory traversal attempts
- Login Security – Protects against brute force attacks by limiting login attempts and locking out suspicious IP addresses
- SEO Hack Protection – Detects Thai/gambling spam, wp-config injectors, and bot cloaking via local User-Agent comparison (no Google scraping)
- Bot View Scanner – Compares browser vs search-bot responses on your own site; scans wp-config.php and index.php for known malware signatures
- Critical Options Monitor – Alerts when key WordPress settings (site URL, admin email, registration) are changed—catches takeover and redirect hacks
- Outbound Request Monitor – Logs outbound HTTP requests from your site to detect backdoors and data exfiltration
- Security Logging – Comprehensive audit log of all security events for monitoring and analysis
- WordPress Hardening – Removes WordPress version information, disables XML-RPC, and implements other security best practices
- Malware Scanning – Scans files for malware and suspicious patterns
- File Integrity Monitoring – Monitors core files for unauthorized changes
- Two-Factor Authentication – Adds an extra layer of security to login
- IP Blocking & Whitelisting – Block malicious IPs and whitelist trusted ones
- Live Traffic Monitoring – Real-time monitoring of website traffic
- Vulnerability Scanner – Checks for known vulnerabilities in WordPress core, plugins, and themes
- Threat Defense – Opt-in signature feed, virtual patches, auto-block reputation, and security digests
- OWASP Coverage Report – Maps enabled controls to OWASP Top 10 categories
Features
Firewall
- Real-time request scanning
- Pattern-based threat detection
- Automatic blocking of malicious requests
- Configurable firewall rules
Login Security
- Failed login attempt tracking
- IP-based lockout system
- Configurable attempt limits
- Customizable lockout duration
Security Logging
- Complete audit trail
- Event type categorization
- IP address tracking
- Request URI logging
- User agent recording
WordPress Hardening
- WordPress version hiding
- XML-RPC disabling
- RSD link removal
- File editing protection
External services
This plugin can optionally connect to third-party services only when you enable the related feature in the plugin settings. Features that call external services are off by default unless noted.
Google Safe Browsing / Transparency Report (blocklist monitoring)
- What it is: A Google page used to check whether your domain appears to be flagged for unsafe browsing.
- When it is called: Only when Blocklist Monitoring is enabled (disabled by default; requires opt-in).
- What data is sent: Your site domain (host) is sent as part of the request URL.
- Why: To help you identify if your domain may be flagged and needs remediation.
- Service provider: Google.
- Terms:
https://policies.google.com/terms - Privacy:
https://policies.google.com/privacy
ip-api.com (GeoIP country lookup)
- What it is: A GeoIP service used to map an IP address to a country code.
- When it is called: Only when Geo-blocking is enabled.
- What data is sent: The visitor IP address is sent to
ip-api.comto determine the country code. - Why: To enforce country-based access restrictions when you enable geo-blocking.
- Service provider: ip-api.com.
- Terms:
https://ip-api.com/docs/legal - Privacy:
https://ip-api.com/docs/legal
Bot View Scanner (local cloaking detection)
- What it is: A local scan that requests your own site URLs with different User-Agent headers (normal browser vs search bot) to detect cloaking.
- When it is called: Only when you click Run Bot View Scan or enable Daily Bot View Scan in SEO Protection settings.
- What data is sent: HTTP requests are made to your own site (
home_url()). No data is sent to Google or third-party search engines. - Why: To detect SEO cloaking and wp-config/index.php injection patterns seen in real server compromises.
- External link: Google Search Console is linked for manual verification only (opens in your browser; the plugin does not scrape Google).
WordPress.org API (vulnerability scanner)
- What it is: Official WordPress.org endpoints for core/plugin version data.
- When it is called: When you run the vulnerability scanner.
- What data is sent: Plugin slugs and WordPress version identifiers (standard update API usage).
- Service provider: WordPress.org.
- Terms:
https://wordpress.org/about/gpl/ - Privacy:
https://wordpress.org/about/privacy/
Optional signature feed (Threat Defense)
- What it is: JSON feed of firewall, malware, and virtual-patch signatures.
- When it is called: Only when Signature feed sync is enabled. If no URL is set, the plugin refreshes from its bundled
data/signatures.json. If you set a remote URL, that URL is fetched daily (or on demand). - What data is sent: A normal HTTPS GET to your configured feed URL. No site visitor data is included.
- Why: To keep detection rules updatable without waiting for a full plugin release.
- Important: Leave disabled (default) if you do not want outbound feed requests.
Optional IP reputation lookup (Threat Defense)
- What it is: An optional JSON reputation endpoint you configure yourself.
- When it is called: Only when local auto-block and remote reputation lookup are both enabled and a reputation URL is set.
- What data is sent: The visitor IP address as a query parameter.
- Expected response: JSON such as
{"block":true,"score":90}. - Important: Disabled by default. Do not enable unless you understand and trust the endpoint you configure.
WordPress.org compliance (storage)
Database exports and plugin-generated files are stored only under:
wp-content/uploads/dwarpal/
This plugin does not:
– Copy or modify wp-config.php
– Write .htaccess to wp-content/ or WordPress core directories
– Define DISALLOW_FILE_EDIT globally (file editor is disabled via a setting + capability filter)
– Call remote files for CSS/JS/images (all assets are bundled)
Screenshots
No screenshots provided
