Loyal Security – Firewall & Malware Scanner Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Loyal Security – Firewall & Malware Scanner is an all-in-one WordPress security suite: a dual-mode web application
firewall, malware scanner with file integrity monitoring, server hardening, two-factor
authentication, backups, and audit logging — in a single self-contained plugin.
Every protection runs on your own server with the rules bundled in the plugin. No Node.js, no
build step: the admin dashboard is a React app powered by WordPress core’s own bundled
wp-element, and every PHP class is loaded by a built-in autoloader. Install it, activate it,
and it works. A small number of features use outside services; each one is listed under
“External services” below, with what it sends and how to switch it off.
Everything in this plugin is free and fully functional — nothing is locked, limited or
time-restricted. Loyal Security Pro is a separate plugin, sold and downloaded from our
website, that adds automation and agency tools on top.
Features
- Web Application Firewall — Optimized Mode (runs before WordPress even loads, via a
lightweight prepend) or Standard Mode (runs inside WordPress). Blocks SQL injection, XSS,
LFI/RFI, path traversal, and RCE. - Rate limiting, brute-force protection & DDoS shielding — plus a bad-bot blocker and
country-level geo-blocking that works with or without a CDN (bundled IP-to-country data,
no outside lookups). - Virtual patching — shields known-vulnerable third-party plugins/themes until you’re
able to update them. - Deep system hardening — .htaccess/Nginx rule generation, wp-config hardening,
directory-browsing lockdown, REST API & XML-RPC restriction, version obfuscation. - Malware scanner — heuristic regex + token-based detection engine, on-demand full-site
scans, and a weekly automatic scan. - File integrity monitoring — WordPress.org checksum verification for core and plugins,
plus baseline diffing for everything else, including themes, mu-plugins and drop-ins. - Database scanner — checks posts, page-builder content, category descriptions, comments,
options, user meta and code-snippet plugins for injected scripts (including scripts loaded
from outside hosts), spam links, a hijacked site address and rogue admin accounts. - Incident response — safe quarantine, one-click clean-file recovery, and file-permission
reset. - Backup & restore — on-demand and scheduled full-site backups (files + database), plus a
downloadable recovery tool you can upload to restore a backup even if WordPress itself won’t
load. - Two-factor authentication — TOTP with QR enrollment and backup codes, passkeys, login
CAPTCHA, password policy, breached-password checking, and active-session management. - Audit log — full event trail with IP/user/proxy tracking, configurable retention
(90 days by default), and CSV export. - Email notifications — alerts with human-readable event guidance, throttling, quiet
hours and per-event muting. - Live Traffic monitor — real-time request feed with user-agent classification, filters,
and one-click block/unblock. - Content Security Policy manager — builds a policy from the resources your site
actually loads, with a report-only mode. - Admin-bar Security Score — an at-a-glance A–F health grade.
- Inline vulnerability notices — flags installed plugins/themes with known CVEs directly
on the Plugins, Themes, and Updates screens. - WP-CLI support —
wp loyal-security status | scan | firewall | backup | twofa.
Loyal Security Pro
Loyal Security Pro is a separate plugin for people running security across many sites. It is
not needed for anything listed above. It adds:
- Hourly threat-intelligence updates — the same feed, delivered every hour instead of twice
a day. - Under Attack Mode — a one-click emergency shield with automatic expiry.
- Faster scheduled scans & auto-quarantine — daily or twice-daily scans, and infected files
isolated the moment they are found. - Sentinel AI — AI-assisted review of suspicious activity with reversible responses.
- Threat hunting, uptime monitoring and compliance reports.
- Webhook, PagerDuty and OpsGenie alerts, and Cloudflare edge sync.
- WooCommerce-aware backups and staging restores.
- Agency tooling — white-label dashboard, role management, and multi-site hub.
External services
Loyal Security connects to the services below. Nothing else is contacted, and no request
carries your site’s URL, your visitors’ personal data, or your content unless stated here.
Requests the plugin makes identify themselves as LoyalSecurity/<version> instead of
WordPress’s default user agent (which includes the site’s URL).
Loyal Security threat-intelligence service (licensekit.loyalsecuritywp.com)
Our own service, used for:
- Threat-intelligence feed (on by default). Keeps the firewall rules, malware signatures,
virtual patches and the vulnerability (CVE) database up to date. Twice a day, and when you
click “Sync now”, the plugin requests each dataset and sends: the dataset name, the version
it already has, the feed channel (“free”, or “pro” with the separate Pro plugin), the
subscription key if Pro stored one, and — for the vulnerability dataset only — the slugs (folder names) of the
installed plugins and themes, so only advisories that concern them are returned. Switch
automatic updates off with Settings Threat Intelligence “Auto Sync”, or turn the module
off with “Enabled”; the plugin then keeps using the rules it already has. - Pricing on the “About Pro” screen. Opening that screen fetches the public plan list. No
site data is sent. - Connection test. Only when you click “Test connection” on the Threat Intelligence
screen: sends a timestamp, an anonymous install ID and, if present, a hash of the
subscription key. - Firewall-bypass reports and virtual-patch suggestions (off by default). Only after an
administrator gives explicit consent (Loyal Security Bypass Telemetry in the Advanced view,
where it can be withdrawn at any time): when an attack appears to have got past the firewall, the plugin
sends the attacker’s request (method, path, parameters, IP address and country), the matching
rule names, the plugin/WordPress/PHP versions (major.minor) and an anonymous install ID —
with cookies, authorization headers and nonces removed. With the same consent, a virtual
patch you approve can be shared as a rule suggestion.
Terms of use: https://loyalsecuritywp.com/terms.html — Privacy policy: https://loyalsecuritywp.com/privacy.html
Have I Been Pwned — Pwned Passwords (api.pwnedpasswords.com)
On by default. When a user logs in, the plugin checks whether the password appears in known
data breaches, using k-anonymity: only the first five characters of the password’s SHA-1 hash
are sent — never the password, the username or the email address. It never blocks a login; the
user sees a warning. Switch it off with Settings Identity & Access “Breach Check”.
Terms of use: https://haveibeenpwned.com/TermsOfUse — Privacy policy: https://haveibeenpwned.com/Privacy
Cloudflare Turnstile (challenges.cloudflare.com)
Only if you choose Turnstile as the login CAPTCHA and enter your keys. The Turnstile script
loads on the login form, and on submission the visitor’s CAPTCHA token and IP address are sent
to Cloudflare to verify it.
Terms of use: https://www.cloudflare.com/website-terms/ — Privacy policy: https://www.cloudflare.com/privacypolicy/ — Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/
Google reCAPTCHA (www.google.com)
Only if you choose reCAPTCHA v3 as the login CAPTCHA and enter your keys. The reCAPTCHA script
loads on the login form, and on submission the visitor’s CAPTCHA token and IP address are sent
to Google to verify it.
Terms of service: https://policies.google.com/terms — Privacy policy: https://policies.google.com/privacy
Google Safe Browsing (safebrowsing.googleapis.com)
Only if you enter your own Safe Browsing API key (Settings Hardening). The plugin then sends
your site’s home URL to check whether Google has flagged it. Nothing is sent without a key.
Terms of service: https://developers.google.com/terms — Privacy policy: https://policies.google.com/privacy
WordPress.org (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org)
File integrity checks download the official checksums of WordPress core and of the installed
WordPress.org plugins (plugin slug and version). When you choose to repair or reinstall, the
official WordPress core or plugin package, or a single core file, is downloaded. These are the
same public services WordPress uses for updates.
File Integrity Monitoring is on by default and its check also runs on a weekly schedule, so
these checksums are fetched automatically as well as when you start a check yourself. Switch
the automatic run off in Settings File Integrity Monitoring (the scheduled check, or the
whole module).
Privacy policy: https://wordpress.org/about/privacy/ — WordPress.org does not publish a separate
terms of service for these endpoints; they are the same public APIs WordPress core itself uses,
and the software is governed by the GPL: https://wordpress.org/about/license/
Stylesheets your pages already load (CSP scanner)
Only when an administrator clicks “Scan” on the Content Security Policy screen. To suggest
which domains your policy should allow, the scanner loads a few of your own pages and the
external stylesheets those pages already use (for example a Google Fonts or CDN stylesheet),
with a plain request that carries no site data. Those providers’ own terms apply to those
files, exactly as when a visitor loads your site.
DNS (your server’s resolver)
To confirm that a visitor claiming to be a search-engine crawler (Googlebot, Bingbot…) really
is one, the plugin performs a reverse and forward DNS lookup of that visitor’s IP address
through your server’s normal DNS resolver. The result is cached.
Screenshots
Dashboard overview with the admin-bar Security Score and at-a-glance module status.
Firewall panel — web application firewall, sign-in lockout, bot management and active virtual patches.
Malware scanner — findings list with one-click quarantine and repair.
Live Traffic monitor — real-time request feed with user-agent classification.
