007AJ Security Scanner & Firewall — Documentation

Guide to installing and using the free 007AJ Security Scanner & Firewall plugin for WordPress (version 0.1.2).

1. Installation

Requirements: WordPress 6.3 or newer and PHP 7.4 or newer.

1. In WordPress go to Plugins → Add New and search for the plugin, or choose Upload Plugin and select the 007aj-security-scanner-firewall zip. You can also upload the 007aj-security-scanner-firewall folder to /wp-content/plugins/.
2. Click Activate. A 007AJ Security menu appears with Dashboard, Settings, Integrity scan and Activity log.
3. Open 007AJ Security → Settings, turn on the features you want and save.
4. Open 007AJ Security → Integrity scan and click Run scan now for a first check of your core files.

2. Settings overview

Every feature is off after activation. On 007AJ Security → Settings you can turn on, one by one: login lockout, the firewall (with its XML-RPC switch and login rate limit), the hardening switches and the activity log. The screen also shows the IP address the server sees for you; see how IP addresses are read.

3. Login lockout

• Failed logins are counted per IP address. After a set number of failures (default 5 in 15 minutes) the address is locked out for a set time (default 30 minutes).
• It applies to every login that goes through WordPress: the login form, XML-RPC and application passwords. A locked-out address cannot log in even with the right password.
• The login form shows how long the lockout lasts. A successful login resets the counter.
• Locked-out addresses are listed on the Dashboard with an Unlock button.
• Optional email to the site admin address when a lockout happens (at most one email every 15 minutes).

4. Firewall (lite)

• Checks the page address, the query string (names and values) and the names of submitted form fields for obvious probes: SQL injection (for example UNION SELECT, ' OR '1'='1, SLEEP(), script injection (<script>, event handlers, javascript: links) and path traversal (../, /etc/passwd, php://). Matching requests get a 403 page.
• Logged-in administrators and editors are not checked, so writing posts that contain HTML or code keeps working. Submitted form values (comments, contact forms) are not checked either, to avoid false alarms.
• Optional switch to turn off XML-RPC completely (also removes the pingback header and turns off pingbacks).
• Optional limit on form submissions to wp-login.php per IP address (default 20 in 5 minutes); extra requests get a 429 answer.

5. Integrity scan

On 007AJ Security → Integrity scan, Run scan now downloads the official checksums for your WordPress version from WordPress.org and compares every core file on your server with them. The result lists:

• Modified core files (contents differ from the official file),
• Missing core files,
• Unknown files in wp-admin, wp-includes and the site root that are not part of WordPress.

The scan only reports. The plugin never changes or deletes files. Plugins, themes and uploads are not scanned. To restore core files, use Dashboard → Updates → Re-install. Scans run only when you click the button; there are no scheduled scans.

6. Hardening switches

• File editors: turns off the theme and plugin file editors (sets DISALLOW_FILE_EDIT unless wp-config.php already sets it).
• Username discovery: for visitors who are not logged in, ?author=N requests go to the home page, the REST users endpoint answers 401, and the users sitemap is removed.
• Version tag: hides the WordPress generator tag (cosmetic).
• Application passwords: turns them off.

7. Activity log and Dashboard

When the activity log is on, it records logins, failed logins, lockouts, firewall blocks, rate-limit hits, blocked username discovery, scans and setting changes, with the time, IP address and username. Only the newest 500 entries are kept. Filter by event, or clear the log with one click.

The Dashboard shows today’s lockouts, failed logins and blocked requests, the last scan result, the hardening switches and the log size.

8. How IP addresses are read

The plugin reads the visitor address from REMOTE_ADDR only. Forwarded headers such as X-Forwarded-For can be forged by the visitor and are never trusted. If your site is behind a proxy or CDN that does not pass the real visitor address to PHP, every visitor may appear to have the same address, and lockouts or limits would then affect everyone. The Settings screen shows the address the server sees for you; check it before turning on lockouts, limits or blocks. Ask your host to restore the real visitor address at the server level if needed.

9. Privacy and personal data

Depending on the features you turn on, the plugin stores on your server:

• Activity log: time, event type, IP address, the username entered or used, the user ID of a logged-in user, and a short detail (for example the rule that matched and the page address requested). Newest 500 entries.
• Login lockout: for each locked-out address, the IP address, the last username tried, the number of failed attempts and the lockout end time, removed when the lockout ends. Counters are stored as temporary values keyed by a one-way hash of the IP address and expire on their own.
• Lockout emails (if on) go to the site admin address and contain the IP address and last username tried.
• Integrity scan: the last result (lists of file names), with no personal data.
• Daily counters for the Dashboard (numbers only).

The plugin adds suggested text to Settings → Privacy and registers a personal data exporter and eraser (Tools → Export Personal Data / Erase Personal Data). They find activity log entries by the person’s user ID, username or email address.

10. External services

The plugin connects to one external service, and only when an administrator asks it to.

Provider: WordPress.org — Terms of use, Privacy policy.

No other outbound requests are made and nothing is sent to 007AJ. The plugin row on the Plugins screen and one dismissible notice on the plugin’s Dashboard contain a plain link to this site; nothing is loaded from it and nothing is sent unless you click it.

11. Deactivating, uninstalling and deleting data

• Deactivating stops all protection and removes current lockouts. Settings and the log are kept.
• Deleting the plugin keeps settings and the log by default, so a reinstall picks up where you left off.
• To remove everything, tick Delete all plugin data when the plugin is deleted in Settings and save before deleting the plugin. Deleting then drops the log table and removes all of the plugin’s options and temporary counters.

12. Common questions

I locked myself out. What now?

Wait until the lockout ends, or log in from a different network. With file access (FTP or your host’s file manager) you can rename the plugin folder in wp-content/plugins/ to turn it off. Deactivating the plugin removes all current lockouts.

Will the firewall break my site?

It skips logged-in administrators and editors, does not look at submitted form values, and only matches obvious attack patterns. If a visitor is blocked by mistake, the activity log shows the rule; you can turn the firewall off in Settings.

Does this plugin remove malware?

No. The integrity scan tells you which WordPress core files were changed, removed or added.

Is there another version?

007AJ Security Scanner & Firewall Suite is a separate, standalone plugin. If both are active, this plugin pauses itself and shows a notice; nothing in this plugin is disabled, limited or time-limited otherwise.

Multisite?

Not tested on multisite. Activate it per site.

13. Support

Email admin@007aj.com. Please include the plugin version (shown under Plugins), your WordPress and PHP versions, and what you expected to happen. Never send passwords.

← Back to 007AJ Security Scanner & Firewall

© 007AJ Security & Analytics · Home · Terms · Privacy