Loyal Security – Firewall & Malware Scanner is an all-in-one WordPress security suite: a dual-mode web application firewall, malware scanner with file integrity monitoring, server hardening, two-factor authentication, backups, and audit logging — in a single self-contained plugin. Every protection r
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.6 and PHP 8.0.
SourceWordPress plugins · Nov 7, 2026
01 / Source details
Aboutthistool.
Loyal Security – Firewall & Malware Scanner is an all-in-one WordPress security suite: a dual-mode web application firewall, malware scanner with file integrity monitoring, server hardening, two-factor authentication, backups, and audit logging — in a single self-contained plugin.
Every protection runs on your own server with the rules bundled in the plugin. No Node.js, no build step: the admin dashboard is a React app powered by WordPress core’s own bundled wp-element, and every PHP class is loaded by a built-in autoloader. Install it, activate it, and it works. A small number of features use outside services; each one is listed under “External services” below, with what it sends and how to switch it off.
Everything in this plugin is free and fully functional — nothing is locked, limited or time-restricted. Loyal Security Pro is a separate plugin, sold and downloaded from our website, that adds automation and agency tools on top.
Features
Web Application Firewall — Optimized Mode (runs before WordPress even loads, via a lightweight prepend) or Standard Mode (runs inside WordPress). Blocks SQL injection, XSS, LFI/RFI, path traversal, and RCE.
Rate limiting, brute-force protection & DDoS shielding — plus a bad-bot blocker and country-level geo-blocking that works with or without a CDN (bundled IP-to-country data, no outside lookups).
Virtual patching — shields known-vulnerable third-party plugins/themes until you’re able to update them.
Deep system hardening — .htaccess/Nginx rule generation, wp-config hardening, directory-browsing lockdown, REST API & XML-RPC restriction, version obfuscation.
Malware scanner — heuristic regex + token-based detection engine, on-demand full-site scans, and a weekly automatic scan.
File integrity monitoring — WordPress.org checksum verification for core and plugins, plus baseline diffing for everything else, including themes, mu-plugins and drop-ins.
Database scanner — checks posts, page-builder content, category descriptions, comments, options, user meta and code-snippet plugins for injected scripts (including scripts loaded from outside hosts), spam links, a hijacked site address and rogue admin accounts.
Backup & restore — on-demand and scheduled full-site backups (files + database), plus a downloadable recovery tool you can upload to restore a backup even if WordPress itself won’t load.
Two-factor authentication — TOTP with QR enrollment and backup codes, passkeys, login CAPTCHA, password policy, breached-password checking, and active-session management.
Audit log — full event trail with IP/user/proxy tracking, configurable retention (90 days by default), and CSV export.
Email notifications — alerts with human-readable event guidance, throttling, quiet hours and per-event muting.
Live Traffic monitor — real-time request feed with user-agent classification, filters, and one-click block/unblock.
Content Security Policy manager — builds a policy from the resources your site actually loads, with a report-only mode.
Admin-bar Security Score — an at-a-glance A–F health grade.
Inline vulnerability notices — flags installed plugins/themes with known CVEs directly on the Plugins, Themes, and Updates screens.
WP-CLI support — wp loyal-security status | scan | firewall | backup | twofa .
Loyal Security Pro
Loyal Security Pro is a separate plugin for people running security across many sites. It is not needed for anything listed above. It adds:
Hourly threat-intelligence updates , plus extra firewall and malware rules published for Pro sites.
Under Attack Mode — a one-click emergency shield with automatic expiry.
Faster scheduled scans & auto-quarantine — daily or twice-daily scans, and infected files isolated the moment they are found.
Sentinel AI — AI-assisted review of suspicious activity with reversible responses.
Threat hunting, uptime monitoring and compliance reports.
Webhook, PagerDuty and OpsGenie alerts, and Cloudflare edge sync.
WooCommerce-aware backups and staging restores.
Agency tooling — white-label dashboard, role management, and multi-site hub.
External services
Loyal Security connects to the services below. Nothing else is contacted, and no request carries your site’s URL, your visitors’ personal data, or your content unless stated here. Requests the plugin makes identify themselves as LoyalSecurity/<version> instead of WordPress’s default user agent (which includes the site’s URL).
Loyal Security threat-intelligence service (licensekit.loyalsecuritywp.com)
Our own service, used for:
Threat-intelligence feed (on by default). Keeps the vulnerability (CVE) database up to date, and delivers new firewall rules, malware signatures and virtual patches whenever we publish them. Twice a day, and when you click “Sync now”, the plugin requests each dataset and sends: the dataset name, the version it already has, the feed channel (“free”, or “pro” with the separate Pro plugin), the subscription key if Pro stored one, and — for the vulnerability dataset only — the slugs (folder names) of the installed plugins and themes, so only advisories that concern them are returned. Switch automatic updates off with Settings → Threat Intelligence → “Auto Sync”, or turn the module off with “Enabled”; the plugin then keeps using the rules it already has.
Pricing on the “About Pro” screen. Opening that screen fetches the public plan list. No site data is sent.
Connection test. Only when you click “Test connection” on the Threat Intelligence screen: sends a timestamp, an anonymous install ID and, if present, a hash of the subscription key.
Firewall-bypass reports and virtual-patch suggestions (off by default). Only after an administrator gives explicit consent (Loyal Security → Bypass Telemetry in the Advanced view, where it can be withdrawn at any time): when an attack appears to have got past the firewall, the plugin sends the attacker’s request (method, path, parameters, IP address and country), the matching rule names, the plugin/WordPress/PHP versions (major.minor) and an anonymous install ID — with cookies, authorization headers and nonces removed. With the same consent, a virtual patch you approve can be shared as a rule suggestion.
Terms of use: https://loyalsecuritywp.com/terms.html — Privacy policy: https://loyalsecuritywp.com/privacy.html
Have I Been Pwned — Pwned Passwords (api.pwnedpasswords.com)
On by default. When a user logs in, the plugin checks whether the password appears in known data breaches, using k-anonymity: only the first five characters of the password’s SHA-1 hash are sent — never the password, the username or the email address. It never blocks a login; the user sees a warning. Switch it off with Settings → Identity & Access → “Breach Check”.
Terms of use: https://haveibeenpwned.com/TermsOfUse — Privacy policy: https://haveibeenpwned.com/Privacy
Cloudflare Turnstile (challenges.cloudflare.com)
Only if you choose Turnstile as the login CAPTCHA and enter your keys. The Turnstile script loads on the login form, and on submission the visitor’s CAPTCHA token and IP address are sent to Cloudflare to verify it.
Only if you choose reCAPTCHA v3 as the login CAPTCHA and enter your keys. The reCAPTCHA script loads on the login form, and on submission the visitor’s CAPTCHA token and IP address are sent to Google to verify it.
Terms of service: https://policies.google.com/terms — Privacy policy: https://policies.google.com/privacy
Google Safe Browsing (safebrowsing.googleapis.com)
Only if you enter your own Safe Browsing API key (Settings → Hardening). The plugin then sends your site’s home URL to check whether Google has flagged it. Nothing is sent without a key.
Terms of service: https://developers.google.com/terms — Privacy policy: https://policies.google.com/privacy
File integrity checks download the official checksums of WordPress core and of the installed WordPress.org plugins (plugin slug and version). When you choose to repair or reinstall, the official WordPress core or plugin package, or a single core file, is downloaded. These are the same public services WordPress uses for updates.
File Integrity Monitoring is on by default and its check also runs on a weekly schedule, so these checksums are fetched automatically as well as when you start a check yourself. Switch the automatic run off in Settings → File Integrity Monitoring (the scheduled check, or the whole module).
Privacy policy: https://wordpress.org/about/privacy/ — WordPress.org does not publish a separate terms of service for these endpoints; they are the same public APIs WordPress core itself uses, and the software is governed by the GPL: https://wordpress.org/about/license/
Stylesheets your pages already load (CSP scanner)
Only when an administrator clicks “Scan” on the Content Security Policy screen. To suggest which domains your policy should allow, the scanner loads a few of your own pages and the external stylesheets those pages already use (for example a Google Fonts or CDN stylesheet), with a plain request that carries no site data. Those providers’ own terms apply to those files, exactly as when a visitor loads your site.
DNS (your server’s resolver)
To confirm that a visitor claiming to be a search-engine crawler (Googlebot, Bingbot…) really is one, the plugin performs a reverse and forward DNS lookup of that visitor’s IP address through your server’s normal DNS resolver. The result is cached.
See it in action
Screenshots & previews.
Dashboard overview with the admin-bar Security Score and at-a-glance module status.Firewall panel — web application firewall, sign-in lockout, bot management and active virtual patches.Malware scanner — findings list with one-click quarantine and repair.Live Traffic monitor — real-time request feed with user-agent classification.
02 / Source details
Gettingstarted.
01Upload the loyal-security folder to /wp-content/plugins/ , or install it directly from Plugins → Add New .
02Activate the plugin through the Plugins screen.
03Open Loyal Security in the admin menu and run the Setup Wizard — it deploys the firewall in the best mode for your hosting environment automatically.
04Review the defaults under Loyal Security → Settings , and enable two-factor authentication for every admin account.
Server requirements: PHP 8.0 or later. Optimized Mode (recommended) needs either auto_prepend_file support (mod_php/CGI) or a writable .user.ini (PHP-FPM). Where neither is available, the firewall automatically falls back to Standard Mode — no manual configuration required.
03 / Source details
Frequently asked questions.
Does this require Node.js or a build step?
No. The dashboard uses WordPress’s bundled React via ES modules, so there’s nothing to compile — and no Composer install either, since the plugin ships its own lightweight autoloader.
Does it work with both block and classic themes?
Yes. The dashboard lives entirely in wp-admin, so it’s completely independent of your active theme.
Will this slow down my site?
Optimized Mode runs the firewall before WordPress even loads, so malicious requests are blocked before the WordPress bootstrap, database connection, or plugin/theme loading happen. Standard Mode, used automatically when the prepend can’t be deployed, still runs as early as possible inside WordPress.
What happens if the firewall itself breaks?
The Optimized Mode prepend is written to fail open: if its configuration or any of its files are missing or unreadable, it does nothing rather than breaking the site. The Setup Wizard also self-tests the deployment and automatically rolls back if the test fails.
How do I switch Optimized Mode off by hand?
If your site does not load after a server or plugin change, open the .htaccess file (or .user.ini ) in your site’s root folder and delete the Loyal Security block: the lines between # BEGIN Loyal Security WAF and # END Loyal Security WAF in .htaccess , or the auto_prepend_file line that mentions Loyal Security in .user.ini . Leave the rest of the file alone. On .user.ini sites PHP can take up to five minutes to notice the change. Loyal Security puts Optimized Mode back by itself on the next visit. If you cannot edit the file, ask your host to do it.
Is anything in this plugin limited or locked?
No. Every feature in this plugin is complete and has no time, usage or licence limits. Loyal Security Pro is a separate plugin that adds its own features (listed above); installing it unlocks nothing in this one.
Which outside services does the plugin contact?
By default, three: our threat-intelligence feed (twice a day, to keep the vulnerability database current and deliver new firewall and scanner rules whenever we publish them), Have I Been Pwned’s Pwned Passwords range API (at login, k-anonymous), and WordPress.org’s own checksum service (with the weekly file-integrity check, the same service WordPress uses for updates). All three can be switched off in Settings. Everything else — CAPTCHA, Safe Browsing, bypass reports, the CSP scanner — is off until you enable it or click it. See “External services” above for exactly what each one sends.
Can I use this alongside another security plugin?
You can, but running two firewalls or two file scanners at once is generally redundant and can occasionally conflict (for example, both plugins trying to write competing rules to .htaccess). We recommend deactivating other firewall plugins before activating Loyal Security’s.
Can I bring my IP block and allow lists over from another security plugin?
Yes. If Wordfence, Sucuri Security or iThemes/Solid Security is or has been installed on the site, Loyal Security can read the IP block and allow lists those plugins stored in your own database, so you do not have to type them in again. It only ever reads, never writes to or changes the other plugin’s data, nothing is sent anywhere, and it runs only when an administrator starts it from the Firewall screen. Those product names are used here solely to identify whose stored lists are being read; Loyal Security is not affiliated with, endorsed by, or connected to any of them.
Where do I report a security vulnerability in the plugin itself?
Please report it privately rather than in the public support forum so it can be fixed before details become public.
What happens to my data if I delete the plugin?
By default, deleting Loyal Security keeps your security data (logs, scan history, settings) in the database in case you reinstall it. Any deployed server-level changes — the firewall prepend, .htaccess rules, wp-config markers — are always reverted on delete regardless. If you want a full data wipe instead, enable “Delete all data on uninstall” under Settings before removing the plugin.
Where does the country data come from?
Country rules use the visitor’s country from Cloudflare (when your site is behind Cloudflare) or from a trusted proxy you configured. Otherwise they look the address up in a table bundled with the plugin: IP Geolocation by DB-IP , “IP to Country Lite”, licensed under CC BY 4.0 and converted to a compact lookup format (details in data/geo/NOTICE.txt ). The table is updated with each plugin release, and looking an address up never contacts any outside service.
The admin screens that show a country (the audit log, Live Traffic and Pro’s Threat Hunting), and notification emails that include a country, link to DB-IP as its licence asks. The page a visitor sees when a country rule blocks them can show the same link: turn on “geo credit on block page” in the Firewall settings. It is off by default because a plugin may not add links to your public site without your consent.
Does it work behind Cloudflare?
Yes. Requests that come from Cloudflare’s published addresses are recognised automatically, so bans, rate limits and logs use the real visitor’s address (“Trust Cloudflare”, on by default). Cloudflare’s own addresses are never banned or allowlisted. For another proxy or load balancer, add its address under Firewall → Trusted proxies.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
