defender-security / readme.txt

readme.txt in Defender Security – Malware Scanner, Login Security & Firewall 3.0.1, at readme.txt

355 lines 18.4 KB

Raw Download Zip

1	=== Defender Security - Malware Scanner, Login Security & Firewall ===
2	Plugin Name: Defender Security - Malware Scanner, Login Security & Firewall
3	Version: 3.0.1
4	Author: WPMU DEV
5	Author URI: https://wpmudev.com/
6	Contributors: WPMUDEV
7	Tags: security plugin, security, firewall, malware, malware scanner, antivirus, ip blocking, login security, brute force attacks, two-factor authentication, activity log, audit logs, block hackers, 2fa, hack, webauthn
8	Requires at least: 5.2
9	Tested up to: 6.0
10	Stable tag: 3.0.1
11	Requires PHP: 7.2.0
12	License: GPL v2 - http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
13
14	WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, activity logs, firewall, 2FA, brute force login security & more.
15
16
17	== Description ==
18
19	Defender adds the best in WordPress plugin security to your website with just a few clicks. Stop brute force login attacks, SQL injections, cross-site scripting XSS, and other WordPress vulnerabilities and hacks with Defender’s malware scanner, antivirus scans, IP blocking, firewall, activity log, security log, and two-factor authentication (2FA) login security.
20
21	No longer do you have to go through hideously complex settings and get a virtual PhD in security. Defender adds all the hardening and security recommendations you need.
22
23	### Security Recommendations
24
25	Defender starts with a list of one-click hardening techniques that will instantly add layers of protection to your site.
26
27	### Block hackers at every level:
28
29	* Two-factor authentication (2FA) – Mobile app verification, backup codes, lost device email, and Biometric Authentication
30	* Login masking – change the location of WordPress’s default login area
31	* Login lockout – failed login attempts lockout
32	* Malware scanner - scan WordPress core files for modifications and unexpected changes
33	* Security Headers - Add an extra layer of defense and protect against common attacks like: XSS, code injection, and more
34	* 404 Detection – automated block of bot IPs
35	* Configs - Create your ideal Defender security settings and export / import saved configs to any other site
36	* Geolocation IP lockout – block users based on location and country (IP blocking)
37	* WordPress Security Firewall – block or allowlist IPs
38	* Disable trackbacks and pingbacks – spam prevention
39	* Core and server update recommendations – stay on top of your system
40	* Antivirus scan - scan for active security threats and viruses
41	* Disable file editor – if they get in, they won’t get far
42	* Hide error reporting – don’t reveal your issues
43	* Update security keys – reset on-demand
44	* Prevent information disclosure – why tell them what you have
45	* Prevent PHP execution – because it’s daaaangerous
46	* Resolve security recommendations and issues in bulk
47	* Google reCAPTCHA - easy to add, stop fraud and abuse.
48	* Pwned Password Check - Protect against compromised passwords.
49	* Force Password Reset - Force users with selected roles to reset passwords.
50	* User Agent Banning - Block bad bots and user agents from accessing your site.
51
52	### Learn The Ropes With These Hands-On Defender Tutorials
53
54	* [How to Get the Most Out of Defender Security](https://wpmudev.com/blog/how-to-get-the-most-out-of-defender-security/)
55	* [How to Stop Hackers in Their Tracks with Defender](https://wpmudev.com/blog/stop-hackers-with-defender-wordpress-security-plugin/)
56	* [Find Out if You’re Hacked: How to Find and Delete Suspicious Code with Defender](https://wpmudev.com/blog/delete-suspicious-code-defender/)
57	* [How to Create a Powerful and Secure Customized Firewall with Defender](https://wpmudev.com/blog/defender-ip-address-lockout-firewall/)
58
59	[youtube https://www.youtube.com/watch?v=3rBd7ea91V8]
60
61	### WordPress Security Scans
62	Defender’s free malware scanner checks WordPress for suspicious code and malware. The Defender scan tool compares your WordPress install with the master copy in WP directory, reports changes and lets you restore the original file with a click.
63
64	### Two-Factor Authentication (2FA)
65	Easily add an extra layer of protection to your WordPress sites with Defender’s range of two-factor authentication (2FA) features. Including: mobile app verification (Google Authenticator, Microsoft Authenticator, Authy), backup code generation, lost device emails, and Biometric Authentication (fingerprint scan and facial recognition).
66
67	[youtube https://www.youtube.com/watch?v=w9pfRCuT36Q]
68
69	### Google reCAPTCHA Integration
70
71	Add reCAPTCHA to your login, registration, and password reset pages in a couple of steps to help protect from fraud and abuse. Select reCAPTCHA type, language, location, and style to suit.
72
73	### Firewall and IP Manager
74
75	Keep your site safe with Defender’s IP manager and firewall. Manually block specific IPs, import a list of banned IPs and set automated timed and permanent lockouts. Defender makes it easy to block and unblock specific locations quickly thanks to its advanced firewall (WAF).
76
77	### Login Protection
78
79	Brute force login attacks are no match for Defender. Limit login attempts to stop users trying to guess passwords. Permanently ban IPs or trigger a timed lockout after a set number of failed login attempts.
80
81	### Login Screen Masking
82
83	Defender makes it easy to move your login screen to a custom URL. Not only does login screen masking improve security, but it also lets you white label your login user experience and improves branding.
84
85	### Force Password Reset
86
87	Password Reset enables you to force all users with selected roles to reset their password at any time. Especially helpful if you suspect a possible data breach on your site.
88
89	### User Agent Banning
90
91	Add user agents to the block or allowlist and stop bad bots from spamming and scraping your site. All major search engines and special network bots are allow-listed out of the box. Easy to set up, Defender does all the work, no editing of the .htaccess file required.
92
93	### Security Headers
94
95	Security headers protect your site against the most likely types of attacks, such as: XSS, code injection, cross site scripting, and more. You can enable the following headers:
96
97	* X-Frame-Options
98	* X-XSS-Protection
99	* X-Content-Type-Options
100	* Strict Transport
101	* Referrer Policy
102	* Permissions-Policy
103
104	### 404 Limiter
105	Defender detects when bots are being used to scan your site for vulnerabilities and shuts them down. The 404 limiter lets you stop the scan by detecting when a bot keeps visiting pages that do not exist, which can also save you from a giant strain on your site’s performance.
106
107	### Notifications and Reports
108	Defender runs surveillance and sends notifications with information that matters.
109
110	### Reduce Setup Time With Saved Configs
111
112	The configs module allows you to save your Defender configurations and reapply them to your other sites in just a few clicks. You can create and save an unlimited number of configurations.
113
114	### Pwned Password Check
115
116	Protect your site against password leak attacks. Entered passwords are checked against public database breach records. If a password is identified as compromised, the user will be asked to change it.
117
118	### What Do People Say About Defender?
119
120	�
121	�
122	�
123	�
124	�
125
126	“I found other pro security plugins a bit too fiddly for my taste...I’m delighted with Defender” - <a href="https://profiles.wordpress.org/keithadv">KeithADV</a>
127
128	�
129	�
130	�
131	�
132	�
133
134	“Thank you for bringing back a free and easy to use 2-Factor Authentication after Clef! Defender helps keep me aware of my sites security.” - <a href="https://wordpress.org/support/users/awijasa/">awijasa</a>
135
136	�
137	�
138	�
139	�
140	�
141
142	“Defender's interface is very intuitive with warnings that are very helpful” - <a href="https://wpmudev.com/profile/djohns">djohns</a>
143
144	�
145	�
146	�
147	�
148	�
149
150	“Defender Recently blocked over 3000 attacks in one week without any noticeable impact on the website. WPMUDEV knocking it out of the park on this one.” - <a href="https://wpmudev.com/profile/davidoswald/">David Oswald</a>
151
152	### Secure Websites, More Trust, Better Profit
153	Your visitors expect a super-safe extra secure website when deciding whether or not to make a purchase or submit information. If visitors don’t trust your site, they will leave without completing a transaction.
154
155	If you’re running a business website or eCommerce store privacy, security, uptime and trust are essential.
156
157	Defender is here to help you: it’s a one of a kind WordPress security plugin that makes web security easy for anyone, for free!
158
159	* Google two-factor authentication (2FA)
160	* One-click site hardening and security tweaking
161	* WordPress core file scanning and repair
162	* Malware scan
163	* Ongoing firewall protection
164	* Google reCAPTCHA
165	* Security headers
166	* One-click configs
167	* Login Screen Masking
168	* Pwned Password Check
169	* IP Blocklist manager and logging
170	* Unlimited file scans
171	* Timed Lockout brute force login attack shield for login protection
172	* 404 limiter for blocking vulnerability scans
173	* IP lockout notifications and reports
174
175	Defender is built to make security simple: it makes your WordPress site harder to hack and it’s insanely easy to set up. Run a scan and implement recommended changes in one-click, for added security in mere minutes.
176
177	All the above is free and will secure WordPress for you. If you need extra security for your WordPress site, [you should get WPMU DEV Membership](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=you_should_get_wpmudev_membership#trial).
178
179	Our Membership gives you access to Defender Pro – which features automated scanning, scheduled malware scans for Core, themes, plugins and other files, audit logs, firewall protection, Blocklist monitoring – alongside Snapshot Pro cloud backups, the Hub with automated plugin, theme and core updates and safe-upgrade scans, all our premium WordPress plugins, 24/7 WordPress support and if your sites already been hacked our team of security experts will clean it up at no additional cost.
180
181	[It’s an incredible deal, and you can find out more here](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=and_you_can_find_out_more_here#trial).
182
183	### A Note From Defender
184	Hey! This is Defender, your trusted solution for WordPress security and hack prevention. I’m part of the WPMU DEV team, a superhero-suite of WordPress plugins, services, and support. Here are some of our other free plugins:
185
186	* [Smush](https://wordpress.org/plugins/wp-smushit/) – Image Compression and Optimization
187	* [Forminator](https://wordpress.org/plugins/forminator/) – Form, Quiz, Poll and Survey Builder
188	* [Hummingbird](https://wordpress.org/plugins/hummingbird-performance/) – Page Speed Optimization
189	* [Hustle](https://wordpress.org/plugins/wordpress-popup/) – Pop-ups, Slide-ins and Email Opt-ins
190	* [SmartCrawl](https://wordpress.org/plugins/smartcrawl-seo/) – SEO checker, Analyzer and Optimizer
191
192	And if you need ALL our Pro plugins AND 24/7 WordPress support, get WPMU DEV membership! You can try it free for 30 days: [wpmudev.com](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=hummingbird-readme&utm_content=link_wpmudev#trial)
193
194	My superhero friends run the WPMU DEV Blog, your source for the very best WordPress tutorials. If you need to be in the know about WordPress, check it out.
195
196	Thanks for looking at Defender, and I look forward to hardening your site and making it safer than ever.
197
198	Enjoy, The Defender
199
200
201	== Frequently Asked Questions ==
202
203	= Why should I choose Defender over other security plugins? =
204
205	Defender is built to add all the best hardening and security recommendations used by the pros without having to become a security expert. This means you get all the most effective and proven protection methods other services provide with fewer settings, on-click hardening and faster setup.
206
207	= Is Defender the only step I need to take in securing my WordPress site? =
208	Hackers and bot attacks are not the only threat to your site. No matter what security plugin or service you use, always be prepared with a secure backup stored in a safe location away from your live site. Security does not protect from hosting outages, server errors and accidentally lost or damaged data. We recommend [Snapshot](https://wpmudev.com/project/snapshot/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=snapshot#trial). Defender with scheduled managed backups is the best way to keep your site safe.
209
210	= Does Defender protect against harmful bots? =
211
212	Yes! Defender’s Firewall gives you robust site protection by allowing you to block bad bot IPs.
213
214	= Can I use Defender with other security plugins? =
215
216	You can. Just make sure not to enable the same features in the third-party plugin, that you also have enabled in Defender, as this might cause conflicts.
217
218	= Is Defender compatible with WordPress Multisite? =
219
220	Yes! The plugin is fully compatible with a multisite installation. It can be network enabled and managed from the network admin.
221
222	= Does Defender offer spam protection? =
223
224	A high percentage of Trackbacks and Pingbacks are spam. Defender allows you to easily disable both, giving you added protection.
225
226	= Will my site be protected from DDoS attacks? =
227
228	Yes. Defender’s IP banning, IP lockouts, and 404 detections can identify DDoS attacks and block bad IPs.
229
230	= I’ve locked myself out of my admin panel, what can I do? =
231
232	Add the code below to your theme’s function.php file, which you’ll find in the main directory of an active theme. Replace “YOUR IP HERE” with your IP address. Use a site like [whatsmyip](https://www.whatsmyip.org/) to get your IP.
233
234	`
235	add_filter( 'ip_lockout_default_whitelist_ip', function ( $ips ) {
236	$ip = 'YOUR IP HERE';
237	$ips[] = $ip;
238	return $ips;
239	} );
240	`
241
242	= Help! I was already hacked. What should I do? =
243
244	WPMU DEV’s expert support can advise you on how to clean up your site if it’s been hacked. Create a new thread in our [support forum](https://wordpress.org/support/plugin/defender-security/), or start a [free 7 day trial of Defender Pro](https://wpmudev.com/project/wp-defender/) to get access to 24/7 live support.
245
246	= I have another question, where’s the best place to get help? =
247
248	Please open a new thread in Defender’s [support forum](https://wordpress.org/support/plugin/defender-security/). Our support team is always happy to help!
249
250	== Screenshots ==
251
252	1. Malware scans and one-click hardening recommendations.
253	2. Layered security recommendations let your harden your site with a few clicks.
254	3. Compares your WordPress install with the directory and restore original files with a click.
255	4. Use 2-Step Verification to protect your accounts with your phone.
256	5. IP blocklisting, 404 limiter and Timed Lockout attack shield.
257
258	== Installation ==
259
260	1. Upload the `wp-defender` plugin to your `/wp-content/plugins/` directory.
261	2. Activate the plugin through the 'Plugins' menu in WordPress.
262	3. Configure and manage using the `defender` menu item in the WordPress dashboard.
263	4. Done!
264
265	== Changelog ==
266
267	= 3.0.1 ( 2022-06-14 ) =
268
269	- Fix: Beehive Pro plugin flagged issues
270
271	= 3.0.0 ( 2022-06-06 ) =
272
273	- New: Biometric Authentication
274	- New: Giveaway Opt-in for Free version
275	- Enhance: PHP version upgrade
276	- Enhance: Compatibility with WordPress 6.0
277	- Enhance: WP-CLI command to show Scan details
278	- Enhance: Update SUI to the latest version
279	- Fix: Audit events logged not showing after applying some date range
280
281	= 2.8.3 ( 2022-05-11 ) =
282
283	- Enhance: PHP upgrade notice
284	- Fix: Defender country_iso_code column missing from Lockout table
285	- Fix: Defender sets all country iso codes as NULL
286
287	= 2.8.2 ( 2022-04-08 ) =
288
289	- Fix: All site visitors are blocked
290
291	= 2.8.1 ( 2022-04-07 ) =
292
293	- Enhance: Hide write permissions error notices for Tweaks while applying config
294	- Enhance: Update the default Auth method on the Users page
295	- Enhance: Singular or plural translation in email templates
296	- Enhance: Login Protection and 404 Detection Section Update
297	- Enhance: Show country flags for country-based lockouts
298	- Fix: Update Firewall's 404 Detection blocklist and allowlist information notice
299	- Fix: Firewall not working when Country is added to whitelist
300	- Fix: Updating plugins with known vulnerabilities
301	- Fix: No passcode when Fallback Email is not the default method
302	- Fix: 404 Exclusions Inconsistent Logging
303	- Fix: 2FA token issue
304	- Fix: Undefined array key "HTTP_HOST"
305	- Fix: Duplicate key name 'country_iso_code'
306	- Fix: Welcome modal when white-label enabled
307	- Fix: Jquery issue on Def's 2FA TOTP page
308
309	= 2.8.0 ( 2022-03-07 ) =
310
311	- New: Backup codes
312	- Enhance: Text version of 2FA code
313	- Enhance: Add Update Old Security Keys settings to config
314	- Enhance: Automatically check for MaxMind database updates
315	- Enhance: WP-CLI command to delete Defender logs
316	- Enhance: Delete security tweak settings during uninstallation
317	- Fix: IP Lockout issue
318	- Fix: Malware Scanning PHP 8.1 error
319	- Fix: Native domain mapping doesn't work with login masking
320	- Fix: Firewall log export doesn't include all entries
321	- Fix: Duplicate configs
322	- Fix: Geo DB downloaded to WP-Admin directory
323	- Fix: Branda conflict – Update User listed twice in logs
324	- Fix: Notifications user search missing some users
325	- Fix: When Defender login masking is active, SmartCrawl report URL are broken
326	- Fix: User filter dropdown count not updating dynamically
327	- Fix: SSO not working with login masking on multisite
328
329	= 2.7.1 ( 2022-02-02 ) =
330
331	- New: Create new endpoints to toggle reCAPTCHA, 2FA modules from Hub
332	- Enhance: Update SUI to latest version
333	- Enhance: Refactor Firewall logs
334	- Enhance: Update admin menu icon
335	- Enhance: Remove deprecated hooks
336	- Enhance: Unsubscribe link doesn't work for not logged in users
337	- Fix: Fatal error on plugin activation with PHP 8.1
338	- Fix: Display error on Dashboard and Tools pages for huge post data
339	- Fix: Configure reCAPTCHA without WooCommerce options
340	- Fix: Invite By Email doesn't check if recipient already added
341	- Fix: Email text overflows on Notification page
342	- Fix: Defender downgrade fails
343
344
345	[Changelog for previous versions](https://wpmudev.com/project/wp-defender/#view-changelog).
346
347	== About Us ==
348	WPMU DEV is a premium supplier of quality WordPress plugins and themes. For premium support with any WordPress related issues you can join us here:
349	[https://wpmudev.com/](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_link)
350
351	Don't forget to stay up to date on everything WordPress from the Internet's number one resource:
352	[WPMU DEV Blog](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_blog_link)
353
354	Hey, one more thing... we hope you [enjoy our free offerings](http://profiles.wordpress.org/WPMUDEV/) as much as we've loved making them for you!
355