defender-security / readme.txt

readme.txt in Defender Security – Malware Scanner, Login Security & Firewall 5.3.1, at readme.txt

368 lines 21.6 KB

Raw Download Zip

1	=== Defender Security - Malware Scanner, Login Security & Firewall ===
2	Plugin Name: Defender Security - Malware Scanner, Login Security & Firewall
3	Version: 5.3.1
4	Author: WPMU DEV
5	Author URI: https://wpmudev.com/
6	Contributors: WPMUDEV
7	Tags: security, malware, firewall, malware scanner, login security
8	Requires at least: 6.4
9	Tested up to: 6.8.1
10	Stable tag: 5.3.1
11	Requires PHP: 7.4
12	License: GPL v2 - http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
13
14	WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, firewall, 2FA, brute force login security, and more.
15
16	== Description ==
17
18	Defender adds the best in WordPress plugin security to your website with just a few clicks, including malware scanner, firewall, password protection, and login security features. Stop brute force login attacks, weak password usage, SQL injections, cross-site scripting (XSS), and other WordPress security vulnerabilities and hacks with Defender’s malware scanner, providing antivirus scans, IP blocking, firewall, activity log, security log, and two-factor authentication (2FA) login security.
19
20	No more complex security settings, Defender's malware scanner, firewall, and login security features add all the hardening and security you need.
21
22	Defender is brought to you by the WordPress speed specialists that created Smush image optimization, now active on more than +1 million websites.
23
24	Plus, connect for free to WPMU DEV’s AntiBot Global Firewall to block harmful IPs with data from over 500,000 sites.
25
26	Enjoy complete site protection from malware, vulnerabilities, bot attacks, and session hijacking from the start with [Defender Pro](https://wpmudev.com/project/wp-defender/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro).
27
28	Level up security immediately with exclusive Pro features like scheduled malware scanning, Safe Repair for suspicious files, and known WordPress vulnerability detection. [Learn more about Pro](https://wpmudev.com/project/wp-defender/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro).
29
30	### Security Recommendations
31
32	Defender's one-click security hardening recommendations instantly adds layers of protection and security to your site.
33
34	### Enhance Security and Block Hackers At Every Level:
35
36	* Malware scanner - scan WordPress core files for modifications and unexpected changes which may be caused by malware. Scan for malware and tighten up the security of your files
37	* AntiBot Global Firewall - Connect for free to WPMU DEV to block harmful IPs with data from over 500,000 sites
38	* WordPress Security Firewall - block or allowlist IPs, implement IP blocking, and Geo IP blocking, user agent banning and protect against brute force attacks
39	* Two-factor authentication (2FA) - Easily set up better security with 2FA to prevent most login attacks such as brute force, App verification, backup codes, lost device email, WooCommerce 2FA, and Web Authentication
40	* Login masking - change the location of WordPress's default login area to improve login security
41	* Login lockout - failed login attempts lockout for even more security assurance
42	* User Agent Banning - Fortify security by blocking bad bots and user agents from accessing your site
43	* Security Headers - Add an extra layer of defense security and protect against common attacks like: XSS, code injection, and more
44	* 404 Detection security - automated block of bot IPs
45	* Security Configs - Create your ideal Defender security plugin settings and export / import saved configs to any other site
46	* Geolocation IP lockout security - block users based on location and country (IP blocking)
47	* Disable trackbacks and pingbacks - disable these notifications to enhance spam protection and site security.
48	* Core and server update security recommendations - stay on top of your system security
49	* Antivirus scan - scan for active security threats, viruses, and other malware
50	* Disable file editor - if they get in, they won't get far
51	* Hide error reporting - hide code errors on the frontend so hackers can’t exploit site security
52	* Update security keys - update old WordPress security keys to be more encrypted and provide better security
53	* Prevent information disclosure - improve server security and protect sensitive files by locking down specific file types
54	* Prevent PHP execution - Defender bolsters security by automatically preventing any PHP code from being executed
55	* Resolve security recommendations and issues in bulk
56	* Google reCAPTCHA security - easy to add, stop fraud and abuse - including BuddyPress and WooCommerce
57	* Pwned Password Check - Increase security by protecting against compromised passwords
58	* Force Password Reset - Force users with selected roles to reset passwords
59	* Force Strong Passwords – Ensure users create secure credentials by enforcing robust password requirements.
60
61	### Learn The Ropes With These Hands-On Defender Security Plugin Tutorials
62
63	* [How to Get the Most Out of Defender Security](https://wpmudev.com/blog/how-to-get-the-most-out-of-defender-security/)
64	* [How to Stop Hackers in Their Tracks with Defender Security](https://wpmudev.com/blog/stop-hackers-with-defender-wordpress-security-plugin/)
65	* [Find Out if You're Hacked: How to Find and Delete Suspicious Code with Defender Security](https://wpmudev.com/blog/delete-suspicious-code-defender/)
66	* [How to Create a Powerful and Secure Customized Firewall with Defender Security](https://wpmudev.com/blog/defender-ip-address-lockout-firewall/)
67
68	### WordPress Security Scans
69	Defender's malware scanner security checks for suspicious code and malware. It also compares your WordPress install with the WP directory master copy, and reports any changes so you can restore the original file with a click.
70
71	### Two-Factor Authentication (2FA) Security
72
73	Easily add an extra layer of protection and security to your WordPress sites with Defender's two-factor authentication (2FA) features. Including: mobile app verification (Google Authenticator, Microsoft Authenticator, Authy), backup code generation, lost device emails, WooCommerce 2FA, Biometric Authentication (fingerprint/facial recognition), and Hardware Key Authentication (USB security keys). Easily prevent brute force attacks and login security vulnerabilities.
74
75	### Login Protection
76
77	Brute force attacks are no match for Defender's login security. Limit login attempts so hackers can't guess passwords. Permanently ban IPs or trigger a timed lockout after a set number of failed login attempts. Use Geo IP blocking to ban users from specific countries or locations.
78
79	### Firewall Security and IP Manager
80
81	Improve your website security with Defender's IP manager and firewall. Manually block specific IPs, import a list of banned IPs, and set automated timed and permanent lockouts. Defender makes it easy to block and unblock specific locations quickly thanks to its advanced firewall security(WAF) offering Geographical IP blocking.
82
83	### User Agent Banning
84
85	Add user agents to the block or allowlist and stop bad bots from spamming and scraping your site. All major search engines and special network bots are allow-listed out of the box. Easy to set up, Defender's user agent banning tool does all the security work, with no editing of the .htaccess file required.
86
87	### Google reCAPTCHA Integration
88
89	Add reCAPTCHA security to your login / registration pages, lost password forms, and post comments in a couple of steps to up security and help protect from fraud and abuse. Select reCAPTCHA type, language, location, and style to suit. As well as Google, Defender also supports the following reCAPTCHA types:
90
91	* BuddyPress reCAPTCHA
92	* WooCommerce reCAPTCHA
93
94	### Login Screen Masking
95
96	Defender makes it easy to move your login screen to a custom URL. Not only does login screen masking improve security, but it also lets you white label your login user experience and improves branding.
97
98	### Force Password Reset
99
100	Enhance site security by forcing all users with selected roles to reset their password at any time. Especially helpful if you suspect a possible data breach on your site.
101
102	### Security Headers
103
104	Protect your site against common attacks, such as: XSS, code injection, cross site scripting, and more. Enable the following security headers:
105
106	* X-Frame-Options
107	* X-XSS-Protection
108	* X-Content-Type-Options
109	* Strict Transport
110	* Referrer Policy
111	* Permissions-Policy
112
113	### 404 Limiter
114	Detect when bots are being used to scan your site for security vulnerabilities and shut them down. The 404 limiter lets you stop the scan by detecting when a bot keeps visiting pages that do not exist, which can also save you from a giant strain on your site's performance.
115
116	### Security Notifications and Reports
117	Defender runs surveillance and sends security notifications with information that matters. All activity and notifications are recorded in the activity log to let you see at a glance the website security actions that have been taken by the Defender security plugin.
118
119	### Reduce Security Setup Time With Saved Configs
120
121	Save your Defender security plugin configurations and reapply them to your other sites in just a few clicks. You can create and save an unlimited number of security configurations.
122
123	### Pwned Password Check
124
125	Entered passwords are checked against public database breach records to further boost security. If a password is identified as compromised, the user will be asked to change it.
126
127	### Custom IP Block/Allowlist
128
129	Create your IP block/allow list once, then apply and automatically sync it to all your other sites with just a single click. Save hours by not having to manually add IPs to each individual site. *Note: a [free WPMU DEV account] (https://wpmudev.com/register) is required to access this feature.
130
131	### What Do People Say About Defender?
132
133	�
134	�
135	�
136	�
137	�
138
139	"I found other pro security plugins a bit too fiddly for my taste...I'm delighted with Defender" - <a href="https://profiles.wordpress.org/keithadv">KeithADV</a>
140
141	�
142	�
143	�
144	�
145	�
146
147	"Thank you for bringing back a free and easy to use 2-Factor Authentication after Clef! Defender helps keep me aware of my site's security." - <a href="https://wordpress.org/support/users/awijasa/">awijasa</a>
148
149	�
150	�
151	�
152	�
153	�
154
155	"Defender's interface is very intuitive with warnings that are very helpful" - <a href="https://wpmudev.com/profile/djohns">djohns</a>
156
157	�
158	�
159	�
160	�
161	�
162
163	"Defender Recently blocked over 3000 attacks in one week without any noticeable impact on the website. WPMUDEV knocking it out of the park on this one." - <a href="https://wpmudev.com/profile/davidoswald/">David Oswald</a>
164
165	### Secure Websites, More Trust, Better Profit
166	If you're running a business website or eCommerce store, privacy, security, uptime and trust are essential.
167
168	The Defender security plugin is here to help you: it's a one of a kind WordPress security plugin that makes web security easy for anyone, for free!
169
170	* Malware scanner
171	* Google two-factor authentication (2FA)
172	* Web Authentication
173	* Firewall setup and configuration
174	* One-click site hardening and security tweaking
175	* WordPress core file scanning and repair
176	* Ongoing firewall security
177	* Google reCAPTCHA
178	* Security headers
179	* One-click security configs
180	* Login Screen Masking
181	* Pwned Password Check
182	* IP Blocklist manager and logging
183	* Geo IP blocking
184	* User agent banning
185	* Unlimited file scans
186	* Timed Lockout brute force login attack shield for login security
187	* 404 limiter for blocking vulnerability scans
188	* IP lockout notifications and security reports
189
190	All the above is free and will enhance WordPress security for you. If you need extra security for your WordPress site, [you should get a WPMU DEV Membership](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=you_should_get_wpmudev_membership#trial).
191
192	Our Membership gives you access to Defender Pro - which security features include automated scanning, scheduled malware scans for Core, themes, plugins and other files, audit logs, firewall protection, Safe Repair, Blocklist monitoring - alongside Snapshot Pro cloud backups, the Hub with automated plugin, theme and core updates and safe-upgrade scans, all our premium WordPress plugins, 24/7 WordPress support and if your sites already been hacked our team of security experts will clean it up at no additional cost.
193
194	[It's an incredible deal, and you can find out more here](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=and_you_can_find_out_more_here#trial).
195
196	== Frequently Asked Questions ==
197
198	= Why should I choose Defender over other security plugins? =
199
200	Defender is built to add all the best hardening and website security recommendations used by the pros without having to become a security expert. This means you get all the most effective and proven protection methods other services provide with fewer settings, one-click hardening and faster setup.
201
202	= Is installing Defender the only step I need to take for better WordPress security? =
203
204	Hackers and bot attacks are not the only security threats to your site. No matter what security plugin or service you use, always be prepared with a secure backup stored in a safe location away from your live site. Security does not protect from hosting outages, server errors and accidentally lost or damaged data. We recommend [Snapshot](https://wpmudev.com/project/snapshot/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=snapshot#trial). Defender with scheduled managed backups is the best way to keep your site safe.
205
206	= Does Defender security protect against harmful bots? =
207
208	Yes! Defender's Firewall gives you robust site protection and security by allowing you to block bad bot IPs and use geographical IP blocking
209
210	= Can I use Defender with other security plugins? =
211
212	You can. Just make sure not to enable the same security features in the third-party plugin that you also have enabled in Defender, as this might cause conflicts, such as malware scanners, firewall, and login security features.
213
214	= Is Defender’s security compatible with WordPress Multisite? =
215
216	Yes! All of Defender's security features are fully compatible with a multisite installation. It can be network enabled and managed from the network admin.
217
218	= Does Defender offer spam protection and security? =
219
220	Yes, Defender provides multiple layers of spam protection and security. A large percentage of Trackbacks and Pingbacks are spam, and Defender allows you to easily disable both to reduce spam and improve site security. Additionally, Defender includes the AntiBot Global Firewall, which blocks known malicious IPs and bots before they even reach your site, offering proactive protection against common attacks and spam bots.
221
222	= Will my site be protected from DDoS attacks and similar security threats? =
223
224	Yes. Defender's IP banning, IP lockout, and 404 detection security features can identify DDoS attacks and block bad IPs.
225
226	= I've locked myself out of my admin panel, what can I do? =
227
228	If you’re the administrator and you’ve been locked out due to multiple failed login attempts, Defender offers two options:
229
230	Option #1: Use the “Unlock Me” feature:
231
232	Click the Unlock Me button on the login page and enter your username or the email address linked to your site. You’ll receive an email with a secure link to unlock your account and regain access — no technical steps needed.
233
234	Option #2: Use the manual method (if email doesn’t work):
235
236	Add the following code to your theme’s functions.php file, located in the main directory of your active theme.
237	`
238	add_filter( 'ip_lockout_default_whitelist_ip', function ( $ips ) {
239	$ip = 'YOUR IP HERE';
240	$ips[] = $ip;
241	return $ips;
242	} );
243	`
244	Replace "YOUR IP HERE" with your actual IP address (you can use a tool like whatsmyip to find it.)
245
246	= Help! I was already hacked. What should I do? =
247
248	WPMU DEV's expert support can advise you on how to clean up your site if it's been hacked. Create a new thread in our [support forum](https://wordpress.org/support/plugin/defender-security/), or [Defender Pro](https://wpmudev.com/project/wp-defender/) gives you access to 24/7 live support.
249
250	= How can I report security issues or bugs? =
251
252	We take plugin security incredibly seriously; if you have a bug or vulnerability to report, you can do so through the Patchstack Vulnerability Disclosure Program. It's fast, easy, and you will be notified when the issue is fixed. [Report a vulnerability](https://patchstack.com/database/vdp/defender-security).
253
254	= I have another question, where's the best place to get help with security? =
255
256	Please open a new thread in Defender's [support forum](https://wordpress.org/support/plugin/defender-security/). Our support team is always happy to help!
257
258	== Screenshots ==
259
260	1. Malware scans and one-click website security hardening recommendations.
261	2. Layered security recommendations let you harden your site with a few clicks.
262	3. Enable AntiBot & Local Firewall for smart, layered defense against bots and brute-force attacks.
263	4. Keep your account safe with 2FA options including TOTP apps, backup codes, and secure fallback methods.
264	5. Use built-in password rules to ensure only secure, uncompromised passwords are used.
265	6. Never miss a threat—Defender emails you security updates on your schedule.
266
267	== Installation ==
268
269	1. Upload the `wp-defender` plugin to your `/wp-content/plugins/` directory.
270	2. Activate the plugin through the 'Plugins' menu in WordPress.
271	3. Configure and manage using the `defender` menu item in the WordPress dashboard.
272	4. Done!
273
274	== Changelog ==
275
276	= 5.3.1 ( 2025-06-12 ) =
277
278	- Fix: Sync malicious IP count displayed in Defender and the Hub
279
280	= 5.3.0 ( 2025-06-11 ) =
281
282	- New: AntiBot Mode
283	- Enhance: Improve Session Protection when loading an image
284	- Enhance: Add session widget on the Dashboard page
285	- Enhance: Rename slug for Expert Services
286	- Enhance: Update wp.org screenshots
287	- Enhance: Update Session Protection Tracking event
288	- Enhance: Change "Central IP List" label to "Custom IP List"
289	- Enhance: Change OTP page styling to match the default WordPress login
290	- Enhance: Generate strong passwords that meet all verification requirements
291	- Enhance: Update malware signatures to detect additional infected files
292	- Enhance: Log custom IP Block events
293	- Enhance: Log Unblocking event from Unlock Me option
294	- Fix: MaxMind key field appears empty on the Local Blocklist page if the MaxMind key is removed from the database
295	- Fix: No session logs appear when the Interim login screen is shown
296	- Fix: Scan can't detect modifications in the Debug Log Manager plugin
297	- Fix: Warning in PHP 8.4
298	- Fix: File existence and readability checks in Malware_Result and Plugin_Integrity classes
299
300	= 5.2.2 ( 2025-04-23 ) =
301
302	- Fix: Plugin_Cross_Sell class error
303
304	= 5.2.1 ( 2025-04-23 ) =
305
306	- Enhance: Add a new menu item to help you discover other free plugins by WPMU DEV and more
307
308	= 5.2.0 ( 2025-04-07 ) =
309
310	- New: Session Protection
311	- Enhance: Compatibility with WordPress 6.8
312	- Enhance: Add a toggle to block popular spam/malicious User Agents
313	- Enhance: Remove Semrush and Ahrefs from the default User Agent blocklist
314	- Enhance: Improve the wpdef_sec_key_gen cron process on multisite
315	- Enhance: Update Malware Signatures to detect suspicious code
316	- Enhance: Improve the Quarantine flow during upgrade from free to pro plugin version
317	- Enhance: Improve the class representing the vulnerability result
318	- Enhance: Improve Trusted IP popup flow
319	- Fix: Masked Login URL bypassed by using encoded characters
320	- Fix: Audit Logging showing wrong time
321
322	= 5.1.1 ( 2025-03-03 ) =
323
324	- Enhance: Improve cron events for AntiBot Global Firewall on multisite
325	- Enhance: Remove manual "All headers" option and migrate to Automatic IP detection for improved compatibility and security
326	- Enhance: Update User Agent logic with AntiBot service to better detect potential threats
327
328	= 5.1.0 ( 2025-02-26 ) =
329
330	- New: Enforce strong password
331	- Enhance: Manage all password-related settings in one place
332	- Enhance: Improve lockout mechanism
333	- Enhance: Upgrade plugin packages
334	- Enhance: Support Unit server
335	- Enhance: Translation improvements
336	- Enhance: Improve IP Lockout redirect when user adds IP to Allowlist
337	- Enhance: Create a new cookie to avoid Lockout caching in Hummingbird plugin
338	- Enhance: Update minimum supported WordPress version
339	- Enhance: Enable Plugin & Suspicious code scan by default on fresh installations
340	- Enhance: Improve Malware_Result class
341	- Enhance: Minor code improvements
342	- Fix: Defender does not detect themes with vulnerabilities
343	- Fix: Error while pfsockopen function is disabled
344	- Fix: NaN is showing on AntiBot page when language is changed to German in the Dashboard plugin
345	- Fix: Form does not submit if Google reCAPTCHA is enabled in both Defender and Forminator plugins
346	- Fix: Malware Scanner highlights WordPress core files on IIS server
347	- Fix: Database error related to AntiBot feature
348	- Fix: Salt keys appear before open php tag
349	- Fix: Google reCAPTCHA compact style is not working
350
351	= 5.0.2 ( 2025-02-14 ) =
352
353	- Improvement: Update 404 logic with AntiBot service to better detect and mitigate potential threats
354	- Improvement: Enhancing IP Detection in Defender to prevent blocking of server IPs
355
356	[Changelog for previous versions](https://wpmudev.com/project/wp-defender/#view-changelog).
357
358	== Upgrade Notice ==
359
360	== About Us ==
361	WPMU DEV is a premium supplier of quality WordPress plugins and themes. For premium support with any WordPress-related issues you can join us here:
362	[https://wpmudev.com/](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_link)
363
364	Don't forget to stay up to date on everything WordPress from the Internet's number one resource:
365	[WPMU DEV Blog](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_blog_link)
366
367	Hey, one more thing... we hope you [enjoy our free offerings](http://profiles.wordpress.org/WPMUDEV/) as much as we've loved making them for you!
368