| @@ -1,14 +1,14 @@ | ||
| 1 | 1 | === Defender Security - Malware Scanner, Login Security & Firewall === |
| 2 | 2 | Plugin Name: Defender Security - Malware Scanner, Login Security & Firewall |
| 3 | -Version: 5.7.0 | |
| 3 | +Version: 6.3.0 | |
| 4 | 4 | Author: WPMU DEV |
| 5 | 5 | Author URI: https://wpmudev.com/ |
| 6 | 6 | Contributors: WPMUDEV |
| 7 | 7 | Tags: security, malware, firewall, malware scanner, login security |
| 8 | 8 | Requires at least: 6.4 |
| 9 | -Tested up to: 6.9 | |
| 10 | -Stable tag: 5.7.0 | |
| 9 | +Tested up to: 7.1.1 | |
| 10 | +Stable tag: 6.3.0 | |
| 11 | 11 | Requires PHP: 8.0.0 |
| 12 | 12 | License: GPL v2 - http://www.gnu.org/licenses/old-licenses/gpl-2.0.html |
| 13 | 13 | |
| 14 | 14 | WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, firewall, 2FA, brute force login security, and more. |
| @@ -14,175 +14,150 @@ | ||
| 14 | 14 | WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, firewall, 2FA, brute force login security, and more. |
| 15 | 15 | |
| 16 | 16 | == Description == |
| 17 | 17 | |
| 18 | -**Defender adds the best in WordPress plugin security to your website with just a few clicks, including malware scanner, firewall, password protection, and login security features. Stop brute force login attacks, weak password usage, SQL injections, cross-site scripting (XSS), and other WordPress security vulnerabilities and hacks with Defender’s malware scanner, providing antivirus scans, IP blocking, firewall, activity log, security log, and two-factor authentication (2FA) login security.** | |
| 18 | +**Keep your sites safe from hackers, brute force attacks and malware with Defender, your easy-to-set-up, enterprise-level security plugin. With Defender, you can rely on the protection of a firewall, one-click hardening and 2FA, without having to be a cybersecurity expert.** | |
| 19 | 19 | |
| 20 | -No more complex security settings, Defender's malware scanner, firewall, and login security features add all the hardening and security you need. | |
| 20 | +As hackers continue to evolve, you know you need to stay on top of your site's security. But you don't have the time to learn to code, stay abreast of every emerging threat, or apply complicated technical settings. | |
| 21 | 21 | |
| 22 | -Defender is brought to you by the WordPress speed specialists that created Smush image optimization, now active on more than +1 million websites. | |
| 22 | +Defender is here to give you the powerful security tools you need, without the technical headaches. Trusted by over 1 million WordPress users, this plugin works immediately with no confusing setup. Just activate Defender and let it handle the rest! | |
| 23 | 23 | |
| 24 | -Plus, connect for free to WPMU DEV’s AntiBot Global Firewall to block harmful IPs with data from over 500,000 sites. | |
| 24 | +**Trusted by 1+ Million Sites | 4.8/5 Star Rating** | |
| 25 | 25 | |
| 26 | -**Enjoy complete site protection from malware, vulnerabilities, bot attacks, and session hijacking from the start with [Defender Pro](https://wpmudev.com/project/wp-defender/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro).** | |
| 26 | += Defender makes it easy to: = | |
| 27 | 27 | |
| 28 | -Level up security immediately with exclusive Pro features like scheduled malware scanning, Safe Repair for suspicious files, and known WordPress vulnerability detection. [Learn more about Pro](https://wpmudev.com/project/wp-defender/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro). | |
| 28 | +* Run on-demand malware scans to find suspicious files and code | |
| 29 | +* Block malicious IPs with a global firewall | |
| 30 | +* Enforce strong passwords, 2FA, and login limits | |
| 31 | +* Apply recommended hardening settings in one click | |
| 32 | +* Get clear reports that show what needs attention | |
| 33 | +* Protect against compromised passwords before they are used on your site | |
| 29 | 34 | |
| 30 | -### Security Recommendations | |
| 35 | += Free Malware Scanner: Stop security threats before they harm your site = | |
| 31 | 36 | |
| 32 | -Defender's one-click security hardening recommendations instantly adds layers of protection and security to your site. | |
| 37 | +If your site has been infected by malware, this malicious code can cause a lot of damage before you even realize it's there. Hackers use malware, often hidden in themes, extensions and plugins, to steal personal data, encrypt files for ransom, or spy on your activity. | |
| 33 | 38 | |
| 34 | -### Enhance Security and Block Hackers At Every Level: | |
| 39 | +Defender gives you a highly-effective yet easy-to-use malware scanner that runs deep diagnostics across your entire site, making sure no malware is lurking in the shadows. | |
| 35 | 40 | |
| 36 | -* **Malware Scanner** - Scan WordPress core files for modifications and unexpected changes which may be caused by malware. Scan for malware and tighten up the security of your files. | |
| 37 | -* **Outdated & Removed Plugins** – Scans for plugins removed from WordPress.org or not updated in 2+ years. | |
| 38 | -* **AntiBot Global Firewall** - Connect for free to WPMU DEV to block harmful IPs with data from over 500,000 sites. | |
| 39 | -* **WordPress Security Firewall** - Block or allowlist IPs, implement IP blocking, and Geo IP blocking, user agent banning and protect against brute force attacks. | |
| 40 | -* **Two-Factor Authentication (2FA)** - Easily set up better security with 2FA to prevent most login attacks such as brute force, App verification, backup codes, lost device email, WooCommerce 2FA, and Web Authentication. | |
| 41 | -* **Login Masking** - Change the location of WordPress's default login area to improve login security. | |
| 42 | -* **Login Lockout** - Failed login attempts lockout for even more security assurance. | |
| 43 | -* **User Agent Banning** - Fortify security by blocking bad bots and user agents from accessing your site. | |
| 44 | -* **Security Headers** - Add an extra layer of defense security and protect against common attacks like: XSS, code injection, and more. | |
| 45 | -* **404 Detection Security** - Automated block of bot IPs. | |
| 46 | -* **Security Configs** - Create your ideal Defender security plugin settings and export / import saved configs to any other site. | |
| 47 | -* **Geolocation IP Lockout Security** - Block users based on location and country (IP blocking). | |
| 48 | -* **Disable Trackbacks And Pingbacks** - Disable these notifications to enhance spam protection and site security. | |
| 49 | -* **Core And Server Update Security Recommendations** - Stay on top of your system security. | |
| 50 | -* **Antivirus Scan** - Scan for active security threats, viruses, and other malware. | |
| 51 | -* **Disable File Editor** - If they get in, they won't get far. | |
| 52 | -* **Hide Error Reporting** - Hide code errors on the frontend so hackers can’t exploit site security. | |
| 53 | -* **Update Security Keys** - Update old WordPress security keys to be more encrypted and provide better security. | |
| 54 | -* **Prevent Information Disclosure** - Improve server security and protect sensitive files by locking down specific file types. | |
| 55 | -* **Prevent PHP Execution** - Defender bolsters security by automatically preventing any PHP code from being executed. | |
| 56 | -* **Bulk Apply Security Recommendations** – Apply multiple recommended security improvements at once for quicker site hardening. | |
| 57 | -* **Google reCAPTCHA Security** - Easy to add, stop fraud and abuse - including BuddyPress and WooCommerce. | |
| 58 | -* **Cloudflare Turnstile** - Protect your site from spam and automated attacks without annoying captchas. | |
| 59 | -* **Pwned Password Check** - Increase security by protecting against compromised passwords. | |
| 60 | -* **Force Password Reset** - Force users with selected roles to reset passwords. | |
| 61 | -* **Force Strong Passwords** – Ensure users create secure credentials by enforcing robust password requirements. | |
| 62 | -* **User Agent Blocklist Presets** – Easily block unwanted bots and scripts using curated user agent presets. | |
| 63 | -* **Known Vulnerability & Suspicious Code Scan (Pro Only)** – Scan WordPress core, themes, and plugins for vulnerabilities and harmful code. | |
| 64 | -* **Malicious Bot Detector (Pro Only)** – Block malicious bots with layered defenses, including traps for bots that ignore robots.txt and checks for fake crawlers posing as search engines. | |
| 65 | -* **Google Blocklist Monitoring (Pro Only)** – Get instant alerts if your site is flagged by Google. | |
| 66 | -* **Session Protection (Pro Only)** – Stop session hijacking and prevent unauthorized account access. | |
| 67 | -* **Safe Repair For Suspicious Files (Pro Only)** – Restore or replace compromised files safely with a single click. | |
| 68 | -* **Automated Reports (Pro Only)** – Receive scheduled security reports straight to your inbox. | |
| 41 | +Defender will scan your site for: | |
| 69 | 42 | |
| 70 | -### Learn The Ropes With These Hands-On Defender Security Plugin Tutorials | |
| 43 | +* **Files that have changed unexpectedly:** The scan will compare all core files and extensions against the official WordPress repository and flag any modifications or rogue additions instantly. | |
| 44 | +* **Known vulnerabilities:** Defender will check verified exploit registries to catch any security gaps in your active themes, plugins and core version, and help you fix them before they can be targeted. | |
| 45 | +* **Suspicious code:** By continually checking your server files, Defender will spot any potential code injections or backdoors, a common way bad actors try to gain access to your site. | |
| 46 | +* **Outdated & removed plugins:** Plugins that have been delisted from the repository or have not been updated in over two years become a significant risk to your site's integrity. Defender flags these weak spots before they can cause a problem. | |
| 71 | 47 | |
| 72 | -* [How to Get the Most Out of Defender Security](https://wpmudev.com/blog/how-to-get-the-most-out-of-defender-security/) | |
| 73 | -* [How to Stop Hackers in Their Tracks with Defender Security](https://wpmudev.com/blog/stop-hackers-with-defender-wordpress-security-plugin/) | |
| 74 | -* [Find Out if You're Hacked: How to Find and Delete Suspicious Code with Defender Security](https://wpmudev.com/blog/delete-suspicious-code-defender/) | |
| 75 | -* [How to Create a Powerful and Secure Customized Firewall with Defender Security](https://wpmudev.com/blog/defender-ip-address-lockout-firewall/) | |
| 48 | += AntiBot Global Firewall: Block harmful IPs with data from over 750,000 sites = | |
| 76 | 49 | |
| 77 | -### WordPress Security Scans | |
| 78 | -Defender's malware scanner security checks for suspicious code and malware. It also compares your WordPress install with the WP directory master copy, and reports any changes so you can restore the original file with a click. | |
| 50 | +Put the collective threat intelligence of a massive network to work for your site. Powered by real-time threat data from over 750,000+ sites, the free AntiBot Global Firewall automatically blocks harmful traffic and spam bots with a single click. | |
| 79 | 51 | |
| 80 | -### Two-Factor Authentication (2FA) Security | |
| 52 | +When any site on our network flags a threat, all other sites get protected too. It's like having a bouncer for your website. If an IP is on the blocklist (updated every 12 hours), they're not getting in! | |
| 81 | 53 | |
| 82 | -Easily add an extra layer of protection and security to your WordPress sites with Defender's two-factor authentication (2FA) features. Including: mobile app verification (Google Authenticator, Microsoft Authenticator, Authy), backup code generation, lost device emails, WooCommerce 2FA, Biometric Authentication (fingerprint/facial recognition), and Hardware Key Authentication (USB security keys). Easily prevent brute force attacks and login security vulnerabilities. | |
| 54 | +The most important part is, you'll be in complete control. | |
| 83 | 55 | |
| 84 | -### Login Protection | |
| 56 | +* **User-friendly setup:** Defender Pro gives you AntiBot on every site you connect, regardless of where they're hosted. Just flip the switch and it'll start working so efficiently you won't even notice it's there. | |
| 57 | +* **Choose your security level:** Basic Mode offers balanced, everyday protection, while Strict Mode offers tighter security that blocks even the slightest suspicious activity. | |
| 58 | +* **Manage IPs in The Hub:** Manually block specific IPs, apply blocklists and allowlists across all sites, implement Geo IP blocking and configure everything from one central dashboard. | |
| 85 | 59 | |
| 86 | -Brute force attacks are no match for Defender's login security. Limit login attempts so hackers can't guess passwords. Permanently ban IPs or trigger a timed lockout after a set number of failed login attempts. Use Geo IP blocking to ban users from specific countries or locations. | |
| 60 | +Want to see AntiBot in action? You can click [here](https://wpmudev.com/antibot-global-firewall-statistics/) to get a real-time look at the malicious IPs and suspicious requests it's detected and blocked in the last 24 hours. | |
| 87 | 61 | |
| 88 | -### Firewall Security and IP Manager | |
| 62 | += Firewall Security & IP Management: Take control over your site's traffic = | |
| 89 | 63 | |
| 90 | -Improve your website security with Defender's IP manager and firewall. Manually block specific IPs, import a list of banned IPs, and set automated timed and permanent lockouts. Defender makes it easy to block and unblock specific locations quickly thanks to its advanced firewall security(WAF) offering Geographical IP blocking. | |
| 64 | +Defender's advanced Web Application Firewall (WAF) makes it easy to lock out hackers, scrapers, and malicious bots without touching a single line of code. | |
| 91 | 65 | |
| 92 | -### User Agent Banning | |
| 66 | +* **Advanced IP Lockouts:** Manually block specific IPs, import custom blocklists, or set automated timed and permanent lockouts for repeat offenders. | |
| 67 | +* **Geo IP Blocking:** Instantly ban traffic from specific countries or geographic locations with a single click. | |
| 68 | +* **User Agent Banning:** Instantly block spam and scrapers using built-in bad bot presets. We automatically allowlist major search engines to protect your SEO. | |
| 69 | +* **Malicious Bot Detector:** Deploy layered defenses to trap aggressive bots that ignore your robots.txt rules and catch fake crawlers impersonating legitimate search engines. | |
| 93 | 70 | |
| 94 | -Add user agents to the block or allowlist and stop bad bots from spamming and scraping your site. All major search engines and special network bots are allow-listed out of the box. Easy to set up, Defender's user agent banning tool now includes built-in bot and script presets to help you quickly block malicious traffic. It does all the security work for you—no editing of the .htaccess file required. | |
| 71 | += Login Security & 2FA: Prevent unauthorized access = | |
| 95 | 72 | |
| 96 | -### Google reCAPTCHA Integration | |
| 73 | +Make sure the only users logging into your WordPress site are the ones you actually *want*. Defender can protect your sites from unauthorized access or brute force attacks with sophisticated login security features. | |
| 97 | 74 | |
| 98 | -Add reCAPTCHA security to your login / registration pages, lost password forms, and post comments in a couple of steps to up security and help protect from fraud and abuse. Select reCAPTCHA type, language, location, and style to suit. As well as Google, Defender also supports the following reCAPTCHA types: | |
| 75 | +These features keep your site safe from malicious logins, while still ensuring legitimate users can log in easily. | |
| 99 | 76 | |
| 100 | -* BuddyPress reCAPTCHA | |
| 101 | -* WooCommerce reCAPTCHA | |
| 77 | +* **Hide Login URL:** Change the location of WordPress's default login area, making it harder for automated bots to find and more convenient for your users. | |
| 78 | +* **Session Security:** Protect your site from session hijacking, preventing attackers from stealing session tokens to impersonate users and gain unauthorized access to your website. | |
| 79 | +* **Smart Password Rules:** Enforce strong passwords for new registrations, automatically block compromised credentials using a public "pwned" passwords database, limit login attempts so hackers can't guess passwords, and force a site-wide password reset upon the next login if you suspect a security breach. | |
| 80 | +* **Two-Factor Authentication (2FA):** Add an extra layer of protection and security to your WordPress sites to prevent brute force attacks and login security vulnerabilities. Defender's two-factor authentication (2FA) features include plenty of ways to verify logins, from mobile app verification (Google Authenticator, Authy) to Biometric Authentication (fingerprint/facial recognition) to Hardware Key Authentication (USB security keys.) Plus, built-in backup code generation, lost device emails and WooCommerce 2FA. | |
| 102 | 81 | |
| 103 | -### Login Screen Masking | |
| 82 | += Security Hardening: Apply recommended settings with a single click = | |
| 104 | 83 | |
| 105 | -Defender makes it easy to move your login screen to a custom URL. Not only does login screen masking improve security, but it also lets you white label your login user experience and improves branding. | |
| 84 | +WordPress security hardening is all about adding multiple layers of protection to your website, to reduce your risk of attacks and unauthorized access. | |
| 106 | 85 | |
| 107 | -### Force Password Reset | |
| 86 | +Defender makes it easy to do this, with 12 recommended hardening settings you can apply with one click. | |
| 108 | 87 | |
| 109 | -Enhance site security by forcing all users with selected roles to reset their password at any time. Especially helpful if you suspect a possible data breach on your site. | |
| 88 | +For example, Defender's hardening settings include: | |
| 110 | 89 | |
| 111 | -### Security Headers | |
| 90 | +* Disabling the file editor to stop internal tampering | |
| 91 | +* Updating outdated security keys | |
| 92 | +* Hiding PHP error reporting on the frontend | |
| 93 | +* Adding advanced security headers (XSS protection, Strict Transport, etc.) | |
| 94 | +* Disabling trackbacks and pingbacks to prevent spam | |
| 112 | 95 | |
| 113 | -Protect your site against common attacks, such as: XSS, code injection, cross site scripting, and more. Enable the following security headers: | |
| 96 | += Automated Defenses: Protect your entire site, on autopilot = | |
| 114 | 97 | |
| 115 | -* X-Frame-Options | |
| 116 | -* X-XSS-Protection | |
| 117 | -* X-Content-Type-Options | |
| 118 | -* Strict Transport | |
| 119 | -* Referrer Policy | |
| 120 | -* Permissions-Policy | |
| 98 | +You've got a lot to handle while running your business, wouldn't it be nice if security was something you could set and forget? [Learn more about Defender Pro](https://wpmudev.com/project/wp-defender/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro). | |
| 121 | 99 | |
| 122 | -### 404 Limiter | |
| 123 | -Detect when bots are being used to scan your site for security vulnerabilities and shut them down. The 404 limiter lets you stop the scan by detecting when a bot keeps visiting pages that do not exist, which can also save you from a giant strain on your site's performance. | |
| 100 | +With Defender, you can put your security on autopilot. It'll be working around the clock with hands-off, automated defenses that run seamlessly in the background to keep intruders out and your data safe. | |
| 124 | 101 | |
| 125 | -### Security Notifications and Reports | |
| 126 | -Defender runs surveillance and sends security notifications with information that matters. All activity and notifications are recorded in the activity log to let you see at a glance the website security actions that have been taken by the Defender security plugin. | |
| 102 | +Here's what Defender will be doing while you work on other things: | |
| 127 | 103 | |
| 128 | -### Reduce Security Setup Time With Saved Configs | |
| 104 | +* **Performing scheduled scans for issues:** Set up regular scans that look for malicious code, suspicious code injections, vulnerabilities, abandoned plugins, and missing hardening recommendations. | |
| 105 | +* **Creating automated security reports:** Stay informed with health updates and immediate threat summaries delivered directly to your inbox. | |
| 106 | +* **Keeping audit logs:** Defender logs key site activity — logins, user changes, plugin and theme updates, content edits, and settings changes — so you can track what happened and when. | |
| 129 | 107 | |
| 130 | -Save your Defender security plugin configurations and reapply them to your other sites in just a few clicks. You can create and save an unlimited number of security configurations. | |
| 108 | += Why choose Defender? = | |
| 131 | 109 | |
| 132 | -### Pwned Password Check | |
| 110 | +There are plenty of WordPress security plugins out there, but many make it needlessly complicated to protect your site. Defender keeps the essentials simple. | |
| 133 | 111 | |
| 134 | -Entered passwords are checked against public database breach records to further boost security. If a password is identified as compromised, the user will be asked to change it. | |
| 112 | +You can scan for malware, block harmful traffic, strengthen login security, and harden your site from one plugin, without digging through confusing technical options. | |
| 135 | 113 | |
| 136 | -### Custom IP Block/Allowlist | |
| 114 | +It's built specifically for WordPress, trusted across the WPMU DEV ecosystem, and designed to help you protect your site without slowing down your work. | |
| 137 | 115 | |
| 138 | -Create your IP block/allow list once, then apply and automatically sync it to all your other sites with just a single click. Save hours by not having to manually add IPs to each individual site. *Note: a [free WPMU DEV account] (https://wpmudev.com/register) is required to access this feature. | |
| 116 | +With Defender, you get: | |
| 139 | 117 | |
| 140 | -### What Do People Say About Defender? | |
| 118 | +* Security trusted by over 1 million WordPress users | |
| 119 | +* Protection built specifically for WordPress vulnerabilities | |
| 120 | +* Regular updates and threat intelligence improvements | |
| 121 | +* Malware scanning, firewall protection, and login security in one plugin | |
| 122 | +* Support from the award-winning WPMU DEV team | |
| 141 | 123 | |
| 142 | -★★★★★ | |
| 143 | -"I found other pro security plugins a bit too fiddly for my taste...I'm delighted with Defender" - <a href="https://profiles.wordpress.org/keithadv">KeithADV</a> | |
| 124 | +So you get serious WordPress security, without the overwhelming setup. | |
| 144 | 125 | |
| 145 | -★★★★★ | |
| 146 | -"Thank you for bringing back a free and easy to use 2-Factor Authentication after Clef! Defender helps keep me aware of my site's security." - <a href="https://wordpress.org/support/users/awijasa/">awijasa</a> | |
| 126 | += Built for speed and security = | |
| 147 | 127 | |
| 148 | -★★★★★ | |
| 149 | -"Defender's interface is very intuitive with warnings that are very helpful" - <a href="https://wpmudev.com/profile/djohns">djohns</a> | |
| 128 | +A security plugin should protect your site without getting in the way. | |
| 150 | 129 | |
| 151 | -★★★★★ | |
| 152 | -"Defender Recently blocked over 3000 attacks in one week without any noticeable impact on the website. WPMUDEV knocking it out of the park on this one." - <a href="https://wpmudev.com/profile/davidoswald/">David Oswald</a> | |
| 130 | +Defender is built to stop threats before they waste your server resources, with lightweight protection that runs quietly in the background. | |
| 153 | 131 | |
| 154 | -### Secure Websites, More Trust, Better Profit | |
| 155 | -If you're running a business website or eCommerce store, privacy, security, uptime and trust are essential. | |
| 132 | +With Defender, you can: | |
| 156 | 133 | |
| 157 | -The Defender security plugin is here to help you: it's a one of a kind WordPress security plugin that makes web security easy for anyone, for free! | |
| 134 | +* Detect and limit 404 bots before they drain server resources | |
| 135 | +* Run malware scans without overloading your CPU | |
| 136 | +* Keep your site protected without adding performance drag | |
| 158 | 137 | |
| 159 | -* Malware scanner | |
| 160 | -* Google two-factor authentication (2FA) | |
| 161 | -* Web Authentication | |
| 162 | -* Firewall setup and configuration | |
| 163 | -* One-click site hardening and security tweaking | |
| 164 | -* WordPress core file scanning and repair | |
| 165 | -* Ongoing firewall security | |
| 166 | -* Google reCAPTCHA | |
| 167 | -* Security headers | |
| 168 | -* One-click security configs | |
| 169 | -* Login Screen Masking | |
| 170 | -* Pwned Password Check | |
| 171 | -* IP Blocklist manager and logging | |
| 172 | -* Geo IP blocking | |
| 173 | -* User agent banning | |
| 174 | -* Unlimited file scans | |
| 175 | -* Timed Lockout brute force login attack shield for login security | |
| 176 | -* 404 limiter for blocking vulnerability scans | |
| 177 | -* IP lockout notifications and security reports | |
| 138 | +So you get the security your site needs, without making visitors wait for it. | |
| 178 | 139 | |
| 179 | -All the above is free and will enhance WordPress security for you. If you need extra security for your WordPress site, [you should get a WPMU DEV Membership](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=you_should_get_wpmudev_membership#trial). | |
| 140 | += Works with your existing setup = | |
| 180 | 141 | |
| 181 | -Our Membership gives you access to Defender Pro - which security features include automated scanning, scheduled malware scans for Core, themes, plugins and other files, audit logs, firewall protection, Safe Repair, Blocklist monitoring - alongside Snapshot Pro cloud backups, the Hub with automated plugin, theme and core updates and safe-upgrade scans, all our premium WordPress plugins, 24/7 WordPress support and if your sites already been hacked our team of security experts will clean it up at no additional cost. | |
| 142 | +You shouldn't have to change your plugins, tools or workflow just to secure your site. Defender works smoothly with your current WordPress setup. | |
| 182 | 143 | |
| 183 | -[It's an incredible deal, and you can find out more here](https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=and_you_can_find_out_more_here#trial). | |
| 144 | +With Defender, you can: | |
| 184 | 145 | |
| 146 | +* Protect WooCommerce, BuddyPress, and sites built with major page builders | |
| 147 | +* Apply saved security configs across multiple sites in a few clicks | |
| 148 | +* Enable and configure protection alongside your favorite plugins | |
| 149 | + | |
| 150 | +So you get the security your site needs, without getting in the way of the plugins, tools, and workflows you already rely on. | |
| 151 | + | |
| 152 | += Get started in minutes = | |
| 153 | + | |
| 154 | +Defender works as soon as you activate it. | |
| 155 | + | |
| 156 | +Install the plugin, run your first malware scan, enable your firewall, strengthen login security, and apply recommended hardening settings in just a few clicks. Defender shows you what needs attention, so you can lock down your site without editing code or guessing which settings matter. | |
| 157 | + | |
| 158 | +Just install Defender, switch on the protections you need, and let it handle the rest. | |
| 159 | + | |
| 185 | 160 | == Frequently Asked Questions == |
| 186 | 161 | |
| 187 | 162 | = Why should I choose Defender over other security plugins? = |
| 188 | 163 | |
| @@ -245,14 +220,13 @@ | ||
| 245 | 220 | Please open a new thread in Defender's [support forum](https://wordpress.org/support/plugin/defender-security/). Our support team is always happy to help! |
| 246 | 221 | |
| 247 | 222 | == Screenshots == |
| 248 | 223 | |
| 249 | -1. Malware scans and one-click website security hardening recommendations. | |
| 250 | -2. Layered security recommendations let you harden your site with a few clicks. | |
| 251 | -3. Enable AntiBot & Local Firewall for smart, layered defense against bots and brute-force attacks. | |
| 252 | -4. Keep your account safe with 2FA options including TOTP apps, backup codes, and secure fallback methods. | |
| 253 | -5. Use built-in password rules to ensure only secure, uncompromised passwords are used. | |
| 254 | -6. Never miss a threat—Defender emails you security updates on your schedule. | |
| 224 | +1. Easily configure optimal security settings in just a few clicks. | |
| 225 | +2. Monitor site security status, active threats, firewall, and scan recommendations at a glance. | |
| 226 | +3. Automatically block malicious IPs and safeguard your site against automated attacks. | |
| 227 | +4. One-click security tweaks like disabling XML-RPC and hiding login URLs to lock down your site. | |
| 228 | +5. Set up reCAPTCHA or Cloudflare Turnstile to prevent spam and brute-force logins. | |
| 255 | 229 | |
| 256 | 230 | == Installation == |
| 257 | 231 | |
| 258 | 232 | 1. Upload the `wp-defender` plugin to your `/wp-content/plugins/` directory. |
| @@ -261,105 +235,114 @@ | ||
| 261 | 235 | 4. Done! |
| 262 | 236 | |
| 263 | 237 | == Changelog == |
| 264 | 238 | |
| 265 | -= 5.7.0 ( 2025-11-18 ) = | |
| 239 | += 6.3.0 ( 2026-09-22 ) = | |
| 266 | 240 | |
| 267 | -- New: Cloudflare Turnstile integration | |
| 268 | -- Enhance: Compatibility with WordPress 6.9 | |
| 269 | -- Enhance: Redesigned CAPTCHA menu | |
| 270 | -- Enhance: Optimize database performance on multisite | |
| 271 | -- Enhance: Add additional widget IDs on Defender’s Dashboard page | |
| 272 | -- Enhance: Add new hooks to simplify Audit testing and Firewall logs deletion | |
| 273 | -- Enhance: Update minimum supported PHP version to 8.0 | |
| 274 | -- Enhance: Disable New Scan button until the background scan is complete | |
| 275 | -- Enhance: Migrate Security Recommendations multisite events to the centralized Cron Manager system | |
| 276 | -- Enhance: Migrate Malware Scanning multisite events to the centralized Cron Manager system | |
| 277 | -- Enhance: Tracking improvements | |
| 278 | -- Fix: Masking URL displays a notice when using a slug already assigned to another page | |
| 279 | -- Fix: Defender not detecting some outdated plugins | |
| 280 | -- Fix: Recommended PHP version appears as NULL on WP Engine hosting | |
| 281 | -- Fix: Default Security Config name and description not saving properly | |
| 282 | -- Fix: UI improvements | |
| 241 | +- Enhancement: Update malware signatures | |
| 242 | +- Enhancement: Make Scan settings uneditable while scanning is in progress | |
| 243 | +- Enhancement: Upgrade node packages | |
| 244 | +- Enhancement: Display country name tooltip on country flag hover in Firewall Logs | |
| 245 | +- Enhancement: Reduce the plugin archive size by removing legacy code in some files | |
| 246 | +- Enhancement: Translation improvements | |
| 247 | +- Enhancement: Display scan details of issue with a suspicious code with automatic scrolling | |
| 248 | +- Enhancement: Update support and product roadmap links | |
| 249 | +- Enhancement: DOM improvements when Pwned/Strong passwords are enabled | |
| 250 | +- Enhancement: Style improvements on Issues page | |
| 251 | +- Enhancement: Scan progress bar improvements | |
| 252 | +- Enhancement: Placeholder copy for Files, folders and file types field | |
| 253 | +- Enhancement: Show count of lockouts in the notice within Malicious Bot detector | |
| 254 | +- Enhancement: Improve config applying message | |
| 255 | +- Fix: Unlock Pro features on free plan for sites hosted by WPMU DEV | |
| 256 | +- Fix: Passing null to parameter #1 on class-malicious-bot.php | |
| 257 | +- Fix: Audit logs are causing an error when updating menu items | |
| 258 | +- Fix: Defender blocking entire America if Armenia is blocked in geoblocking | |
| 259 | +- Fix: Messaging missing for the config file imports | |
| 260 | +- Fix: Defender > Strong passwords option breaks the WP Application Password | |
| 261 | +- Fix: Dropdown scroll issue in smaller screens | |
| 262 | +- Fix: Overlapping modals on Dashboard page | |
| 263 | +- Fix: Minor code improvements | |
| 283 | 264 | |
| 284 | -= 5.6.2 ( 2025-11-20 ) = | |
| 265 | += 6.2.4 ( 2026-09-01 ) = | |
| 285 | 266 | |
| 286 | -- Enhance: Miscellaneousness improvements | |
| 267 | +- Fix: Username does not appear in some Audit Log events | |
| 268 | +- Fix: Audit module stores un-interpolated {{user_login}} in some logs | |
| 269 | +- Fix: Minor improvements in vulnerability detection | |
| 287 | 270 | |
| 288 | -= 5.6.1 ( 2025-10-21 ) = | |
| 271 | += 6.2.3 ( 2026-08-31 ) = | |
| 289 | 272 | |
| 290 | -- Fix: Malicious Bot Detector blocking Facebook Sharing Debugger bot | |
| 273 | +- Enhancement: Improved Audit Log UI across Dashboard and Audit Log pages | |
| 274 | +- Enhancement: Added a "Save your API keys to load" preview state for Bot Protection CAPTCHA settings | |
| 275 | +- Enhancement: Updated the event type label in the detailed Audit Log view from 'Content' to 'Context' | |
| 276 | +- Fix: Resolved an issue where audit log events from multi-event requests were not synchronizing to the Hub | |
| 277 | +- Fix: Fixed a UI layout issue when editing Nginx configuration under Hardening > Prevent Information Disclosure | |
| 278 | +- Fix: Addressed a deprecation notice for Webauthn::verify_response() | |
| 279 | +- Fix: Fixed a visual bug where the "Learn how we detect your IP" link overlapped the background border at 1280px screen widths | |
| 280 | +- Fix: Minor code improvements | |
| 291 | 281 | |
| 292 | -= 5.6.0 ( 2025-10-07 ) = | |
| 282 | += 6.2.2 ( 2026-08-24 ) = | |
| 293 | 283 | |
| 294 | -- New: Malicious Bot Detector | |
| 295 | -- New: WooCommerce integration with Defender > Strong Password | |
| 296 | -- Enhance: Migrate Audit multisite events to the centralized Cron Manager system | |
| 297 | -- Enhance: Migrate Firewall multisite events to the centralized Cron Manager system | |
| 298 | -- Enhance: Improve plugin detection logic to exclude plugins not from wp.org | |
| 299 | -- Enhance: Remove AntiBot IP list after site disconnection | |
| 300 | -- Enhance: Add rel="nofollow" to Bot Trap URL | |
| 301 | -- Enhance: Hide Blocklist Checker and AntiBot Stats button when Whitelabel is enabled | |
| 302 | -- Enhance: Sync with the Custom IP Block/Allow list across different hosting memberships | |
| 303 | -- Enhance: Add parameter to WP-CLI Scan command for outdated and closed plugins | |
| 304 | -- Enhance: Add audit logging event to detect Hub SSO login | |
| 305 | -- Enhance: Improve plugin code style using PHPStan and ESLint rules | |
| 306 | -- Fix: Web Authentication improvements | |
| 307 | -- Fix: Security Recommendations > Security key value not saved | |
| 308 | -- Fix: Defender not adding noindex tag to secret link of Bot Trap | |
| 309 | -- Fix: Notification hints not displaying properly | |
| 310 | -- Fix: Issue on Firewall Logs page when logging in with an expired session using the default WordPress login modal | |
| 311 | -- Fix: Defender country blocklist not working for EU region and UK | |
| 284 | +- Fix: Streamlined schema method by removing bootstrap trait | |
| 312 | 285 | |
| 313 | -= 5.5.1 ( 2025-09-04 ) = | |
| 286 | += 6.2.1 ( 2026-08-20 ) = | |
| 314 | 287 | |
| 315 | -- Enhance: Change Outdated Plugin threshold to 2 Years | |
| 316 | -- Enhance: Create hook to customize Outdated Plugin threshold | |
| 288 | +- Fix: 2FA > Web Authentication method binds credential verification to the target user (props: Tai) | |
| 317 | 289 | |
| 318 | -= 5.5.0 ( 2025-09-02 ) = | |
| 290 | += 6.2.0 ( 2026-08-18 ) = | |
| 319 | 291 | |
| 320 | -- New: Detection of outdated and removed plugins in scans | |
| 321 | -- New: Scan process runs in the background | |
| 322 | -- Enhance: Display User Agent name in Bot Trap logs | |
| 323 | -- Enhance: Improve Blocklist Lockout with updates for the move_uploaded_file function | |
| 324 | -- Enhance: Update YARA rules for better Malware detection | |
| 325 | -- Enhance: Tab improvements in Security Headers | |
| 326 | -- Enhance: Improve WooCommerce compatibility with Force Strong and Pwned Password features | |
| 327 | -- Enhance: Enable "Unlock Me" option by default on AntiBot activation | |
| 328 | -- Enhance: Migrate "audit_clean_up_logs" multisite event to the centralized Cron Manager system | |
| 329 | -- Enhance: Rename "File Change Detection" to "Issue Type" on the Malware Scanning page | |
| 330 | -- Enhance: Remove "In progress" upsell during onboarding | |
| 331 | -- Enhance: Improve flow for expired members | |
| 332 | -- Enhance: Improve code style in Defender core | |
| 333 | -- Fix: Defender Bot Trap causing invalid robots.txt | |
| 334 | -- Fix: Blank Defender > Get Started page when WPMU DEV branding is enabled | |
| 335 | -- Fix: Error on WooCommerce > Login page when logging in using a weak password and Strong Passwords option is enabled | |
| 336 | -- Fix: Improve Vulnerability Scan for free and premium plugins using the same slug | |
| 337 | -- Fix: Default login pages return error 500 instead of 403 when Mask Login area is active and configured | |
| 292 | +- New: Audit Log for Free Hub and WP.org users | |
| 293 | +- Enhancement: Compatibility with WordPress 7.1 | |
| 294 | +- Enhancement: Replace PHP-DI third-party package with custom lightweight DI Container | |
| 295 | +- Enhancement: Display the Audit Log Storage retention setting | |
| 296 | +- Enhancement: Handle UI state when all scan types are disabled on the Settings page | |
| 297 | +- Enhancement: Update WPMU DEV domain in Audit service codebase | |
| 298 | +- Enhancement: Validate secret-key API response before writing to wp-config.php | |
| 299 | +- Enhancement: Improve toast message when attempting to disable the last enabled Malware Scan type | |
| 300 | +- Enhancement: Remove dash-notice submodule | |
| 301 | +- Enhancement: Ensure all scan status messages are displayed during scan progress | |
| 302 | +- Enhancement: Improving user communication while the site is connecting to the Hub | |
| 303 | +- Fix: Clicking on 'View Logs' link does not filter Firewall Logs after the redirect | |
| 304 | +- Fix: Security improvements on Hub-Connector (props: Jakub Herman) | |
| 305 | +- Fix: Prevent adding duplicate recipient email addresses in Reports and Alerts | |
| 306 | +- Fix: Changing the default report template should not affect existing recipient(s) preferences | |
| 307 | +- Fix: Fix responsive layout issues on Dashboard, Two-Factor Auth and Other Settings plugin pages | |
| 308 | +- Fix: Reverting to Defender 5 causes JavaScript errors on the Notifications page | |
| 309 | +- Fix: Recipients don't receive email for all types of 'Firewall Alert' when a firewall lockout is enabled and triggered for XSS, Fake Bot, or 'Non-installed plugin lockout' | |
| 310 | +- Fix: Logs are displayed without timezone on Audit and Firewall log pages | |
| 311 | +- Fix: Improve Malware Alert and Report flow for 'always_send' and 'error_send' params | |
| 312 | +- Fix: Email notifications title issue with apostrophes | |
| 313 | +- Fix: The scheduled time notice does not show after the Free upgrade | |
| 314 | +- Fix: Defender Welcome Modal is displayed in wrong version | |
| 315 | +- Fix: 3 strings were not imported for translation due to emoji | |
| 316 | +- Fix: Unable to access the Custom Rules page | |
| 317 | +- Fix: Force Authentication is not restricted to roles enabled under User Roles | |
| 318 | +- Fix: Settings page layout breaks at 1280px with horizontal scrollbar | |
| 319 | +- Fix: Incorrect 'Enable Bot Protection' modal on disabled reCAPTCHA toggles | |
| 320 | +- Fix: Pagination remains visible after ignoring all files and only disappears after clicking a page | |
| 321 | +- Fix: Defender Audit Logs creates incorrect and duplicate entries when updating General Settings | |
| 322 | +- Fix: Minor code improvements | |
| 338 | 323 | |
| 339 | -= 5.4.1 ( 2025-08-05 ) = | |
| 324 | += 6.1.0 ( 2026-07-22 ) = | |
| 340 | 325 | |
| 341 | -- Enhance: Add a button to direct the users to the AntiBot Statistics page | |
| 342 | -- Enhance: Improve Bot Trap flow | |
| 343 | -- Fix: UI Improvements | |
| 326 | +- Enhancement: Improved compatibility of Central IP list status with Unlimited Hosting environments | |
| 327 | +- Enhancement: Extended Whitelabel support to cover Global Firewall branding | |
| 328 | +- Enhancement: User Agent lockout features reflected in the overall lockout count alongside 404 and Login lockouts | |
| 329 | +- Enhancement: Added tooltip for the "Security actions required" badge and confirmation notice after applying configuration presets | |
| 330 | +- Enhancement: Improved recipient name validation in Reports & Alerts and smarter alert scheduling for months with fewer than 31 days | |
| 331 | +- Enhancement: Users remain on the current page after connecting to the Hub | |
| 332 | +- Enhancement: Updated CVSS score handling for outdated plugin issues | |
| 333 | +- Enhancement: Updated Defender icon, configuration branding, dropdown design, and Hub Connector submodule | |
| 334 | +- Fix: Resolved multiple v5 to v6 upgrade issues where notification, 2FA, and Usage Tracking settings were incorrectly reset or disabled | |
| 335 | +- Fix: Fixed errors triggered by third-party plugin conflicts and Notification model properties | |
| 336 | +- Fix: Fixed WP-CLI command handling, including duplicate scan lines and missing subcommands | |
| 337 | +- Fix: Resolved AntiBot and Bot Protection state issues, including Unlock Me button and feature activation modal | |
| 338 | +- Fix: Fixed Firewall Logs status filter, IPv6 Blocklist lookup, and custom IP block/allow list sync | |
| 339 | +- Fix: Fixed UI issues including pagination, file details panel truncation, and config dialog behavior | |
| 340 | +- Fix: Minor code improvements, PHP warning fixes, and performance refinements | |
| 344 | 341 | |
| 345 | -= 5.4.0 ( 2025-07-22 ) = | |
| 342 | += 6.0.1 ( 2026-07-08 ) = | |
| 346 | 343 | |
| 347 | -- New: User Agent Blocklist Presets | |
| 348 | -- New: Bot Trap to block spam User Agent IPs | |
| 349 | -- Enhance: Update Vue.js and Axios versions and related packages | |
| 350 | -- Enhance: Remove Tutorials menu and widget | |
| 351 | -- Enhance: Remove widget on Dashboard page to discover other free plugins by WPMU DEV | |
| 352 | -- Enhance: Remove recommended-plugins-notice submodule for Free version | |
| 353 | -- Enhance: Update Malware Signatures to detect suspicious code | |
| 354 | -- Enhance: Remove "Add Spam User Agents" button | |
| 355 | -- Enhance: Create new wd_404_attempt hook to extend 404 Detection flow | |
| 356 | -- Enhance: Add Session key to config structure | |
| 357 | -- Enhance: Add Force Strong Password key to config structure | |
| 358 | -- Fix: Defender forcibly logs out users for inactivity | |
| 359 | -- Fix: Unable to save secure password when Strong Passwords and Password Reset are both enabled | |
| 360 | -- Fix: Documentation buttons are missing aria-hidden tag | |
| 361 | -- Fix: Error when creating multisite and running Malware Scan | |
| 344 | +- Fix: Resolved a fatal error caused by legacy null date values | |
| 362 | 345 | |
| 363 | 346 | [Changelog for previous versions](https://wpmudev.com/project/wp-defender/#view-changelog). |
| 364 | 347 | |
| 365 | 348 | == Upgrade Notice == |
