SiteFort Security

SiteFort is a prevention-first WordPress security plugin that combines security hardening, firewall and bot protection, login security and 2FA, vulnerability scanning, and malware detection in one protection layer. It blocks common attack paths early, before they turn into compromises, while supported firewall rules can sync to Cloudflare for enforcement at the edge.

SiteFort’s cloud-assisted malware scanner verifies trusted files by hash and sends only unknown or suspicious files for deep threat analysis, keeping scans reliable even on shared and lower-resource hosting.

Security hardening, firewall protection, login security, 2FA, and vulnerability scanning are free forever.

Core WordPress Security Features

• WordPress Security Hardening: Reduces common exposure through XML-RPC, user enumeration, sensitive files, direct PHP execution, REST access, security headers, and other WordPress security controls.
• Firewall & Bot Protection: Blocks vulnerability probes, abusive requests, malicious traffic, and unwanted automation with IP, country, rate limiting, and configurable bot controls. Supported rules can also sync to Cloudflare for edge enforcement.
• Login Security & 2FA: Protects WordPress login, WooCommerce customer accounts, and membership account access with two-factor authentication, CAPTCHA, brute-force lockouts, a custom login URL, breached-password checks, and password policies.
• Vulnerability Scanner: Checks WordPress core, plugins, and themes for known vulnerabilities, affected versions, severity, CVE references where available, and remediation guidance.
• Cloud-Assisted Malware Scanner: Detects backdoors, web shells, injected code, malicious redirects, SEO spam, and suspicious file changes, with deep threat analysis in the cloud to reduce server load.
• Compromise & Reputation Checks: Detects suspicious administrator accounts, injected content, unsafe URLs, exposed sensitive files, malicious redirects, and domain or server reputation issues.

WordPress Security Hardening

SiteFort provides simple, toggle-based WordPress hardening controls to reduce common security exposure and shrink the attack surface.

• Sensitive File Protection: Blocks public access to WordPress configuration backups, database dumps, debug logs, backup files, installer files, and other sensitive resources, including exposed .env or .git data when present.
• PHP Execution Protection: Blocks PHP execution in uploads and restricts direct access to PHP files in plugin and theme directories.
• XML-RPC Controls: Disable XML-RPC, restrict authentication, or block pingback abuse.
• User Enumeration Blocking: Reduces username exposure through author archives, REST endpoints, and common discovery paths.
• REST & Application Password Controls: Restricts REST API access and controls WordPress Application Passwords based on site requirements.
• File Editor Protection: Disables the built-in WordPress theme and plugin file editor.
• Directory Browsing Protection: Disables directory listing to reduce file discovery and unintended information exposure.
• Security Headers: Analyze and manage CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and disclosure headers.
• Version & Metadata Cleanup: Reduces exposed WordPress version, generator, and header information.
• Protection Verification: Confirms supported hardening protections are active and identifies items that require manual hosting or server configuration.

WordPress Malware Scanner

SiteFort combines hash-first file verification with cloud-assisted deep threat analysis to detect malware while reducing scan workload on the WordPress server.

• Hash-First File Verification: Known WordPress core, plugin, and theme files are verified against trusted hashes.
• Deep Threat Analysis: Files that cannot be verified by hash or show suspicious indicators are sent to the SiteFort cloud for deep threat analysis, including backdoors, web shells, injected PHP or JavaScript, malicious redirects, SEO spam, and obfuscated code.
• File Integrity: Detects modified WordPress core, plugin, and theme files, along with unexpected files that do not belong in trusted packages.
• Account & Content Checks: Checks administrator accounts, WordPress content, options, URLs, and redirects for suspicious changes and indicators of compromise.
• Sensitive File Exposure: Identifies publicly accessible backups, logs, configuration files, debug files, and other sensitive files commonly targeted by attackers.
• Domain & IP Reputation: Checks the site domain and server IP against supported blocklists and abuse intelligence.

Database and content checks run on the protected site and are not uploaded to the SiteFort cloud.

Login Security & 2FA

SiteFort protects WordPress login and account access against brute-force attacks, credential abuse, and unauthorized access.

• Brute-Force & CAPTCHA Protection: Limits repeated login attempts and adds CAPTCHA protection to WordPress, WooCommerce, and supported custom login and registration forms.
• Two-Factor Authentication: Adds role-based 2FA with authenticator apps, email codes, recovery codes, grace periods, and trusted devices.
• WooCommerce & Membership 2FA: Lets customers and members manage 2FA from WooCommerce My Account or supported custom account pages.
• Custom Login URL: Move the WordPress login page to a private URL and control requests to the default wp-login.php address.
• Password Security: Detects weak and breached passwords, enforces password strength, prevents reuse, and supports optional expiration policies.

WordPress Firewall

Read the full description on the official page →