SquidShield

Automatic WordPress security by SquidSec — firewall, login protection, malware & integrity scanning, hardening, and audit logging.

Install, activate, protected.

Features

Most modules default on at activation so a typical site is covered without a setup tour.

Screenshots

1. Protection status dashboard with active layers and meter	2. WordPress admin dashboard card summarizing Shield status
3. Login security: lockouts, CAPTCHA, and 2FA options	4. Firewall and rate-limit settings with allowlist controls

5. Activity / audit log of security events

These assets also live under .wordpress-org/ for WordPress.org directory use (icons, banners, screenshots).

Quick install

From the latest release (recommended)

1. Open the latest release.
2. Under Assets, download squidsec-shield-x.y.z.zip.
3. In WordPress: Plugins → Add New → Upload Plugin.
4. Choose that zip → Install Now → Activate.

Important: Use the asset named squidsec-shield-x.y.z.zip only.

Uploading a nested zip or the raw source archive is the usual cause of “The plugin does not have a valid header.”

That's it. Protective modules default on so a typical site is covered without opening Settings first.

From this repository

git clone https://github.com/DotNetRussell/SquidShield-WP.git
cd SquidShield-WP
chmod +x bin/build-release-zip.sh
./bin/build-release-zip.sh
# Upload dist/squidsec-shield-<version>.zip in WP Admin

Requirements

Plugin layout

squidsec-shield/
├── squidsec-shield.php    # Bootstrap & plugin headers
├── includes/              # Modules (WAF, Auth, Malware, Hardening, …)
├── assets/
│   ├── css/ js/           # Admin UI
│   └── images/            # Brand logo, admin icons
├── data/                  # Rules, signatures, vuln data
├── dropins/               # Early-load WAF drop-in
├── languages/             # Translations
└── uninstall.php

After install, look for SquidShield in the WordPress admin menu and the main Dashboard widget.

CI / releases

• Workflow: .github/workflows/ci.yml
• Installable zip: Releases → Assets → squidsec-shield-x.y.z.zip (not “Source code”; not a nested Actions artifact zip)
• CI gate: every release job installs and activates the built zip in a fresh WordPress before publishing
• Version source: Version: header in squidsec-shield.php (currently 1.0.0)

When you cut a new version:

1. Bump Version and SQUIDSEC_SHIELD_VERSION in squidsec-shield.php.
2. Merge to main (or push a tag like v1.0.1).
3. Grab the zip from the new release.

Development & tests

The suite covers WAF rules, virtual patches, malware signatures, FIM, login protection, user enumeration, 2FA/TOTP, fingerprint cleanup, sensitive files, hardening, vulnerability/risk scoring, audit logs, REST API, and more.

Local (Docker)

If the plugin is mounted into a local WordPress container (see tests/bin/run-tests.sh):

chmod +x tests/bin/run-tests.sh
./tests/bin/run-tests.sh
# Optional filter:
./tests/bin/run-tests.sh --filter RulesEngine

PHPUnit directly

Requires WordPress loadable via WP_LOAD (path to wp-load.php):

export WP_LOAD=/path/to/wordpress/wp-load.php
export SQUIDSHIELD_TESTING=1
php phpunit.phar -c phpunit.xml.dist

Tests may use a live site database. Prefer disposable/local environments. Do not point WP_LOAD at production.

More detail: tests/README.md.

Configuration notes

• Defaults are on — enable/disable individual modules under the SquidShield admin screens.
• Pentest mode — log detections without blocking (useful for staging).
• Early drop-in — dropins/squidsec-shield-early.php can run the WAF before full plugin load when placed as an MU-plugin / advanced setup (see admin docs in-plugin).
• Notifications — email, generic webhook, and Slack webhook fields in settings.

Support & links

License

This repository is distributed under the terms in LICENSE. The plugin header also notes GPLv2 or later for WordPress.org compatibility expectations.