WPCalibrate Security Guard

Production-ready, enterprise-grade WordPress hardening and cybersecurity suite. Engineered for proactive defense-in-depth, zero-bloat performance, intelligent Web Application Firewall (WAF) filtering, brute-force mitigation, and heuristic file integrity scanning with isolated quarantine rollback.

Table of Contents

• About the Plugin
• Key Features
  • Web Application Firewall (WAF)
  • Login Armor & Brute-Force Shield
  • System & Filesystem Hardening
  • Heuristic & Core Integrity Scanner
  • Isolated Quarantine Vault
  • Forensic Activity & Audit Logging
  • Security Posture Scoring
  • WooCommerce Deep Integration
  • Dashboard 1-Click GitHub Updates
• System Requirements
• Installation Guide
• Configuration & Usage
• Architecture & Security Methodology
• REST API Reference
• Frequently Asked Questions (FAQ)
• Changelog
• License & Credits

About the Plugin

WPCalibrate Security Guard was built by WPCalibrate to provide mission-critical WordPress sites with enterprise-level protection without the sluggish database bloat, destructive file deletions, or aggressive caching conflicts typical of legacy security plugins.

Core Philosophy

1. Defense-in-Depth: Protection is applied at every stage of the WordPress lifecycle: HTTP request entry (plugins_loaded), authentication dispatch (wp_authenticate), filesystem batch execution, and admin access control.
2. Zero-Bloat Performance: Employs optimized custom SQL tables, in-memory object transients, and regex microsecond lookahead patterns to minimize server overhead.
3. Non-Destructive Remediation: Files are never permanently deleted without administrative consent. Detected malware is quarantined into an encrypted, isolated directory with automated rollback and metadata preservation.
4. Deterministic Auditing: Real-time event logging with automatic sensitive data redaction (passwords, tokens, credit card patterns are never written to disk or logs).

Key Features

1. Web Application Firewall (WAF)

• Early Request Inspection: Hooks into plugins_loaded at priority 1, evaluating raw URIs, query strings, POST bodies, and HTTP headers before themes or standard plugin code execute.
• SQL Injection (SQLi) Defense: Blocks UNION SELECT, sleep injections, boolean-based payloads, and hex conversions.
• Cross-Site Scripting (XSS): Neutralizes script injections, javascript: pseudo-protocols, and malicious iframe embeds.
• Remote Code Execution (RCE): Intercepts eval(base64_decode()), passthru, system, and PHP input wrapper streams.
• Path Traversal Shield: Blocks directory traversal attempts (../../etc/passwd, win.ini traversals).
• Hostile Bot Mitigation: Detects vulnerability scanners and scrapers (sqlmap, nikto, wpscan, masscan).
• Request Rate Limiter: Mitigates DDoS and credential-stuffing velocity with automated HTTP 429 throttling (with automatic exemptions for authenticated site administrators).

2. Login Armor & Brute-Force Shield

• Velocity Rate Limiting: Enforces configurable lockout thresholds (e.g., 5 failed attempts within 15 minutes triggers a 30-minute IP block).
• Generic Username Shield: Instantly blocks authentication attempts against common targeted usernames like admin or administrator.
• Custom Login URL Slug: Masks wp-login.php behind a secret custom slug (e.g., /secure-gate/), rendering automated brute-force scripts obsolete.
• User Enumeration Defense: Blocks author archive queries (/?author=1) and REST API /wp/v2/users scans to protect staff usernames.
• Subnet Support: Full support for exact IPv4, IPv6, and CIDR notation ranges (e.g., 192.168.1.0/24, 2001:db8::/32).

3. System & Filesystem Hardening

• Disable File Editor: Automatically enforces DISALLOW_FILE_EDIT to eliminate backdoors created via the WordPress theme/plugin editor.
• Conceal Core Version: Strips WordPress generator meta tags, RSS feed versions, and query string script version parameters.
• XML-RPC Control: Completely disables XML-RPC endpoints or pingbacks if unused.
• Security Headers Injection: Automatically deploys X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, and Referrer-Policy: strict-origin-when-cross-origin.

4. Heuristic & Core Integrity Scanner

• Official Checksum Verification: Validates WordPress core files against official hashes from the WordPress.org Checksums API.
• Heuristic Malware Detection: Scans PHP files for obfuscated code, webshell signatures (c99, r57, WSO, b374k), base64 decoding loops, and suspicious eval chains.
• Uploads Directory Guard: Flags executable .php, .phtml, .sh, .exe, or .phar files placed within media upload directories.
• Memory-Conscious Batching: Processes files in resilient AJAX chunks (default 150 files every 350ms) to prevent server timeouts and memory exhaustion.

5. Isolated Quarantine Vault

• Encrypted Quarantine: Suspicious files are moved to wp-content/wpcalibrate-quarantine/ with scrambled random filenames.
• Execution Lockdown: The vault is hardened with deny-all .htaccess, web.config, and index.php directives.
• One-Click Restoration: File locations, ownership, and original permissions are saved in the database, allowing instant rollback.

6. Forensic Activity & Audit Logging

• Dedicated Database Table: Logs are stored in wp_wpcalibrate_security_events to keep wp_options clean and performant.
• Automated Data Scrubbing: Automatically redacts sensitive fields (passwords, auth cookies, JWT tokens, credit cards) before writing to the database.
• Search & Filter: Filter forensic records by severity (Critical, High, Medium, Low), event type, or IP address.
• CSV Audit Export: Export forensic logs for security compliance audits.

7. Security Posture Scoring

• 0–100 Assessment: Calculates an audit score based on enabled hardening rules, WAF status, authentication armor, and scan clean status.
• Actionable Remediation: Presents prioritized step-by-step recommendation cards to reach a 100/100 score.

8. WooCommerce Deep Integration

• Declares full compatibility with WooCommerce High-Performance Order Storage (HPOS) and Cart/Checkout Blocks.
• Protects WooCommerce customer login, password reset, and checkout endpoints without interfering with legitimate payment gateway webhooks.

9. Dashboard 1-Click GitHub Updates

• Includes a native GitHub Release Updater.
• Whenever a new version or security patch is published on this repository, administrators receive standard WordPress update notices and can update with a single click from Dashboard → Plugins.

System Requirements

Installation Guide

Option 1: WordPress Admin Upload

1. Download wpcalibrate-security-guard-1.0.0.zip from the Latest Releases.
2. Go to your WordPress Dashboard → Plugins → Add New Plugin → Upload Plugin.
3. Select the .zip file and click Install Now.
4. Click Activate Plugin.

Option 2: Manual FTP / SFTP Installation

1. Extract wpcalibrate-security-guard.zip.
2. Upload the wpcalibrate-security-guard folder to /wp-content/plugins/.
3. In WordPress admin, go to Plugins → Installed Plugins and activate WPCalibrate Security Guard.

Configuration & Usage

Follow our recommended 5-step rollout guide (accessible via the Overview tab in wp-admin):

1. Step 1: Baseline Core Hardening
   Navigate to WPCalibrate → Hardening. Turn on Disable File Editor, Conceal WordPress Version, and Enable Security Headers.
2. Step 2: Fortify Authentication
   Open Login Security. Set Maximum Retries to 5, Lockout Duration to 30 minutes, and enable Block Generic 'admin' Username.
3. Step 3: Activate Web Application Firewall (WAF)
   Switch to Firewall. Ensure the WAF is enabled with rules active for SQL Injection, XSS, Path Traversal, and Code Injection.
4. Step 4: Run Heuristic & Integrity Scanner
   Go to Scanner and click Start Full Scan. Review any flagged findings and quarantine or resolve issues.
5. Step 5: Configure Email Alerts
   Open Alerts and verify your administrative notification email to receive instant alerts on repeated attack blocks.

Architecture & Security Methodology

                           Incoming Web Request
                                    │
                                    ▼
       ┌────────────────────────────────────────────────────────┐
       │   Layer 1: Web Application Firewall (plugins_loaded)   │
       │   • URI / Query / Body normalization                  │
       │   • SQLi, XSS, RCE & Directory Traversal inspection    │
       │   • Rate Limiting (Bypasses Auth Admins & REST API)    │
       └────────────────────────────┬───────────────────────────┘
                                    │ Pass
                                    ▼
       ┌────────────────────────────────────────────────────────┐
       │   Layer 2: Authentication Defense (wp_authenticate)    │
       │   • IP & Username Velocity Check                       │
       │   • Progressive Lockout Enforcement                    │
       │   • Generic Username Rejection ("admin")               │
       └────────────────────────────┬───────────────────────────┘
                                    │ Pass
                                    ▼
       ┌────────────────────────────────────────────────────────┐
       │   Layer 3: Application & Filesystem Hardening          │
       │   • DISALLOW_FILE_EDIT constant injection              │
       │   • XML-RPC disabling                                  │
       │   • HTTP Security Headers                              │
       └────────────────────────────┬───────────────────────────┘
                                    │
                                    ▼
       ┌────────────────────────────────────────────────────────┐
       │   Layer 4: Background Heuristic & Integrity Engine     │
       │   • Batch chunked directory walker                     │
       │   • Official WordPress.org Checksum API validation     │
       │   • Isolated Quarantine Vault with rollback            │
       └────────────────────────────────────────────────────────┘

REST API Reference

All endpoints are registered under namespace wpcalibrate-security/v1 and require the manage_wpcalibrate_security capability (or administrator role) and a valid X-WP-Nonce header.

Frequently Asked Questions (FAQ)

Will this plugin slow down my website?

No. WPCalibrate Security Guard is built from the ground up for microsecond execution. Heavy operations (integrity scanning, checksum fetches, database cleanup) run asynchronously in non-blocking background batches.

Does the scanner automatically delete files?

Never. The plugin follows a strict non-destructive policy. Suspicious files can be quarantined into an execution-safe vault (.htaccess and index.php protected) with one-click restoration or manual deletion under your explicit control.

How do updates work from GitHub?

The plugin includes a built-in GitHub updater that checks this repository for new releases. Whenever a new tag is released, WordPress displays an update notification in your dashboard just like a WordPress.org plugin.

Changelog

[1.0.2] - 2026-10-16

• Fixed (Sidebar Menu Icon): Resolved invisible sidebar logo caused by esc_url() stripping base64 PNG data URIs. get_menu_icon() now returns direct public HTTP/HTTPS branding URL.
• Fixed (WAF Rate-Limiting & Scanner Conflict): Fixed "Scan failed or encountered an error" and "Rate Limit Exceeded" screen by bypassing internal plugin REST API endpoints (/wpcalibrate-security/v1/) and authenticated administrators in FirewallEngine and RateLimitRule.
• Improved (Checksum Caching): Added 15-minute negative transient caching in ChecksumService to prevent repeated 15-second timeouts when api.wordpress.org is unreachable.
• Improved (Filesystem Walker): Added scannable file filtering to skip heavy non-executable media files (jpg, png, webp, mp4) in wp-content/, shrinking scan state payload from ~10MB to <500KB.
• Improved (Frontend Scanner): Added 3-retry backoff in admin.js with 350ms batch throttle for gentle server load.

[1.0.1] - 2026-10-16

• Fixed (Sidebar Icon Sizing): Constrained sidebar menu logo to standard WordPress 20x20px with 0.7 opacity matching native dashboard dashicons.
• Fixed (Scanner Handshake): Fixed REST response format in RestApiController::handle_scan_start() and response validation in admin.js.
• Added (Overview Tab): Added comprehensive Overview tab covering Purpose, 5-Step "How to Use" Guide, Architecture/Methodology, and Module Directory.

[1.0.0] - 2026-10-16

• Initial production release.
• Web Application Firewall (WAF) with 7 modular named rules.
• Brute-force protection, progressive lockout rate limiter, and custom login URL slug.
• Core and heuristic file integrity scanner with isolated quarantine vault.
• Forensic audit logger with automated sensitive data redaction.
• Deterministic 0-100 security posture scoring engine.
• WooCommerce HPOS and Cart/Checkout Blocks compatibility.

License & Credits

• Author: WPCalibrate
• Website: wpcalibrate.com
• Support: support@wpcalibrate.com | +447474795976
• License: GNU General Public License v2.0 or later (GPL-2.0-or-later)