SiteFort Security – Malware Scanner, Firewall, Login Security & Hardening

Most WordPress hacks start with a door someone left open. An unpatched plugin, an exposed config backup, a weak admin password. SiteFort closes these weak points before attackers find them, then backs that up with a firewall, login protection, and cloud malware scanning.

Malware analysis runs in the SiteFort cloud rather than on your hosting, so full scans stay fast even on shared servers. The free plugin is not a trial. The protections most sites need are included without a paywall.

Try the Live Demo | Features | Free Remote Scan

Comprehensive WordPress Protection

• Cloud Malware Scanner: Detects backdoors, web shells, injected code, and SEO spam, with the heavy analysis running in the cloud instead of on your server.
• Verified Hardening: Locks down XML-RPC, user enumeration, sensitive files, and PHP execution, then verifies each rule is enforced on the server, not just enabled in the dashboard.
• Firewall & Bot Filter: Country blocking, rate limits, a community IP blocklist, and bot filtering that never blocks real search engines.
• Login Security & 2FA: Custom login URL, CAPTCHA, brute-force lockouts, breached-password blocking, and role-based 2FA enforcement. No separate login plugin needed.
• Backdoor Admin & Account Audit: Finds admin accounts hidden from the WordPress users list, plus weak, breached, and suspicious accounts.
• Vulnerability Checks: Scans core, plugins, and themes against CVE intelligence and shows affected versions, severity, and fix guidance.
• Repair & Quarantine: Quarantine suspicious files (restorable if something breaks) or repair infected files from clean sources in one click.
• Cloudflare Edge Sync: Push IP, country, and bot rules to Cloudflare so attacks are blocked before they ever reach WordPress.

WordPress Security Scanner

A single scan covers files, accounts, content, and reputation.

• Malware Detection: Known files clear instantly by local hash. Only unknown or suspicious files go to deep cloud analysis for backdoors, web shells, injected code, SEO spam, and malicious redirects.
• File Integrity: Catches tampered core, plugin, and theme files, and flags files that should not exist on the site at all.
• Account Security: Flags weak, breached, and suspicious accounts, including backdoor admins hidden from the WordPress users list or created outside normal site workflows.
• Content & Database Safety: Checks WordPress data locally for injected content, suspicious options, unsafe URLs, and spam or redirect indicators. Database content never leaves your site.
• Domain & IP Reputation: Checks your domain and server IP against blocklists and abuse feeds so a listing surfaces early, before it affects traffic or email deliverability.
• Sensitive File Exposure: Finds exposed backups, logs, config files, debug files, and other files attackers commonly target.
• Vulnerability Scanner: Checks WordPress core, plugins, and themes for known vulnerabilities, affected versions, severity, and CVE references where available.

WordPress Security Hardening

SiteFort closes the exposure points attackers check first.

• XML-RPC Controls: Disable XML-RPC, restrict authentication, or block pingback abuse.
• User Enumeration Blocking: Reduces username leaks from author archives, REST endpoints, and common discovery paths.
• Sensitive File Protection: Blocks public access to .env, backups, logs, debug files, .git metadata, lock files, sample configs, and server fragments.
• PHP Execution Protection: Blocks PHP from running in uploads and direct access in plugin and theme folders, so a malicious file that sneaks in never runs.
• Directory Listing Protection: Reduces exposure from browsable upload, plugin, theme, or backup directories.
• File Editor Protection: Disables the built-in theme and plugin file editor to limit damage from compromised admin accounts.
• REST & Application Password Controls: Restricts risky REST access and application password behavior based on site needs.
• Version & Metadata Cleanup: Hides WordPress version output and reduces exposed generator and header signals.
• Security Headers: Analyze and manage CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and disclosure headers.
• Enforcement Checks: Confirms supported hardening rules are active on the server. Items that require manual hosting or server configuration are flagged separately.

Login Security & 2FA

Account takeover is one of the fastest ways to lose control of a WordPress site. SiteFort adds layered login protection without requiring separate plugins.

• Custom Login URL: Move your login page to a private address; anything hitting wp-login.php gets a redirect, a 403, or a 404, your choice.
• Attack Prevention: Brute-force lockouts, CAPTCHA, generic login errors, and XML-RPC/REST authentication controls.
• Two-Factor Authentication: Role-based 2FA enforcement with authenticator app codes, email codes, and recovery codes.
• Password Policy: Weak and breached password detection, role-based strength enforcement, and expiration rules.

WordPress Firewall

SiteFort blocks unwanted traffic before it consumes server resources, with no custom rule syntax to learn.

• IP & Country Rules: Block or allow traffic by IP address, CIDR range, country, bot, crawler, or user agent.
• Country Blocking: Supports both block-selected and allow-only modes.
• Sensitive File Protection: Stops bots probing for .env, .git, wp-config.php backups, SQL dumps, debug logs, installer files, and other risky paths.
• Cloudflare Sync: Pushes supported IP, country, and user-agent rules to Cloudflare so high-volume blocks happen at the edge, including temporary edge blocks for repeat attackers.
• Rate Limiting & 404 Controls: Reduces abusive traffic spikes, repeated missing-page requests, and automated noise.
• Community Threat Intelligence: Blocks traffic from malicious IPs seen across the SiteFort network.
• Vulnerability-Hunting Bot Protection: Blocks bots probing for vulnerable plugins, themes, backup files, and configuration leaks.

Bot Filter Policy

Not all bots are bad. Pick one of three protection levels; unwanted automation gets blocked while legitimate search crawlers always pass through, so bot filtering does not put your SEO at risk.

• Basic: Blocks known hacking tools and bots probing for vulnerable files.
• Balanced: Blocks hacking tools, scraping bots, and automated scripts. Recommended for most sites.
• Maximum: Blocks hacking tools, scrapers, automated scripts, and unrecognized bot traffic.
• Block AI Training Crawlers: Optional block for AI scrapers that harvest content for model training (GPTBot, ClaudeBot, CCBot, Bytespider). AI assistants and AI search crawlers stay allowed.

Choose the level that fits the site, then adjust individual rules from the firewall dashboard.

Vulnerability Management

SiteFort checks installed WordPress core, plugin, and theme versions against vulnerability intelligence and shows affected assets, severity, CVE references where available, and the update that fixes each issue. While you apply updates, the firewall blocks the scanner bots that hunt for vulnerable components.

One-Click Repair & Restore

Pro: Guided repair workflows let you act on scan findings without manually editing files over FTP or SSH.

• Repair or delete malicious files directly from scan results.
• Restore clean WordPress core, plugin, and theme files when a trusted clean source is available.
• Repair supported paid plugin and theme files when clean-source matching is available.
• Quarantine suspicious files safely, with one-click restore if something on the site breaks.

For an active compromise, Securewp expert cleanup and managed security services are available when hands-on investigation, root-cause patching, blocklist help, or post-cleanup review is needed.

Audit Log & SiteFort Console

SiteFort keeps a security event history so you can quickly see what changed, what was blocked, and what needs attention.

• Login Activity: Successful logins, failed attempts, lockouts, 2FA events, and account-related actions.
• User & Site Changes: User updates, plugin and theme changes, settings changes, and sensitive admin actions.
• Firewall Activity: Blocked IPs, country rules, bot blocks, rate-limit events, and suspicious request activity.
• Scanner Results: Malware findings, vulnerability findings, reputation checks, hardening issues, and scan history.

Site-level security features are available from the WordPress dashboard. SiteFort Console is optional for teams that need centralized visibility across multiple sites, downloadable reports for clients, and team roles and support workflows.

Hosting Compatibility

SiteFort is built for real WordPress environments.

• Compatible with shared hosting, managed WordPress hosting, VPS, and dedicated servers.
• Works with Apache, Nginx, and LiteSpeed.
• Cloudflare-friendly: supports proxied sites and optional Cloudflare rule sync.
• Cloud-assisted scanning reduces heavy scan work on lower-resource hosting plans.

Free vs Pro

Free includes the firewall, bot filter, login security and 2FA, verified hardening, vulnerability checks, audit log, quarantine, and cloud malware scanning with 3,000 scan credits every month.

Pro adds:

• Unlimited cloud scanning with deep threat analysis
• Scheduled scans and automated vulnerability alerts
• One-click malware repair with clean-file restore for core, plugins, and themes
• Uptime and SSL expiry monitoring
• Slack, Discord, email, and webhook alerts
• Remote scan history, advanced reports, and white-label options for agencies
• Expert cleanup discounts

Managed adds hands-on monitoring, response workflows, and expert cleanup coverage by the Securewp team.

See the WordPress Security Plugin Comparison for a feature-by-feature breakdown against other WordPress security plugins.

External services

SiteFort connects to external services only when needed for license activation, cloud-assisted malware analysis, vulnerability intelligence, firewall intelligence, optional Console sync, optional CAPTCHA, optional GeoIP, Cloudflare sync, and administrator-enabled notifications.

Optional integrations are not contacted unless they are configured or used.

SiteFort Cloud

• Servers: securewp.net, intel.securewp.net, console.securewp.net
• Used for: License activation, service metadata, cloud malware analysis, vulnerability intelligence, firewall intelligence, reputation checks, community blocklist sync, clean-file repair, and optional Console sync.
• Data sent: Email address, license key/token, site URL, WordPress/plugin versions, installed plugin/theme names and versions, file hashes, scan results, vulnerability findings, reputation status, firewall metadata, blocked IPs, and security configuration metadata.
• Malware scanning: File hashes are sent first. Only unknown or suspicious files may be uploaded for deeper analysis and are deleted after processing. Database and content checks run on your website. SiteFort does not upload your database or database-stored content to the cloud. If wp-config.php requires analysis, sensitive configuration values are removed before upload.
• Temporary storage: SiteFort Cloud may return temporary upload/download URLs on *.amazonaws.com for scan uploads or clean-file repair downloads.
• Privacy: https://securewp.net/privacy-policy/
• Terms: https://securewp.net/terms-and-conditions/
• Storage provider policies: AWS privacy https://aws.amazon.com/privacy/ and terms https://aws.amazon.com/service-terms/; Cloudflare privacy https://www.cloudflare.com/privacypolicy/ and terms https://www.cloudflare.com/website-terms/

Optional integrations

• MaxMind GeoLite2 (download.maxmind.com) is used only when an administrator downloads or updates the local GeoIP database. It sends the configured MaxMind account ID and license key. Visitor IPs are resolved locally and are not sent to MaxMind during normal requests. Privacy: https://www.maxmind.com/en/privacy-policy Terms: https://www.maxmind.com/en/geolite2/eula
• Have I Been Pwned Passwords (api.pwnedpasswords.com) is used for breached-password checks when enabled. SiteFort sends only the first 5 characters of the SHA-1 password hash. Full passwords and full hashes are never sent. Privacy: https://haveibeenpwned.com/Privacy Terms: https://haveibeenpwned.com/TermsOfUse
• Google reCAPTCHA (www.google.com) and Cloudflare Turnstile (challenges.cloudflare.com) are used only when selected and configured for CAPTCHA protection. They receive the challenge token, site key, and visitor/browser data required by the selected provider. Policies: https://policies.google.com/privacy https://policies.google.com/terms https://www.cloudflare.com/turnstile-privacy-policy/ https://www.cloudflare.com/website-terms/
• Cloudflare API (api.cloudflare.com) is used only when Cloudflare Sync is enabled. It sends Zone ID, API token/credentials, zone details, blocked IPs, country rules, selected user-agent rules, and firewall rule data. Privacy: https://www.cloudflare.com/privacypolicy/ Terms: https://www.cloudflare.com/website-terms/
• Notification webhooks may send security alerts to Slack (hooks.slack.com), Discord (discord.com, discordapp.com), or a custom HTTPS webhook entered by the administrator. Webhook payloads may include site name, site URL, event type, severity, scan counts, vulnerability names, CVE identifiers, firewall counts, usernames, IP addresses, browser names, action URLs, timestamps, and event details. Slack policies: https://slack.com/trust/privacy/privacy-policy https://slack.com/terms-of-service/user Discord policies: https://discord.com/privacy https://discord.com/terms

Local site checks

Some requests are loopback checks against the protected site’s own public URL, such as security-header checks, public-file exposure checks, and homepage link collection. These contact the site being protected, not a third-party service.