007AJ

007AJ Security Scanner & Firewall Suite

Login lockout, request firewall, integrity scan, repair and live traffic

A standalone WordPress security suite by 007AJ. Switch on login lockout, a request firewall with rule categories, IP allow and block lists, rate limits, scheduled integrity scans against WordPress.org checksums, file change monitoring, repair with quarantine, live traffic and hardening — every protection stays off until you turn it on.

Login lockout and login rate limit

After a number of failed logins (form, XML-RPC and application passwords) an IP is locked for a time you choose. Optional email alert. Locked addresses appear on the Dashboard so you can clear a lockout. A separate login rate limit returns HTTP 429 on wp-login.php.

Request firewall with rule categories

Switch categories on or off: SQL injection, script injection (XSS), path traversal and file inclusion, code and command injection, sensitive file probes (.env, .git, dumps, backup archives, wp-config backups, known web shell names) and attack-tool user agents. Administrators and editors are not checked by the pattern rules.

Custom skip and block paths

Paths that skip the pattern rules (for webhooks that legitimately receive code) and paths that are always blocked. Patterns that would cover wp-login.php or wp-admin are refused so you do not lock yourself out.

XML-RPC switch

Refuse all xmlrpc.php requests and turn off pingbacks when you switch this on.

IP allow and block lists

IPv4 and IPv6 addresses and CIDR ranges. Allowlisted addresses skip the firewall, rate limits, temporary blocks and login lockout. Block-listed addresses get 403 on every page. Your own current address cannot be added to the block list. Country blocking is not included — this plugin ships no GeoIP database and calls no outside GeoIP service.

Rate limits and temporary blocks

Limits per IP for all requests, REST requests and “not found” floods. An address that hits the 404 limit is blocked temporarily on the whole site. Temporary blocks are listed on the Dashboard so you can release them.

Integrity scan vs WordPress.org checksums

Compares WordPress core with the official checksums and finds unknown files in wp-admin, wp-includes and the site root. Optionally compares plugins from WordPress.org. Custom and commercial plugins have no published checksums and are listed as not checked. Themes cannot be checked — WordPress.org publishes no theme checksums.

Repair with quarantine undo

Repair restores a modified or missing core or WordPress.org plugin file from WordPress.org. The download is written only if it matches the official checksum, and the current copy is saved in quarantine first so every repair can be undone. Quarantine moves an unknown file into a protected uploads folder under a name the web server will not run.

Scheduled scans and email digest

Run the integrity scan daily or weekly with WP-Cron and email a plain-text summary: only when something needs review, after every run, or never. Quiet sites may need a real system cron that hits wp-cron.php.

File change monitoring

Keeps a baseline of core, plugin and theme files (size, mtime, MD5) and reports files added, modified or removed. When WordPress, a plugin or a theme reports a new version, changes inside it are accepted automatically. “Accept all changes” sets a new baseline. Uploads are not monitored.

Live traffic

A short record of recent requests handled by WordPress: time, IP (optionally shortened), method, path without query string, status, user ID, the protection that blocked it and the user agent. Only the newest 1,000 requests from the last 7 days are kept. Block an address with one click.

Hardening and activity log

Turn off the file editor, limit username discovery, hide the version tag and turn off application passwords. The activity log keeps logins, failed logins, lockouts, blocks, scans, repairs, quarantine actions and setting changes (newest 500 entries).

Opt-in by design

Every protection starts off. Open Settings and switch on only what you need, one tab at a time.

Runs on your server

Everything runs on your server. The plugin sends no data to 007AJ. Firewall rules change only through plugin releases.

Honest about REMOTE_ADDR

IP addresses are read from REMOTE_ADDR only. Forwarded headers are not trusted. Behind a proxy or CDN that does not restore the visitor address, check the address shown on Settings before turning on lockouts or blocks.

Privacy tools included

Suggested privacy policy text, plus a personal data exporter and eraser for activity log and live traffic of logged-in users.

Fully licensed version

Fully licensed version — use on your own sites. You get the complete plugin, with every feature described on this page.