Security release. Passkey logins now enforce your configured user verification level, the post-login redirect is restricted to your own site, and admin log rendering is hardened. Settings import no longer drops protections. Recommended for all users.<\/p>","1.0.29":"
Every feature is now free and unlimited, including the WAF engine, two-factor authentication, and passkeys. New features arrive switched off, so upgrading does not change how you log in. Visitor IPs are no longer sent to third-party geolocation services.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3475861,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3475861,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3475861,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3475861,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3475861,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250},"banner.svg":{"filename":"banner.svg","revision":3475861,"resolution":false,"location":"assets","locale":false}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.25","1.0.27","1.0.28","1.0.30"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Security dashboard with real-time stats, protection status, and blocks over time","2":"Brute force protection with login activity log and lockout settings","3":"Firewall with 600+ patterns, per-pattern toggles, and hit counts","4":"Access control with IP whitelist, blacklist, and country blocking","5":"Two-factor authentication and passkey setup","6":"Settings with security headers and configuration","7":"Tools and diagnostics with health checks and database repair"}},"plugin_section":[262246],"plugin_tags":[2439,1174,602,600,1909],"plugin_category":[54],"plugin_contributors":[257201],"plugin_business_model":[],"class_list":["post-278927","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-brute-force","plugin_tags-firewall","plugin_tags-login","plugin_tags-security","plugin_tags-two-factor-authentication","plugin_category-security-and-spam-protection","plugin_contributors-srworks","plugin_committers-srworks"],"banners":{"banner":"https:\/\/ps.w.org\/srworks-armorlite\/assets\/banner-772x250.png?rev=3475861","banner_2x":"https:\/\/ps.w.org\/srworks-armorlite\/assets\/banner-1544x500.png?rev=3475861","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/srworks-armorlite\/assets\/icon.svg?rev=3475861","icon":"https:\/\/ps.w.org\/srworks-armorlite\/assets\/icon.svg?rev=3475861","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"\n
ArmorPro<\/strong> protects WordPress with a full security stack that runs before your site does. Every feature is free and unlimited. There is no premium tier, no locked panels, and no upgrade prompts.<\/p>\n\n Attacks get blocked at the PHP engine level, roughly a millisecond into the request, before WordPress loads a single file.<\/p>\n\n Visitor IP addresses never leave your server. Geolocation is resolved against a MaxMind GeoLite2 database stored locally on your own site, not by calling a third-party lookup API. Anonymous usage statistics are off unless you turn them on.<\/p>\n\n ArmorPro connects to srworks.co in the situations below. Visitor IP addresses are never sent to any external service.<\/p>\n\n To show the country for logged IPs and to power country blocking, ArmorPro downloads a MaxMind GeoLite2 country database and stores it on your server. All lookups then happen locally.<\/p>\n\n Individual IP addresses are never sent to this or any other service. Only the database file is transferred, and every lookup runs locally against it.<\/p>\n\n ArmorPro can share anonymous statistics to help guide development. This is disabled until you explicitly opt in from the Settings page, and can be turned off again at any time.<\/p>\n\n No personal data, visitor data, or log contents are included.<\/p>\n\n ArmorPro contains a license client reserved for future AI-powered features, which will carry a per-request cost. No feature in this version is gated behind it, the admin interface has no field for entering a license key, and the AJAX endpoints that would trigger validation are not registered. This client makes no network requests.<\/p>\n\n ArmorPro stores the following in your WordPress database:<\/p>\n\n Clear all logs at any time from the Tools tab. Log retention is 90 days and old entries are pruned daily. Uninstalling the plugin deletes all of it, along with the WAF bootstrap file and any .htaccess or .user.ini directives ArmorPro added.<\/p>\n\n Visitor IP addresses are never transmitted off your server.<\/p>\n\n Questions, bug reports, and feature requests: https:\/\/srworks.co\/contact<\/p>\n\n Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https:\/\/perishablepress.com), used under GPLv2.<\/p>\n\n Charts by Chart.js (https:\/\/www.chartjs.org), MIT License.\nTooltips by Tippy.js (https:\/\/atomiks.github.io\/tippyjs) and Popper (https:\/\/popper.js.org), MIT License.\nQR codes by jquery-qrcode (https:\/\/larsjung.de\/jquery-qrcode\/), MIT License.<\/p>\n\n This product includes GeoLite2 data created by MaxMind, available from https:\/\/www.maxmind.com.<\/p>\n\n\n The firewall, brute force protection, and bot protection begin working immediately. The WAF engine, two-factor authentication, passkeys, and custom login URL are opt-in, so nothing changes how you log in until you choose it.<\/p>\n\n\n No. Every feature is free and unlimited, with no premium tier and no upgrade prompts.<\/p><\/dd>\n Yes. It runs on Apache, NGINX, LiteSpeed, and others. The standard firewall is pure PHP and needs no server configuration. The WAF engine detects your server type and configures itself.<\/p><\/dd>\n It runs at the PHP engine level, before WordPress begins loading, using PHP's auto_prepend_file directive to intercept malicious requests in roughly a millisecond. It reads from cached flat files for speed and fails open, allowing requests through, if anything goes wrong.<\/p>\n\n Enabling it writes a small bootstrap file to your site root and adds an auto_prepend_file directive to .user.ini or .htaccess, depending on your server. Both are removed when you disable it or uninstall the plugin.<\/p><\/dd>\n No. The WAF engine adds roughly 1ms. The standard firewall uses fast string matching early in the WordPress load. Blocked requests stop before WordPress finishes loading, which reduces server load during an attack.<\/p><\/dd>\n Failed logins are tracked per IP address. After a configurable number of failures the IP is locked out for a configurable duration. Repeat offenders can be auto-blacklisted after a set number of blocks, with an optional expiry so entries clear themselves.<\/p><\/dd>\n Yes, though features may overlap. Test before relying on both. Running two WAFs or two custom login URLs at once is not recommended.<\/p><\/dd>\n Go to ArmorPro > Access Control and add it to the whitelist. Whitelisted IPs bypass every security check, including brute force lockouts and firewall blocking.<\/p><\/dd>\n Add Security logs are stored locally in your WordPress database: IP addresses that trigger a rule or attempt a login, timestamps, and attempted usernames. Visitor data is never sent to a third party. Anonymous usage statistics are optional and off by default. See External Services below for every outbound connection the plugin can make.<\/p><\/dd>\n Bot protection adds invisible honeypot fields, timestamp validation, and JavaScript token verification to login, registration, and password reset forms. Automated bots that submit forms without rendering JavaScript or that submit too quickly are blocked before they can attempt brute force attacks.<\/p><\/dd>\n Yes. Country blocking lets you allow only specific countries (whitelist mode) or block specific countries (blacklist mode) from accessing your login page. Uses MaxMind GeoLite2 database stored locally for fast, unlimited lookups. Note: country blocking currently applies to login page access; the firewall provides separate protection for all other requests.<\/p><\/dd>\n ArmorPro offers multiple login protection features: brute force protection with automatic lockouts, bot detection, two-factor authentication, passkey login, REST API protection to block enumeration, author slug obfuscation to hide usernames, and a custom login URL to hide wp-login.php entirely.<\/p><\/dd>\n Yes! ArmorPro includes built-in two-factor authentication (2FA) using TOTP (Time-based One-Time Password). Users can set up any authenticator app like Google Authenticator, Authy, or 1Password. Backup codes are also provided in case you lose access to your device. Passkey authentication (Face ID, Touch ID, Windows Hello) is also supported as an alternative.<\/p><\/dd>\n ArmorPro focuses on prevention: stopping attacks before they compromise your site. The firewall blocks SQL injection, XSS, and other common attack vectors. For malware scanning and removal, we recommend pairing with a dedicated malware scanner.<\/p><\/dd>\n ArmorPro blocks malicious request patterns via the firewall and includes Bad User Agent blocking with a curated list of known malicious bots, scrapers, and vulnerability scanners that's regularly updated. Bot protection adds additional automated detection on login forms.<\/p><\/dd>\n Blocked visitors see a professional \"Access Blocked\" page with a 403 status code. The page is clean and branded, informing them to contact the site administrator if they believe it's an error.<\/p><\/dd>\n Yes. You can export login activity, firewall blocks, and blacklist data to CSV files for analysis or compliance reporting.<\/p><\/dd>\n Yes, including WP Rocket, W3 Total Cache, LiteSpeed Cache, and WP Super Cache. The firewall runs ahead of caching layers and sets appropriate cache-control headers.<\/p><\/dd>\n\n<\/dl>\n\n\nFeatures<\/h4>\n\n
\n
Privacy by default<\/h4>\n\n
External Services<\/h3>\n\n
GeoIP Database Download<\/h4>\n\n
\n
Anonymous Usage Statistics (Optional, Off by Default)<\/h4>\n\n
\n
License Validation (Unused in This Version)<\/h4>\n\n
\n
Privacy Policy<\/h3>\n\n
\n
Support<\/h3>\n\n
Credits<\/h3>\n\n
\n
\n
Is anything paid or limited?<\/h3><\/dt>\n
Does ArmorPro work with NGINX?<\/h3><\/dt>\n
What is the WAF Engine?<\/h3><\/dt>\n
Will this slow down my website?<\/h3><\/dt>\n
How does brute force protection work?<\/h3><\/dt>\n
Can I use this alongside another security plugin?<\/h3><\/dt>\n
How do I whitelist my IP address?<\/h3><\/dt>\n
I locked myself out. What now?<\/h3><\/dt>\n
define('ARMOR_DISABLE', true);<\/code> to wp-config.php to bypass all protection, or create a file named .emergency-bypass<\/code> in the plugin directory. Either one restores access so you can fix the setting and remove the bypass.<\/p><\/dd>\nWhat data does ArmorPro collect?<\/h3><\/dt>\n
What does the bot protection do?<\/h3><\/dt>\n
Can I block specific countries from accessing my site?<\/h3><\/dt>\n
How do I protect my WordPress login page?<\/h3><\/dt>\n
Does ArmorPro support two-factor authentication?<\/h3><\/dt>\n
Does ArmorPro protect against malware?<\/h3><\/dt>\n
How do I block bad bots and scrapers?<\/h3><\/dt>\n
What happens when an IP is blocked?<\/h3><\/dt>\n
Can I export security logs?<\/h3><\/dt>\n
Is it compatible with caching plugins?<\/h3><\/dt>\n
1.0.30<\/h4>\n\n
\n
1.0.29<\/h4>\n\n
\n
1.0.28<\/h4>\n\n
\n
1.0.27<\/h4>\n\n
\n
1.0.26<\/h4>\n\n
\n
1.0.25<\/h4>\n\n
\n
1.0.24<\/h4>\n\n
\n
1.0.23<\/h4>\n\n
\n
1.0.22<\/h4>\n\n
\n
1.0.21<\/h4>\n\n
\n
1.0.20<\/h4>\n\n
\n
1.0.19<\/h4>\n\n
\n
1.0.18<\/h4>\n\n
\n
1.0.17<\/h4>\n\n
\n
1.0.16<\/h4>\n\n
\n
1.0.15<\/h4>\n\n
\n
1.0.14<\/h4>\n\n
\n
1.0.13<\/h4>\n\n
\n
1.0.12<\/h4>\n\n
\n
1.0.11<\/h4>\n\n
\n
1.0.10<\/h4>\n\n
\n
1.0.9<\/h4>\n\n
\n
1.0.8<\/h4>\n\n
\n
1.0.7<\/h4>\n\n
\n
1.0.6<\/h4>\n\n
\n
1.0.5<\/h4>\n\n
\n
1.0.4<\/h4>\n\n
\n
1.0.3<\/h4>\n\n
\n
1.0.2<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n