007AJ Security Scanner & Firewall

007AJ Security Scanner & Firewall is a lightweight security plugin by 007AJ. It runs on your own server, and every feature is off until you turn it on.

Login lockout

• Counts failed logins per IP address. After a set number of failures (default 5 in 15 minutes) the address is locked out for a set time (default 30 minutes).
• Applies to every login that goes through WordPress: the login form, XML-RPC and application passwords. A locked-out address cannot log in even with the right password.
• The login form shows how long the lockout lasts. A successful login resets the counter.
• Locked-out addresses are listed on the Dashboard with an Unlock button.
• Optional email to the site admin when a lockout happens (at most one email every 15 minutes).

Firewall (lite)

• Checks the page address, the query string (names and values) and the names of submitted form fields for obvious attack probes: SQL injection (for example UNION SELECT, ' OR '1'='1, SLEEP(), script injection (<script>, event handlers, javascript: links) and path traversal (../, /etc/passwd, php://). Matching requests get a 403 page.
• Logged-in administrators and editors are not checked, so writing posts that contain HTML or code keeps working. Submitted form values (comments, contact forms) are not checked either, to avoid false alarms.
• Optional switch to turn off XML-RPC completely (also removes the pingback header and turns off pingbacks).
• Optional limit on form submissions to wp-login.php per IP address (default 20 in 5 minutes); extra requests get a 429 answer.
• The rules were written for this plugin. They catch common, obvious probes; they are not a complete defence and do not replace keeping WordPress, themes and plugins up to date.

Integrity scan

• A “Run scan now” button compares every WordPress core file on the server with the official checksums published by WordPress.org.
• Lists modified and missing core files, plus files in wp-admin, wp-includes and the site root that are not part of WordPress.
• Reports only. The plugin never changes or deletes files. Plugins, themes and uploads are not scanned.

Hardening switches

• Turn off the theme and plugin file editors (sets DISALLOW_FILE_EDIT unless wp-config.php already sets it).
• Limit username discovery for visitors who are not logged in: ?author=N requests go to the home page, the REST users endpoint answers 401, and the users sitemap is removed.
• Hide the WordPress version generator tag (cosmetic).
• Turn off application passwords.

Activity log

• Records logins, failed logins, lockouts, firewall blocks, rate-limit hits, blocked user discovery, scans and setting changes, with time, IP address and username.
• Keeps only the newest 500 entries. Filter by event; clear with one click.

Dashboard

Today’s lockouts, failed logins, blocked requests, the last scan result, hardening switches and log size, all on one screen.

How IP addresses are read

Only REMOTE_ADDR is used. Forwarded headers such as X-Forwarded-For can be forged by the visitor and are never trusted. If your site is behind a proxy or CDN that does not pass the real visitor address to PHP, every visitor may appear to have the same address. The Settings screen shows the address the server sees for you, so you can check this before turning on lockouts.

External Services

This plugin connects to one external service, and only when an administrator asks it to.

WordPress.org core checksums (api.wordpress.org)

• What it is for: the integrity scan downloads the official list of WordPress core file checksums so it can compare them with the files on your server.
• When: only when an administrator clicks “Run scan now” on the Integrity scan screen. There are no automatic or scheduled requests.
• What is sent: a request to https://api.wordpress.org/core/checksums/1.0/ with your WordPress version number and site language (for example version=7.1&locale=en_US), with the user agent set to WordPress/<version>. Your site address, users and files are not sent. Your server’s IP address is visible to WordPress.org, as with any web request.
• Service provider: WordPress.org. Terms of use: https://wordpress.org/about/terms-of-service/ – Privacy policy: https://wordpress.org/about/privacy/

No other outbound requests are made. Nothing is sent to 007AJ. The plugin row on the Plugins screen and the dismissible notice on the plugin’s Dashboard contain a plain link to https://007aj.com/007aj-security-scanner-firewall-suite; nothing is loaded from that address and nothing is sent unless you click the link yourself.

Privacy

What the plugin stores on your server, depending on the features you turn on:

• Activity log (if on): time, event type, IP address, the username entered or used, the user ID of a logged-in user, and a short detail (for example the firewall rule that matched and the page address requested). Newest 500 entries only.
• Login lockout (if on): for each locked-out address, the IP address, the last username tried, the number of failed attempts and the lockout end time, removed when the lockout ends. Failed-attempt and login-request counters are stored as temporary values keyed by a one-way hash of the IP address and expire on their own.
• Lockout emails (if on) go to the site admin address and contain the IP address and last username tried.
• Integrity scan: the last scan result (lists of file names), with no personal data.
• Daily counters for the Dashboard (numbers only).

The plugin adds suggested text to Settings > Privacy and registers a personal data exporter and eraser with WordPress (Tools > Export Personal Data / Erase Personal Data). They find activity log entries by the person’s user ID, username or email address.