SecureLite Security – Firewall, Malware Scanner & Attack Simulation

SecureLite Security is a free WordPress security plugin: a firewall, a malware scanner, brute force protection that limits login attempts, two-factor authentication (2FA) and hide login. It also does one thing other security plugins don’t: it proves each of those protections works on your own site, with one click.

Most security plugins give you a list of switches and leave you hoping they work. SecureLite adds a button that finds out.

Run Attack Simulation runs fifteen real attacks against SecureLite’s real protections — SQL injection, XSS, directory traversal, user enumeration, brute force, malicious and executable uploads, XML-RPC abuse, comment spam from bots, password bots without a real browser, attack-tool signatures, a malware sample, PHP execution in your uploads folder, and whether your .git directory or readme.html can be downloaded by anyone — and confirms that a real request to your site actually reaches those protections. It then reports, per protection, whether it would block, is switched off, or failed. Where a setting would fix it, an Enable & re-test button is right there. The result is a printable report you can hand to a client.

It is built to run on a live site. The attacks run inside WordPress, not over the network, so there is nothing for your host’s firewall, your CDN or another security plugin to see or react to, no failed logins, and nothing left behind — not even in your security log. You do not need a staging copy.

Everything runs on your site. There is no reverse proxy in front of your domain, so your caching, your CDN and your visitors’ real IP addresses all keep working exactly as they did.

Why you can trust it

SecureLite is new, so it has no years of reputation to point to. Here is what you can check for yourself instead:

• Proof, not promises. Attack Simulation shows you what each protection actually blocks on your own site, and says so plainly when one doesn’t. Nothing is hidden to sell you a fix, and it never tells you your site is “secure”, only which checks passed.
• Built not to lock you out. Two-factor can’t switch on until a code from your app has worked, and comes with recovery codes. A new login URL is tested before it is kept. Knowing your username isn’t enough to lock you out of your own account. Three ways back in are written down before you ever need them.
• Nothing about your site leaves your server. No account, no licence key, no telemetry. The one outbound request, to WordPress.org for official file checksums, is listed under External Services.
• Every feature is free, for good. No upgrade nags in your dashboard, and nothing in the plugin will ever move behind a paywall.
• Clean to remove. Deactivate it and the lines it added to wp-config.php are given back; delete it and every table and setting goes with it.
• People you can reach. Built by PixelGravitas. Support questions are answered in the forum by the people who write the code, and every changelog entry says exactly what changed and why.

Protection

• Firewall — inspects query strings, POST bodies, cookies, URLs and user agents for SQL injection, XSS, directory traversal and known scanner tools. Blocks attacks from the moment it is installed; a watch-only switch is there if you ever need to check a request. Editors and authors can save a post that explains javascript: links or quotes an onclick= attribute without the firewall refusing it.
• Malicious upload blocking — a virtual patch for the executable-upload vulnerability class, including PHP disguised with an image extension.
• Brute force protection (limit login attempts) — persistent per-IP and per-username lockout, surviving cache flushes. Addresses that keep coming back are locked for longer each time, up to 24 hours. Guesses at “admin” count double. Login errors never disclose whether a username exists. A locked username still opens for the right password, so nobody can lock you out of your own account by knowing your login name.
• Two-factor authentication (2FA) — scan a QR code with any authenticator app (TOTP, RFC 6238). The QR code is drawn on your own server, so your key never leaves it. You cannot switch it on until you have entered a code your app actually produced, each code signs you in only once, and ten single-use recovery codes are issued at the same time.
• Hide login (change the login URL) — move wp-login.php to a secret address and return 404 at the old one. The new address is tested before it is kept, and emailed to you.
• Malware scanner — every WordPress core file is compared with the official release, so a web shell dropped into wp-includes or the site root, or a changed core file, is reported as Critical with certainty. PHP, JavaScript and HTML elsewhere get signature and heuristic scanning for backdoors, web shells and packed payloads, and matches in wordpress.org plugins are checked against the official release so unmodified library code is not reported as malware. The database is scanned for injected fake-captcha and redirect scripts that a file scanner would never find.
• File-integrity monitoring — event-driven, with a lightweight sweep over the paths attackers actually touch: wp-config.php, .htaccess, mu-plugins, dropins, theme functions.php, and any PHP appearing in uploads.
• Rate limiting — refuses floods from one address before the page renders, counted over a rolling minute, with a tighter budget for unauthenticated admin-ajax. Logged-in users are never limited, and genuine Google and Bing crawlers are verified and let through.
• Smart protection — when SecureLite is not sure a visitor is a person, it checks their browser instead of refusing them. A real browser passes in a moment, usually without the person noticing; bots that do not run a real browser are stopped before WordPress does any work. Password bots sending logins straight to wp-login.php never reach the password check, a comment sent without your page is checked before it is saved, and a person on a busy shared address who goes over the traffic limit passes the check and carries on instead of being refused. No puzzles, no CAPTCHA, no outside service.
• Comment spam protection — refuses comments from bots without any outside service. A bot that posts without loading your comment form, or fills in a box people never see, is turned away, and one person can post only a few comments an hour. People sharing an address (an office, a college, a mobile network) are not refused for each other’s comments. People see no change to the form. Trackbacks and pingbacks are switched off.
• XML-RPC protection — refuses the two things bots use XML-RPC for: guessing account passwords and pingbacks. Jetpack, apps and tools that connect with an application password keep working.
• Uploads PHP check — the exact rule, for Apache/LiteSpeed (.htaccess) or nginx, that stops PHP executing in your uploads folder, and an Attack Simulation check that confirms your server enforces it. SecureLite never edits .htaccess or any other server configuration file itself.
• Security score — a local security scanner for your settings, with prioritized findings and one-click fixes.
• Notifications — a daily summary and two immediate alerts, sent by your own site. Never one email per blocked request.
• Post-hack recovery — log everyone out, regenerate salts, reset passwords, rename the user 1 account.
• Trusted IPs — exempt your own address or office range from the lockout and rate limiter, so you can’t shut yourself out.
• Works behind Cloudflare and proxies — a Cloudflare preset and a trusted-proxy list, so lockouts see each visitor’s real address. Forwarded IP headers are only believed when the connection really comes from a trusted proxy, so they cannot be forged to dodge a lockout.
• Clean removal — the only file SecureLite writes is wp-config.php, and only when you switch a setting that lives there (the file editor, your trusted-IP line, regenerating keys and salts). Deactivating gives those lines back and reactivating restores them; uninstalling removes them, its tables and its settings entirely. Nothing of this plugin outlives it.

What’s coming next

SecureLite is new, and these are planned — no dates promised, and nothing already in the plugin will ever move behind a paywall:

• An emailed unlock link on the lockout screen, so getting back in never needs FTP.
• Optional alerts when an installed plugin has a known vulnerability, clearly disclosed and off unless you turn it on.
• A dashboard for agencies looking after many sites.

Tell us what you’d like next in the support forum.

What this plugin is not

A PHP plugin cannot stop a volumetric DDoS, and SecureLite does not claim to. For that you want Cloudflare or server-level rate limiting in front of the site. SecureLite owns the depth on the site itself.

Need help?

Free support is on the WordPress.org support forum, answered by the people who build SecureLite. Every feature is free, so you never need to buy anything to get help.

Need hands-on help? SecureLite is made by PixelGravitas, a website maintenance and security team.

• Site already hacked? We remove the malware and close the way in, for a fixed fee agreed before work starts: WordPress malware removal
• A check needs server-level changes, or you would rather someone looked after the site: WordPress maintenance and support

External Services

SecureLite does not send telemetry and does not require an account or an API key. All processing happens on your own server and all security data stays in your own database.

WordPress.org checksums. During a malware scan, SecureLite requests the official file checksums for your WordPress release from https://api.wordpress.org/core/checksums/1.0/ (sending the WordPress version and locale), and for wordpress.org plugins that matched a scanner pattern from https://downloads.wordpress.org/plugin-checksums/ (sending the plugin’s folder name and version). When core files do not match the installed release, it also asks https://api.wordpress.org/core/version-check/1.7/ for the newest WordPress version (nothing is sent) so it can recognise files from a half-finished update. No site address, user data or file content is sent. Responses are cached for seven days, the newest-version answer for twelve hours. These are WordPress.org services: Terms of Service, Privacy Policy.