SRWorks ArmorPro

ArmorPro protects WordPress with a full security stack that runs before your site does. Every feature is free and unlimited. There is no premium tier, no locked panels, and no upgrade prompts.

Attacks get blocked at the PHP engine level, roughly a millisecond into the request, before WordPress loads a single file.

Features

• WAF Engine — Runs before WordPress loads via PHP’s auto_prepend_file, adding roughly 1ms of overhead. Blocks malicious requests at the PHP engine level before any WordPress code executes. Detects and configures Apache, NGINX, and LiteSpeed automatically, and falls back to the standard firewall when enhanced mode is unavailable. Enable it from the Firewall tab with one click.
• Firewall — 600+ built-in patterns covering SQL injection, XSS, path traversal, and shell access, matched across five categories (Request URI, Query String, User Agent, Referrer, IP Address) in three modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggles, hit counts, and your own custom patterns. Pure PHP, so it works on any server without .htaccess.
• Brute Force Protection — Session-based login tracking with automatic lockouts after a configurable number of failures. Repeat offenders can be auto-blacklisted with an optional expiry. Login activity log records IP, country, status, and the usernames tried.
• Two-Factor Authentication — TOTP for Google Authenticator, Authy, 1Password, and any compatible app. QR code setup, ten backup recovery codes, and role-based enforcement with a grace period.
• Passkey Authentication — Passwordless login with Face ID, Touch ID, Windows Hello, or a hardware security key (WebAuthn/FIDO2). Multiple passkeys per user with friendly names and clone detection.
• Bot Protection — Honeypot fields, timestamp validation, and JavaScript token verification on login, registration, and password reset forms. Bots are stopped before they can attempt a single password.
• Access Control — IP whitelist and blacklist with inline notes. Country blocking in allow or block mode, backed by a locally stored MaxMind GeoLite2 database.
• Custom Login URL — Move wp-login.php to any slug you choose. The default login returns a 404.
• Security Headers — Seven managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection, HSTS, Content-Security-Policy, Permissions-Policy) delivered via PHP and optionally .htaccess, with a header probe that avoids duplicating what your server already sends.
• Email Notifications — Daily and weekly security digests, plus event alerts for lockouts, blacklistings, and administrator logins.
• Privacy Hardening — Author slug randomization to stop user enumeration, and email obfuscation to keep addresses away from scrapers. XML-RPC and REST API protection included.
• Dashboard — Real-time stats, a blocks-over-time chart, protection status cards, and a WordPress dashboard widget.
• Tools — Health checks with database integrity verification, one-click table repair, settings export and import, CSV log export, and debug mode.

Privacy by default

Visitor IP addresses never leave your server. Geolocation is resolved against a MaxMind GeoLite2 database stored locally on your own site, not by calling a third-party lookup API. Anonymous usage statistics default to off on the WordPress.org version and to on for the direct download from srworks.co, and can be turned off at any time either way. See External Services for the detail.

External Services

ArmorPro connects to srworks.co in the situations below. Visitor IP addresses are never sent to any external service.

GeoIP Database Download

To show the country for logged IPs and to power country blocking, ArmorPro downloads a MaxMind GeoLite2 country database and stores it on your server. All lookups then happen locally.

• When: once when the database is missing, checked on an admin page load at most once per day, then weekly for updates
• Data sent: your site URL and the plugin version
• Service: https://api.srworks.co, which returns a link to the database file hosted on SRWorks infrastructure
• Database: GeoLite2 Country by MaxMind, https://www.maxmind.com
• Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy

Individual IP addresses are never sent to this or any other service. Only the database file is transferred, and every lookup runs locally against it.

Anonymous Usage Statistics

ArmorPro shares anonymous statistics about the installation to help guide development. The default depends on where you got the plugin:

• WordPress.org version — off. Nothing is sent unless you click “Enable” on the opt-in notice. Choosing “No Thanks” is remembered.
• Direct download from srworks.co — on by default. It can be turned off at any time, see below.

Either way, once you have made a choice it is remembered and the default no longer applies.

• When: on activation, on deactivation, and once daily
• Data sent: an anonymous site identifier; which SRWorks plugins are installed, their version numbers, and whether each has an active subscription; your WordPress version; and your PHP version
• Not sent: your site address, visitor data, log contents, IP addresses, email addresses, or any other personal information
• The site identifier is a one-way SHA-256 hash of your site address combined with a random value generated on your own server. It cannot be reversed to recover your address.
• To turn it off: add define( 'SRWORKS_TELEMETRY', false ); to your wp-config.php, or use the srworks_telemetry_enabled filter
• Service: https://api.srworks.co
• Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy

No personal data, visitor data, or log contents are included.

License Validation (Unused in This Version)

ArmorPro contains a license client reserved for future AI-powered features, which will carry a per-request cost. No feature in this version is gated behind it, the admin interface has no field for entering a license key, and the AJAX endpoints that would trigger validation are not registered. This client makes no network requests.

• When: never, in this version
• Service: https://api.srworks.co
• Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy

Privacy Policy

ArmorPro stores the following in your WordPress database:

• IP addresses of visitors who trigger a security rule or attempt to log in
• Timestamps of security events
• Usernames used in login attempts
• Country codes resolved locally from the GeoLite2 database

Clear all logs at any time from the Tools tab. Log retention is 90 days and old entries are pruned daily. Uninstalling the plugin deletes all of it, along with the WAF bootstrap file and any .htaccess or .user.ini directives ArmorPro added.

Visitor IP addresses are never transmitted off your server.

Support

Questions, bug reports, and feature requests: https://srworks.co/contact

Credits

Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com), used under GPLv2.

Charts by Chart.js (https://www.chartjs.org), MIT License.
Tooltips by Tippy.js (https://atomiks.github.io/tippyjs) and Popper (https://popper.js.org), MIT License.
QR codes by jquery-qrcode (https://larsjung.de/jquery-qrcode/), MIT License.

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.