A whole security team, packaged into one plugin.
Loyal Security – Firewall & Malware Scanner brings six layers of defense — firewall, malware scanning, file integrity monitoring, hardening, 2FA, backups and audit logging — to your own server. No external service required. No Node, no build step.
Security Score
Excellent
Firewall
Optimized · Active
Malware Scanner
Idle · Clean
Last Full Scan
3 minutes ago
LIVE AUDIT LOG
ISSUE ALERTS
PRO — Under Attack Mode, scheduled scans & live threat intel.
Go ProMODULE 01 — FIREWALL
Web Application Firewall & DDoS Shield
Dual-mode WAF: Optimized Mode runs before WordPress even loads via a lightweight prepend; Standard Mode runs inside WordPress when a prepend can't be deployed. Either way, malicious requests never reach your database.
- Blocks SQL injection, XSS, LFI/RFI, path traversal & RCE
- Rate limiting, brute-force protection & DDoS shielding
- Bot management — an editable trust/block list, not a fixed filter, plus country-level geo-blocking
- Virtual patching shields vulnerable plugins/themes until updated
- Switching from Wordfence, Sucuri or iThemes? Import your existing IP block/allow list in one click
- Pro Sync your blocked bot signatures to Cloudflare Custom Rules — rejected at the edge, before they reach your server
- Pro Rule builder — block an attack on one plugin's parameter from plain choices, tested before it is saved
MODULE 02 — INTEGRITY
Malware Scanner & File Integrity Monitoring
A heuristic regex + token-based detection engine sweeps every file. Core, plugin and theme files are verified against WordPress.org checksums; everything else — including mu-plugins and drop-ins — is checked against your own baseline.
- On-demand full-site scans + free weekly automatic baseline scan
- Database scanner for spam injections & rogue admin accounts
- Safe quarantine, one-click clean-file recovery & permission reset
- Pro Scheduled daily/twice-daily scans + auto-quarantine on detection
- Pro Deep database scan & “I’ve been hacked” guided recovery
MODULE 03 — ACCESS & HARDENING
Deep Hardening, Two-Factor Auth & Audit Trail
Lock the front door and keep a record of every attempt on it. TOTP-based 2FA with QR enrollment, backup codes, and an enterprise-grade audit log that tracks every meaningful event on your site.
- .htaccess/Nginx rule generation & wp-config hardening
- REST API & XML-RPC restriction, author-name hiding, version obfuscation
- TOTP 2FA, CAPTCHA, password policy & breached-password checks
- Audit log: IP/user/proxy tracking, 90-day retention, CSV export
AUDIT STREAM
EVERYTHING ELSE, INCLUDED — FREE
Not a trimmed-down trial. A complete suite.
Everything on this page is in the free plugin unless it carries a Pro badge. Nothing here is time-limited, request-limited, or crippled to push an upgrade.
04 — THE CONSOLE
This is the actual plugin.
Not a mockup and not a marketing render — every panel below describes the shipping Loyal Security admin, module by module, running inside wp-admin with WordPress core's own bundled React. No Node, no build step, no Composer install.
Main Dashboard
Security score, module health, and the counters that matter.
01 / 18 MODULES
USE ← → TO STEP THROUGH
05 — DEFENSE IN DEPTH
Six layers. An attacker has to beat all of them.
Single-control security fails the moment that control is bypassed. Loyal Security is built as concentric layers — the perimeter, the request, the identity, the filesystem, the database, and the evidence trail. Select a layer to see what it stops and what it does when something gets past the one in front of it.
06 — ENGINEERING GUARANTEES
A security plugin has to be safe to install.
Security software runs with the highest privileges on your site. That is exactly why the failure modes matter as much as the features — so here are ours, in writing.
Fails open, by design
If the Optimized Mode prepend's configuration or files are missing or unreadable, it does nothing at all rather than taking your site down with it.
A deployment that tests itself
The Setup Wizard picks the right firewall mode for your host, self-tests the deployment, and rolls itself back automatically if that test fails.
No external service required
Two services are on by default and both can be switched off: our threat-intelligence feed (twice a day, never your site URL) and a breached-password check that sends 5 characters of a hash. Everything else is opt-in, and every call is disclosed in full.
Your data stays your call
Deleting the plugin keeps your logs, scans and settings in case you reinstall — while server-level changes are always reverted. Want a clean wipe instead? One setting.
08 — PLANS
Free protects your site. Pro runs your operation.
Everything that defends your site day to day is free, forever. Pro adds automation, live threat intelligence, and tooling for managing security across many sites.
Every plugin claims its free tier is complete. See exactly which normally-paid features aren't gated here →
Free
$0Forever. No credit card.
- Dual-mode WAF & DDoS shielding
- Virtual patching for vulnerable plugins
- Malware scanner + weekly baseline scan
- File integrity monitoring (core/plugins/themes)
- 2FA, CAPTCHA, breached-password checks
- On-demand backup & standalone restore
- Audit log with 90-day retention
- Live traffic monitor & WP-CLI support
Pro
$59/yr$4.92/mo billed yearly · 38% cheaper than monthly
One site per license. Everything in Free, plus:
- Real-time threat intelligence & hourly WAF updates
- Under Attack Mode — one-click shield, checkout keeps working
- Scheduled daily/twice-daily scans + auto-quarantine
- Uptime, certificate, domain & defacement monitoring
- Vulnerable plugins updated to their fix automatically
- Sentinel AI, emailed sign-in codes & impossible travel
- Client reports, off-site backups & white label
- Agency plans for 5–25 sites with Loyal Hub
07 — ANSWERS
Frequently asked questions
Straight answers, including the ones about what we do and don't send off your server.
SYSTEM REQUIREMENTS
PRIVACY & EXTERNAL SERVICES
No analytics or tracking. The services the plugin can contact, disclosed in full:
- • Threat-intelligence feed On by default — our service, twice a day, for firewall, malware & CVE updates. Sends dataset versions and installed plugin/theme slugs — never your site URL. Can be switched off.
- • Breached-password check On by default — k-anonymity lookup against Have I Been Pwned. Only 5 hash chars leave the site; never blocks login. Can be switched off.
- • CAPTCHA — optional Cloudflare Turnstile / Google reCAPTCHA, covering login, registration & lost-password. See Cloudflare / Google privacy policies.
- • Integrity checksums — official checksums from WordPress.org, the same public service WordPress core uses for updates.
- • Bypass telemetry Opt-in — redacted attack requests, only with explicit consent.
- • Cloud reputation & Sentinel AI Pro plugin — part of the separate Pro plugin; Sentinel AI only with explicit consent.
09 — DEPLOY
From zero to protected in under two minutes
- 1
Upload & activate
Upload the
loyal-securityfolder to/wp-content/plugins/, or install directly from Plugins → Add New. Activate it. - 2
Run the Setup Wizard
Open Loyal Security in the admin menu. It deploys the firewall in the best mode for your host automatically.
- 3
Review defaults
Check Loyal Security → Settings and enable two-factor authentication for every admin account.
- 4
You're covered
Optimized Mode needs
auto_prepend_fileor a writable.user.ini. No support? It falls back to Standard Mode automatically — nothing to configure.
wp-cli