Firewall, malware & file-change scanner, brute-force protection, rate limiting, plus free uptime + SSL monitoring — one-click connect, no API key.
Everything you need to keep a WordPress site safe — in one plugin, most of it running locally for free. Defen.so blocks attacks, scans for malware, watches your files for tampering, hardens the common holes hackers walk through, and — once you connect a free account — pings your site from outside so you know the second it goes down or your SSL is about to expire.
No API key to paste. No config file. Click Connect to Defen.so, sign in, and you’re protected.
▶ Get the free mobile app — Defenso Alerts: https://play.google.com/store/apps/details?id=so.defen.alerts — a phone app that rings you like a phone call, an alarm that cuts through silent mode and Do Not Disturb, the moment your site goes down, gets attacked, or your SSL/domain is about to expire. Also on iOS. This is the feature people install the plugin for and then tell their friends about.
Works standalone — no account required
You do not need a Defen.so account to use the plugin. These run entirely on your own server, for free, with no sign-up and no limits:
- Upload scanning — every uploaded file is checked for dangerous extensions and polyglots (magic bytes that disagree with the declared type). Runs on every upload, for everyone.
- Malware scan — heuristic sweep of your PHP/JS files for common webshell and obfuscation patterns.
- File-modification detection (new in 1.4.0) — snapshots a trusted sha256 baseline of your files, then flags anything added, changed, or removed since. This is how you catch a hacked or injected file that a signature scanner would miss — a backdoor dropped into your theme, a modified
wp-config.php, a plugin file that isn’t the one you installed. - Continuous database scanning (new in 1.4.0) — a weekly background sweep keeps your malware and vulnerability findings fresh automatically. No manual clicking; your results are never stale.
- Background scan with a live progress bar (new in 1.4.0) — the heavy scan runs on WP-Cron, not inside your admin request, so the dashboard never hangs. A progress bar tracks it and can’t get stuck.
- Path rate limiting — throttle any URL slug or wildcard pattern on your own site (e.g.
/wp-login.php,/wp-json/*,/checkout*) per client IP; excess requests get a429with aRetry-Afterheader. Up to 3 rules run locally for free; connect a free account to add more. - Login / brute-force hardening — per-IP login rate limiting with an adjustable attempt count and window, optional reCAPTCHA v3, optional TOTP 2FA.
- Firewall-lite — blocks known-bad scanner user-agents (sqlmap, nikto, wpscan, nuclei…) and common exploit request patterns (path traversal, LFI/RFI wrappers, code-in-querystring, wp-config and dotfile probes).
- Core-file integrity check — verifies WordPress core files against the official WordPress.org checksum manifest and flags any modified or missing core file.
- Exposed-file check — probes for publicly-reachable secrets (.env, .git, wp-config backups, database dumps, debug logs).
- Activity log — records the last 100 high-value admin actions locally.
Common WordPress security holes we close
Most WordPress compromises come through the same handful of doors. Defen.so shuts them with one-click toggles (safe defaults on for new installs):
- Brute-force logins — per-IP throttling and lockout on
wp-login.phpso credential-stuffing bots can’t grind your passwords. - User enumeration — blocks
?author=scans and the REST/usersendpoint that leak your usernames to attackers before they even try a password. - XML-RPC abuse — disable
xmlrpc.php, a favourite amplifier for brute-force and pingback DDoS. - Version fingerprinting — hides your WordPress version so attackers can’t cheaply match you to a known exploit.
- The built-in file editor — disables the theme/plugin editor (
DISALLOW_FILE_EDIT) so a single stolen admin session can’t paste a backdoor into your code. - Missing security headers — sends X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and optional HSTS.
- Geo-block — reject requests from any list of countries.
A green “Security active” badge in your toolbar (new in 1.4.0)
A shield icon sits in the WordPress admin bar and turns green when your site is protected, with a one-click menu to Scan, Reports & findings, File changes, Uptime, and Upgrade. Security status is visible on every page, not buried in a settings screen.
Uptime, SSL & domain-expiry monitoring — free once connected
Uptime, SSL-expiry and domain-expiry checks have to run from outside your server — a plugin inside WordPress can’t reliably tell whether your own site is reachable. So the moment you connect a free Defen.so account, external checks start running from Defen.so’s servers, and you can route alerts to email, Slack, Telegram, Discord, a webhook, or the Defenso Alerts app. This is free. A paid subscription is how you support development — and it unlocks more: faster check intervals, more monitors, longer log retention, more scans, and custom WAF rules. Soft ask, honest deal: you never need to pay to stay protected.
Better when connected (optional)
Connecting a free Defen.so account adds a managed cloud layer on top — nothing above is taken away:
- Managed WAF — blocks SQL injection, XSS, path traversal, bot scanners and mass-assignment using the live rule set plus custom rules from your dashboard.
- Attack log — blocked events (including upload and rate-limit blocks) streamed to your dashboard in real time.
- CVE vulnerability lookup — checks your installed plugins and themes against the live CVE feed.
For AI coding assistants — MCP server + Claude skill
The Defen.so ecosystem goes past the browser. There’s an MCP server (@defen.so/mcp) and a Claude Code skill so AI coding assistants — Claude Code, Cursor, Windsurf — can scan a site or repo, guard the code they’re writing, and add WAF rules without leaving the editor. If you build with an AI pair-programmer, your security tooling lives where your code does.
One-click connect
Click “Connect to Defen.so”. A popup opens at app.defen.so; you sign in (or sign up) and authorize. The popup postMessages a scoped API key back — origin-locked to app.defen.so so no third party can intercept it.
Fails open: if Defen.so is unreachable at request time, the plugin allows the request and ships the log later.
External services
This plugin connects to external services. Here is exactly what is sent, when, and to whom.
1. Defen.so API (app.defen.so) — the plugin’s core service.
- What it is: the managed WAF, uptime monitoring, and attack-log backend the plugin connects your site to.
- When data is sent: when you connect your site (one-time OAuth handshake), when the plugin refreshes its cached rule policy, when scan findings (including file-change diffs) are reported, and when a request is blocked/challenged/deceived (attack-log events are batched and sent on
shutdown). - What is sent: your scoped API token, your site URL, per-event metadata — HTTP method, URL path, visitor IP, User-Agent, matched rule ID, and the action taken — and scan finding summaries. No request bodies, no cookies, no personal content.
- Terms: https://defen.so/tos — Privacy: https://defen.so/privacy
2. Google reCAPTCHA (google.com/recaptcha) — optional, only if you enable login hardening with a reCAPTCHA site key.
- What it is: Google’s bot-detection service, used to score login attempts on
wp-login.php. - When data is sent: only on the login page, and only if you have entered a reCAPTCHA site key. If you leave it blank, no request is ever made to Google.
- What is sent: the reCAPTCHA token and the data Google’s script collects from the login page (per Google’s terms).
- Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy
3. ip-api.com — optional, only if you enable the geo-block feature.
- What it is: a free IP-to-country geolocation lookup, used to find a visitor’s country so the geo-block rule can allow or deny it.
- When data is sent: only when geo-block is enabled and a visitor’s country is not already supplied by your host (e.g. Cloudflare’s country header). The visitor’s IP is sent for the lookup.
- What is sent: the visitor’s IP address only.
- Terms: https://ip-api.com/docs/legal — Privacy: https://ip-api.com/docs/legal
4. api.wordpress.org — only when you run the “Verify core files” check.
- What it is: the official WordPress.org checksums API, the same one WP-CLI uses to verify core-file integrity.
- When data is sent: only when you click “Verify core files”. Nothing is sent automatically.
- What is sent: your WordPress version number and locale only — no site content, no personal data.
- Terms & Privacy: https://wordpress.org/about/privacy/
