Block early.
Log everything.
Enforce when ready.
Opsec is a modular WordPress security plugin built around one idea: block what can be blocked before WordPress finishes loading, and make everything else visible enough to act on. Twelve independent modules — every one ships in log-only mode first, so you see exactly what it would have done before it ever does it.
WordPress security has a plugin problem
The numbers that shaped every module below.
of the 11,334 WordPress vulnerabilities disclosed in 2025 were in plugins.
of infections exploit a flaw that already had a patch available.
median time from public disclosure to mass exploitation.
of plugin vulnerabilities are exploitable without authenticating.
of WordPress-specific attacks are actually blocked by typical hosting-level defenses.
Everything a module finds, on one screen
No SSH session, no log-tailing. A live health score, a 7-day blocked count, and every module's state at a glance.
Composite health score
One number, rolled up from every module's current state — not a vanity metric, a summary you can act on.
7-day blocked count
What was actually stopped, separated from what log-only mode would have stopped, so enforcement claims stay honest.
Worst severity, not just a count
18/20 means something already succeeded. The dashboard leads with severity, not noise volume.
Every module, one grid
Status, mode, and last activity for each module — scannable in seconds, filterable when it isn't.
Independent by design
Each module does one job. Turn any of them off and the rest keep working.
01Blocking the request
IP Blocklist
Pulls CINS Army, DShield, Spamhaus DROP and FireHOL feeds daily, compiles them into a merged, sorted-range file.
Query Guard
Signature scanning for SQLi, XSS, traversal and command injection in query strings.
Login Guard
Per-IP failed-login rate limiting with lockout, escalating repeat offenders to the early gate.
User Enumeration
Blocks ?author=N probing, anonymous REST user listing and oEmbed author leakage.
02Detecting compromise
File Integrity
Core verified against WordPress.org's published checksums — authoritative even if installed after the fact.
User Watchdog
Watches privileged accounts through WordPress hooks, and separately by hourly snapshot diff.
Hardening
Disables the dashboard file editor, blocks PHP execution in uploads, and finds plugins that hide themselves.
Vulnerability Scan
Flags outdated components, plugins pulled from the .org directory, and anything unmaintained for two years.
03Closing the loop
Auto Updates
Installs what the vulnerability scan flagged, rather than waiting for someone to read the report.
Security Headers
CSP, HSTS, frame and referrer policy. The two that can genuinely break a site are off by default.
Event Log
One filterable table every module writes to, so the answer to "what happened" is not an SSH session.
Telegram Alerts
Real-time notification for events above a severity threshold, with a cooldown so a scanner can't flood you.
It runs before WordPress does
One severity scale, every module — from the first byte of the request.
Incoming request
Any HTTP request to the site, before anything else runs.
Must-use pre-boot gate
IP blocklist, query scanning, POST/upload checks — before WordPress, themes, or any plugin loads.
WordPress & in-app modules
File integrity, user watchdog, vulnerability scan — reporting to the same event log.
The enforcement layer runs as a must-use plugin, loaded before WordPress finishes bootstrapping. Every request is checked against the IP blocklist, scanned for malicious query patterns, and validated on POST and upload — before WordPress, themes, or any other plugin gets a chance to run.
Everything else — file integrity, user watchdog, vulnerability scanning — runs inside WordPress and reports back to the same place.
One severity scale, every module
Low numbers are noise. High numbers mean this needs a look. 18 or above means something already succeeded — not just an attempt.
What this plugin can't do
We'd rather tell you than let you assume.
A WordPress plugin only ever sees requests that reach PHP. If a file genuinely exists — an exposed .git directory — the web server serves it directly.
Probe detection for sensitive paths depends on the site's permalink structure routing 404s into WordPress.
Baseline comparison for plugins and themes detects change since the baseline was taken — not whether the current state was clean.
An IP allowlist only helps for services that publish stable ranges. Mobile apps, desktop clients and pingbacks arrive from arbitrary addresses.
Under active development
All twelve modules are built and tested. Opsec is not yet released, and not yet running in enforcing mode on a production site — every module ships in log-only mode until it has earned enforcement.
Follow development ↗