=== GemSecurity – Firewall, Malware Scanner, 2FA, Social Login & reCAPTCHA === Contributors: kodezen, tusharimran Tags: security, social login, recaptcha, firewall, two factor authentication Requires at least: 6.4 Tested up to: 7.1 Requires PHP: 7.4 Stable tag: 1.2.2 License: GPL-3.0+ License URI: http://www.gnu.org/licenses/gpl-3.0.txt WordPress security with firewall, malware scanner, 2FA, social login, reCAPTCHA, hCaptcha, Turnstile and activity log in one lightweight plugin. == Description == **GemSecurity** is an all-in-one WordPress security plugin: a web application firewall, login protection, two-factor authentication, social login, reCAPTCHA / hCaptcha / Cloudflare Turnstile, a malware and vulnerability scanner, and a full activity log, all in one fast single-page dashboard. Every feature lives in a module you can switch on or off. A module that is off loads no code, so you only pay for what you use. A live security score tells you what still needs attention, and every page has a built-in "?" guide. = Why GemSecurity? = * One plugin instead of five: security, firewall, 2FA, social login and CAPTCHA together * Lightweight and modular: disabled modules load nothing * Safe by default: administrators are never locked out by the firewall, risky options start off * Setup wizard and in-plugin help for every page * Light and dark admin theme = Firewall & WAF (Web Application Firewall) = * Blocks SQL injection (SQLi), cross-site scripting (XSS), local file inclusion (LFI) and remote code execution (RCE) requests * IP blocklist with CIDR range support, plus an IP safelist that is never blocked or rate-limited * Request rate limiting and 404-flood throttling * Bad-bot and AI-crawler blocking, with search-engine bot verification * Site-wide file upload switch (Media, REST, sideload and XML-RPC) * Your own IP is refused in the blocklist so you cannot lock yourself out = Hardening = * Disable XML-RPC and the theme/plugin file editor * Stop author and REST API user enumeration * Hide the WordPress version * Application password governance and max-age * Generic login error messages * Optional protection of wp-config.php, debug.log and wp-admin/includes via .htaccess = Security headers = * X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy * HSTS (Strict-Transport-Security) and Content-Security-Policy (CSP) * Headers are added to REST API responses too = Login security & brute-force protection = * Limit login attempts with configurable brute-force lockouts * Custom login URL (hide / rename wp-login.php) with a public page picker and wp-config.php kill switch * Session limits, idle timeout and absolute admin session timeout * Admin-login email alerts * Login lockdown mode * Force logout and forced password resets by role, on demand or on a schedule = reCAPTCHA, hCaptcha & Cloudflare Turnstile = * Google reCAPTCHA v2 and v3, hCaptcha and Cloudflare Turnstile * Protects login, registration and lost-password forms * "Verify keys" test with the real widget before you save * A wrong secret key never locks everyone out; the problem is logged instead = Two-Factor Authentication (2FA) = * Authenticator app (TOTP) with QR code: Google Authenticator, Authy, Microsoft Authenticator and others * Email one-time codes (OTP) * One-time backup codes * Enforce 2FA per role, or for all roles * Works with front-end login forms, not only wp-login.php * 2FA secrets encrypted with AES-256-GCM = Social login = * One-click sign in with Google, Facebook, GitHub and X (Twitter) * Choose the role for new social accounts * Buttons appear only after a provider's keys are verified; broken providers switch off and alert you * Social sign-ins go through Admin Guard = Magic login (passwordless) = * Users can request a one-time sign-in link by email from the login form * Rate-limited, and the link only works in the browser that requested it = Password policy = * Minimum strength and length rules * Breached-password check with Have I Been Pwned (only a partial hash is sent) * Password rotation: force resets for passwords older than a set number of days = Admin Guard = * Administrator whitelist with automatic removal of rogue / unapproved admins * Hidden-admin detection * Preview who would be removed before anything happens = Temporary access = * Give an existing user a higher role for a limited time; their old role comes back automatically = Plugin Guard & supply-chain protection = * Verifies every plugin against official WordPress.org checksums * Trust list for premium, custom, theme and must-use plugins * Optional enforcement stops untrusted plugins before they load * Install Lock: block zip uploads, all installs or every file change, with a logged 15-minute timed unlock * Plugin lock: a separate unlock password plus emailed code guards deactivating GemSecurity = Upload Shield = * Refuses PHP and other executable files on every upload path * Detects PHP hidden in images and scripted SVG * Writes no-execute rules to uploads/.htaccess, with a live PHP-execution test and an nginx snippet * Bans the IP behind a refused executable upload = Malware & vulnerability scanner = * WordPress core file integrity check against official checksums * Compare a flagged core file line by line with the WordPress.org original * Uploads malware / PHP pattern scan * Suspicious .htaccess rule detection with one-click quarantine * Known-vulnerability scanner for WordPress core, plugins and themes * File-change detection and link scanner * Mark reviewed files as safe; they are reported again if they change * Code & database finder to search the whole install and database = Anti-spam = * Frictionless bot checks on comments and registration (no CAPTCHA needed) * Comment honeypot and heuristic spam filtering = API security = * REST API rate limiting * Application password controls = Activity log (audit log) = * Logs logins, user changes, role changes, plugin/theme changes, settings and content edits * Field-level diff for edits to live posts, with a link to the revision * SEO meta, template and featured image changes * Records how each event arrived (admin, REST, XML-RPC, AJAX, WP-CLI, cron), user agent and session * Filter by user or post, retention settings and CSV export = Alerts & notifications = * Email, Slack, Telegram and generic webhook alerts * Alerts include the IP's city, region, country and network * Daily report of administrators and active plugins, highlighting changes * Alert when GemSecurity is deactivated * Test buttons for every channel = Compliance & SIEM = * Send security events to your own SIEM collector or webhook = Security dashboard = * Live security score with grade and trends * "What needs your attention" list linking straight to each fix * Module manager to turn features on and off without reloading * First-run setup wizard with protection levels = Works with GemBackup (optional) = GemSecurity does not create backups itself. If the separate GemBackup plugin is active, GemSecurity can ask it for a backup before plugin/theme/core updates and can start a restore of its latest backup from the Incident Response page. = GemSecurity Pro = GemSecurity Pro is a separate add-on plugin for sites that need active threat defense and malware cleanup. None of its code is in this free plugin; everything listed above stays free. * **Threat Defense** – escalating auto-bans for repeat attackers, a full ban ledger and a curated bad-bot blocklist * **Virtual patching** – CVE-targeted firewall rules that block known exploits for your installed plugin and theme versions, even before a fix is released * **Country blocking (geolocation)** – allow or block countries for the whole site or just the login page * **Signature malware scanner** – deep malware detection with one-click quarantine and restore * **Database injection scan** – finds spam links, hidden scripts and backdoors stored in posts, options and other tables * **Plugin & theme integrity** – compares every file with the original from WordPress.org * **Core repair** – reinstalls WordPress core and removes files that core does not ship, so implants do not survive a reinstall * **File-change baseline** – records a known-good snapshot and alerts on any added, changed or deleted file * **Post-hack recovery toolkit & Incident Response** – step-by-step cleanup, reset salts, sessions and passwords, restore quarantined files * **Payment page integrity (PCI DSS 4.0)** – watches the scripts loaded on checkout pages and flags card-skimmer injections * **Uptime & domain monitoring** – site uptime, SSL/TLS certificate expiry, DNS changes and SPF/DKIM/DMARC email health * **New-device login alerts** – emails users when an unrecognised device signs in, plus emergency one-time login links * **Hardening pack** – extra one-click hardening rules * **Auto-update enforcement** – keep chosen plugins, themes and core updated automatically * **Settings import / export** – copy your security setup between sites == External services == GemSecurity connects to the services below only for the feature named, and only after you turn that feature on. On a default install the only requests made are to WordPress.org (official checksums and plugin information, used to verify core, plugin and theme files). Every other service below is contacted only after you switch that feature on, including the vulnerability scan, which is off by default. = CAPTCHA (Login & Access → CAPTCHA) = When CAPTCHA is enabled, the provider's script loads on the login, registration and lost-password forms, and the CAPTCHA response token plus the visitor's IP address are sent to the provider to verify each submission. * Google reCAPTCHA — [Terms](https://policies.google.com/terms), [Privacy](https://policies.google.com/privacy) * hCaptcha — [Terms](https://www.hcaptcha.com/terms), [Privacy](https://www.hcaptcha.com/privacy) * Cloudflare Turnstile — [Terms](https://www.cloudflare.com/website-terms/), [Privacy](https://www.cloudflare.com/privacypolicy/) = Social login (Login & Access → Social Login) = When a visitor signs in with a provider, the OAuth authorization code is sent to that provider and the user's name, email and avatar are returned to your site. * Google — [Terms](https://policies.google.com/terms), [Privacy](https://policies.google.com/privacy) * Facebook (Meta) — [Terms](https://www.facebook.com/terms.php), [Privacy](https://www.facebook.com/privacy/policy/) * GitHub — [Terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service), [Privacy](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement) * X (Twitter) — [Terms](https://x.com/en/tos), [Privacy](https://x.com/en/privacy) = Vulnerability scanner = The slug and version of each installed plugin and theme, and your WordPress version, are sent to the WPVulnerability API (www.wpvulnerability.net) to look up known vulnerabilities. [License](https://www.wpvulnerability.com/license/), [Privacy](https://www.wpvulnerability.com/privacy/) = Plugin and file integrity checks = Plugin/theme slugs and versions are sent to WordPress.org to fetch official checksums, package details and original files for comparison. When you open a flagged core file in the Scanner, that file is downloaded from core.svn.wordpress.org (your WordPress version and the file path are sent) and accepted only if it matches the official checksum. [Terms](https://wordpress.org/about/domains/), [Privacy](https://wordpress.org/about/privacy/) = Breached-password check (Password Policy) = When enabled, the first 5 characters of the SHA-1 hash of a new password are sent to Have I Been Pwned (api.pwnedpasswords.com), also when you press "Test connection". The password itself never leaves your site. [Terms and privacy](https://haveibeenpwned.com/Privacy) = IP location lookup (Plugin Guard alerts) = When Plugin Guard blocks an executable upload or an untrusted plugin, the IP address of the visitor involved is sent over HTTPS to ipapi.co to add a country and city to the security alert. The GemSecurity Pro add-on uses the same lookup for its country access control. No lookup is made when your CDN already supplies the country. [Terms](https://ipapi.co/terms/), [Privacy](https://ipapi.co/privacy/) = Alerts (Notifications) = When you add a Slack webhook or Telegram bot, security alert text (event, user, IP address and time) is sent to that channel. * Slack — [Terms](https://slack.com/terms-of-service), [Privacy](https://slack.com/trust/privacy/privacy-policy) * Telegram — [Terms](https://telegram.org/tos), [Privacy](https://telegram.org/privacy) = Generic webhook and SIEM collector (Notifications, Settings → Compliance & SIEM) = Only if you enter your own webhook or collector URL, security events (event name, severity, message, user, IP address and time) are sent to that URL. The destination is chosen and operated by you, so its terms and privacy policy are your own. = Site monitoring (Monitoring module) = Uptime, TLS-certificate, DNS, SPF and DMARC checks are made against your own site and domain. DNS lookups use your server's resolver; no data about your site is sent to GemSecurity or Kodezen. = Usage insights (opt-in) = Only if you accept the opt-in notice, GemSecurity sends usage data to Kodezen at store.kodezen.com. This includes your site URL and name, the admin's name and email, the server IP, WordPress, PHP, database and server versions, the site language, active theme, and active and inactive plugins. If you choose to give feedback when deactivating, that feedback is sent too. Nothing is sent if you decline. [Terms](https://kodezen.com/terms-and-conditions/), [Privacy](https://kodezen.com/privacy-policy/) == Source code and libraries == The malware and firewall signatures in the PHP code are stored hex-encoded and decoded with `GemSecurity\Helper::sig()`. They are detection patterns (data), not code, and are encoded only so that antivirus tools do not flag the plugin itself for containing the same strings as the malware it looks for. The admin JavaScript in `assets/build/` is compiled. Its human-readable source is included in the `dev_gemsecurity/` folder and is also public on GitHub: [github.com/imrantushar/gemsecurity](https://github.com/imrantushar/gemsecurity). To rebuild it, run `npm install` and then `npm run build`. To build the full release zip, run `npm run dist`. It installs missing packages and then builds the JS, translation template and zip. GemSecurity bundles these open-source libraries: * [Redux Toolkit](https://github.com/reduxjs/redux-toolkit), [Redux](https://github.com/reduxjs/redux) and [React Redux](https://github.com/reduxjs/react-redux) — MIT * [React Router](https://github.com/remix-run/react-router) — MIT * [React Select](https://github.com/JedWatson/react-select) and [Emotion](https://github.com/emotion-js/emotion) — MIT * [Axios](https://github.com/axios/axios) — MIT * [qrcode.react](https://github.com/zpao/qrcode.react) — ISC * [StoreEngine WordPress SDK](https://store.kodezen.com/) — GPL-3.0-or-later React and WordPress packages are loaded from WordPress core, not bundled. == Installation == 1. Upload the `gemsecurity` folder to `/wp-content/plugins/`, or install through Plugins → Add New. 2. Activate the plugin through the Plugins menu in WordPress. 3. Open the GemSecurity menu and review the dashboard; enable the protections you want. == Frequently Asked Questions == = Where do I start? = Open GemSecurity → Modules and turn on the areas your site needs, then work through Firewall, Login Security and Scanner — they cover the most common attacks. Every page has a "?" button in the top bar that explains what that page does, how to set it up, and what to watch out for. = There are a lot of settings. Is there documentation inside the plugin? = Yes. The "?" button in the top bar opens a guide for the page you are on: a short summary, what the feature actually does once enabled, numbered setup steps, and the caveats worth knowing before you switch something on. = What does turning a module off actually do? = A module that is off loads none of its code, registers no REST routes and shows no menu entry — so features you do not use cost nothing. Its settings are kept, so switching it back on restores your configuration exactly as it was. Menu entries appear and disappear as you toggle, without reloading the page. = Which files does GemSecurity change? = Only when you switch the matching feature on, and only through WordPress's own helpers: Upload Shield adds deny rules to `wp-content/uploads/.htaccess`, and "Protect wp-config.php and error logs" (off by default) adds a marked block to the site's root `.htaccess` that blocks web access to `wp-config.php`, `debug.log` and `wp-admin/includes`. Turning either off removes only its own block. Nothing is written to WordPress core, plugin, theme or must-use folders, and quarantined files are kept in the database and can only be restored, as non-executable files, to the uploads folder. = Will the firewall lock me out? = No. Logged-in administrators are never blocked by the IP blocklist or auto-bans, and aggressive options default to off so you can opt in deliberately. = Which settings could break my site if I enable them carelessly? = The ones the in-plugin guides call out: a custom login URL (save the new address first), an admin IP allowlist on a dynamic home connection, an enforced Content-Security-Policy, HSTS preload, and country blocking applied to the whole site rather than just the login. Each of those is explained in the help drawer on its own page. = Does it work without GemSecurity Pro? = Yes. Everything described above works in the free plugin. Pro adds active threat protection, malware remediation and scale features. == Changelog == = 1.2.2 - 05/11/2026 = * Fixed - The admin-bar styles are now added through WordPress's style functions instead of a `