Opis
Lunexia Security & .htaccess Shield is an all-in-one WordPress security suite engineered to defend your website against attacks, malicious bots, unauthorized login attempts, and malware infections. Combining proven .htaccess server hardening, an intelligent Web Application Firewall (WAF), Two-Factor Authentication (2FA / OTP login protection), login brute force defense, and a deep malware scanner with 1-click quarantine, Lunexia provides comprehensive website security that is ultra-lightweight, safe, and fully compatible with WordPress 7.0 Modern admin and PHP 8+.
Whether you need rock-solid login protection, two-factor authentication, malware removal, or instant .htaccess security headers, Lunexia delivers enterprise-grade protection with zero bloat.
🛡️ Key Security Features:
- Two-Factor Authentication (2FA) & OTP Login Security: Add time-based one-time password (OTP) verification for Administrators, Editors, and custom roles. Protect your login forms from credential stuffing and unauthorized access.
- Login Brute Force Protection: Detect, limit, and automatically block malicious IP addresses attempting brute force login attacks.
- Web Application Firewall (WAF): Real-time inspection for SQL Injection (SQLi), Cross-Site Scripting (XSS), Local File Inclusion (LFI), and Remote Code Execution (RCE) attempts without breaking page builders like Elementor or Gutenberg.
- Malware Scanner & Threat Detection: Deep file integrity and heuristic scanner to detect webshells, backdoors, obfuscated base64 code, eval injections, and unauthorized core file modifications.
- 1-Click Quarantine & Cleanup: Instantly isolate infected files into a safe, non-executable quarantine vault with full 1-click restoration and permanent deletion controls.
- Automatic .htaccess Hardening: Safely apply proven Apache/LiteSpeed security rules with automatic timestamped backups before every change.
- Admin Approval Workflow: Require administrator approval for newly registered administrative and editor accounts before they can log in.
- Backend Access Control: Restrict access to
wp-adminandwp-login.phpexclusively to trusted, whitelisted IP addresses. - Security Headers Protection: Automatically enforce Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, and Referrer-Policy.
- Live Traffic Monitor & IP Reputation: Real-time traffic surveillance tracking visitor requests, malicious bots, automated crawlers, and blocked threat origins.
- Modern WordPress 7.0 Ready: Centered layout, high-DPI retina interface, and modern glassmorphic dashboard widgets.
🔒 Security Rules Included:
- Disable directory browsing and file listing (
Options -Indexes) - Protect
wp-config.phpdatabase credentials and.htaccessconfiguration files - Block direct web access to sensitive files (
.bak,.sql,.log,.ini,.sh,.env) - Disable XML-RPC (
xmlrpc.php) to block pingback DDoS and brute force amplifications - Prevent unauthorized PHP script execution in the
wp-content/uploads/directory - Block malicious query string injections, GLOBALS variable overrides, and script tags
- Block author enumeration attacks (
?author=1) to prevent username discovery - Enforce essential HTTP security headers (XSS Protection, No-Sniff, HSTS, Frame Guard)
⚡ Safe, Non-Destructive & Reliable:
- Automatically creates a backup before applying any file modifications.
- Uses native WordPress filesystem APIs for maximum server compatibility.
- All generated rules are cleanly encapsulated in custom markers for 1-click restore.
- Seamless compatibility with Elementor, Gutenberg, WooCommerce, and caching plugins.
External Services
This plugin connects to external services as follows:
Lunexia License Authority (api.lunexiait.com)
This plugin connects to the Lunexia central license server to validate commercial license authenticity, verify cryptographic Ed25519 tokens, and check domain bindings. This connection is used when activating, validating, or deactivating a license key in the plugin dashboard.
- Purpose: Validates license authenticity, cryptographic tokens, and domain licensing.
- When it’s used: When activating, validating, or deactivating an enterprise license.
- What data is sent: License key, website URL/domain, verification nonces, PHP and WordPress version numbers.
- Service provider: Lunexia IT (api.lunexiait.com)
- Terms of Service: https://lunexiait.com/terms/
- Privacy Policy: https://lunexiait.com/privacy/
Instalacja
- Upload the
lunexia-htaccess-shieldfolder to the/wp-content/plugins/directory (or search for Lunexia Security in Plugins > Add New). - Activate the plugin through the Plugins menu in WordPress.
- Navigate to Lunexia Security in your WordPress admin menu.
- Review and toggle your desired security rules and login protection features.
- Click Save & Apply Rules to instantly harden your site.
Najczęściej zadawane pytania
-
How does the Two-Factor Authentication (2FA) and Login Protection work?
-
Lunexia adds OTP (one-time password) verification during login for selected user roles (such as Administrator and Editor). When enabled, users must enter a secure verification code sent to their registered email address before gaining dashboard access, effectively stopping unauthorized logins even if passwords are leaked.
-
Does this plugin work with Elementor and Gutenberg?
-
Yes! Lunexia includes intelligent page builder detection. Firewall inspection automatically accommodates Elementor editor previews, AJAX widget saving, and REST API publishing without false positives or 403 blocks.
-
How does the Malware Quarantine Manager work?
-
When the malware scanner detects a suspicious file or backdoor, you can quarantine it with a single click. The file is immediately moved into a secure, isolated quarantine directory with revoked execution permissions (
0400) and blocked from direct browser access. You can restore the file to its original location or delete it permanently at any time. -
Is this plugin safe for my server?
-
Yes. Lunexia automatically creates timestamped backups of your
.htaccessfile prior to applying any rule changes. If needed, you can restore your configuration with one click from the plugin dashboard. -
Does this replace other security plugins?
-
Lunexia can be used as your primary lightweight security shield or alongside complementary tools. Its low memory footprint and server-level rules provide exceptional performance without slowing down your site.
Recenzje
Wtyczka nie ma jeszcze żadnej recenzji.
Kontrybutorzy i deweloperzy
„Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA) & Malware Protection” jest oprogramowaniem open source. Poniższe osoby miały wkład w rozwój wtyczki.
Zaangażowani
Interesuje cię rozwój wtyczki?
Przeglądaj kod, sprawdź repozytorium SVN lub czytaj dziennik rozwoju przez RSS.
Rejestr zmian
3.2.2
- Enhanced dual-mode cryptographic token verification supporting both 64-byte Sodium Ed25519 and 32-byte HMAC-SHA256 signatures.
- Added staging and local domain normalization (.local, .test, localhost) for seamless local development.
- Fixed Lifetime enterprise license status persistence and renewal status indicators.
- Polished Midnight Obsidian administrative interface with dynamic cache-busting asset versions.
3.2.1
- Upgraded license authority client to
api.lunexiait.comwith Ed25519 cryptographic token verification and anti-tampering protection. - Added 1-click malware quarantine, file restoration, and permanent file deletion actions.
- Added live Quarantine Manager dashboard table displaying isolated files and file metadata.
- Fixed Elementor editor preview canvas and REST publishing false positives in Web Application Firewall (WAF).
- Fixed HTTP method restrictions to preserve REST API and Elementor
DELETEoperations. - Added official high-DPI WordPress.org banners (1544×500, 772×250) and square icons (256×256, 128×128).
- SEO optimized title, keywords, and description for security, login, two factor, firewall, and malware searches.
3.0.0
- Redesigned dashboard with four separate protection score widgets and modern admin visuals.
- Added premium badges to Firewall, Malware Scan, and Advanced Settings navigation tabs.
- Added Security Intelligence and Threat Center dashboards for malware, reputation, and threat intelligence visibility.
- Centered plugin layout with an 80% width wrapper for a cleaner WordPress 7.0 admin experience.