Login Armor
🇫🇷 Fully translated into French. Interface et documentation intégralement disponibles en français. Thirteen security modules. One lightweight plugin. No premium tier. Login Armor protects WordPress login, accounts and administration with thirteen independent modules. It is built for agencies, freelancers and site owners who want practical security, clear evidence and safe defaults without a remote dashboard, bundled telemetry or upsells. Why Login Armor Complete and free: every module is included under the GPL. Lightweight: modules load only when needed and normal login checks add less than 2 ms on a typical setup. Private by default: data stays on your site. Optional external calls are disabled until you enable the related feature. Ready for real sites: multisite support, reverse-proxy controls, WP-CLI commands and production-safe defaults. Thirteen security modules Hide Login: replace wp-login.php with a private slug and return a 404 or redirect blocked visitors to a chosen URL. Brute Force Protection: escalating lockouts, subnet blocking, trusted proxy headers and coverage for login, password recovery, registration, XML-RPC and REST users. Hardening: fifteen controls for XML-RPC, pingbacks, file editing, version exposure, application passwords, author enumeration, reserved usernames, honeypots and new-admin alerts. Two-Factor Authentication: TOTP, email codes, backup codes, trusted devices, per-role enforcement, grace periods and recovery. Detection and Incidents: group raw events into attack patterns with severity, timelines, source IPs, targeted users and one-click actions. Activity Log: tamper-evident admin audit trail with filters, CSV export, retention controls and optional signed SIEM forwarding. Security Headers: CSP, X-Frame-Options, Permissions-Policy, Referrer-Policy and X-Content-Type-Options for login and lockout pages, with optional site-wide baseline headers. Breach Check: privacy-preserving Have I Been Pwned password checks and an optional XposedOrNot email check. Password Policy: length and character rules, username exclusion, breached-password rejection and optional non-locking expiration reminders. Session Management: idle timeout, maximum lifetime, optional single-device access and one-click revocation of other sessions. IP Geolocation: cached country lookup for IPs shown in Incidents and Events, with private ranges excluded. Request Firewall: optional, monitor-first filtering of malicious paths, query strings and HTTP methods, with administrator exclusions and IP/path allowlists. Bot Challenge: an invisible proof-of-work the browser solves before the login form is accepted, an alternative to CAPTCHAs with no external service; monitor-first, then enforce. Additional tools Login Armor also includes guided onboarding, a 0-100 security score, conflict detection, email/Slack/Discord/webhook notifications, a dashboard widget and a complete WP-CLI suite. The optional AI Security Briefing uses your own WordPress AI connector to explain a thirty-day security snapshot or a single incident. It always starts with deterministic facts, works without AI and sends nothing until an administrator explicitly requests an analysis. GPL forever. PHP 8.1+. WordPress 6.8+. Zero dependencies. Treize modules de sécurité. Une seule extension légère. Aucune version premium. Login Armor protège la connexion, les comptes et l’administration de WordPress grâce à treize modules indépendants. L’extension s’adresse aux agences, freelances et propriétaires de sites qui veulent une sécurité concrète, des preuves lisibles et des réglages sûrs, sans tableau de bord distant, télémétrie imposée ni upsell. Pourquoi Login Armor Complet et gratuit : tous les modules sont inclus sous licence GPL. Léger : les modules se chargent uniquement lorsque nécessaire et les contrôles ajoutent moins de 2 ms sur une connexion normale. Privé par défaut : les données restent sur votre site. Les appels externes optionnels sont désactivés tant que vous n’activez pas la fonction concernée. Prêt pour la production : multisite, reverse proxies, commandes WP-CLI et réglages par défaut sécurisés. Treize modules de sécurité Masquer la connexion : remplace wp-login.php par un slug privé et renvoie une 404 ou redirige les visiteurs bloqués vers l’URL choisie. Protection contre la force brute : verrouillages progressifs, blocage de sous-réseaux, proxies de confiance et protection de la connexion, récupération, inscription, XML-RPC et REST users. Renforcement : quinze contrôles pour XML-RPC, les pingbacks, l’éditeur de fichiers, la version, les mots de passe applicatifs, l’énumération d’auteurs, les identifiants réservés, le pot de miel et les alertes nouvel administrateur. Authentification à deux facteurs : TOTP, codes par e-mail, codes de secours, appareils de confiance, application par rôle, période de grâce et récupération. Détection et incidents : regroupe les événements en scénarios d’attaque avec sévérité, chronologie, IP sources, comptes ciblés et actions immédiates. Journal d’activité : piste d’audit admin infalsifiable avec filtres, export CSV, rétention et transfert SIEM signé optionnel. En-têtes de sécurité : CSP, X-Frame-Options, Permissions-Policy, Referrer-Policy et X-Content-Type-Options pour les pages de connexion et de verrouillage, avec en-têtes de base optionnels sur tout le site. Détection de fuites : vérification confidentielle des mots de passe via Have I Been Pwned et contrôle optionnel des e-mails via XposedOrNot. Politique de mot de passe : longueur, classes de caractères, exclusion de l’identifiant, rejet des mots de passe compromis et rappels d’expiration non bloquants. Gestion des sessions : délai d’inactivité, durée maximale, accès limité à un appareil et révocation des autres sessions. Géolocalisation IP : pays des IP affichées dans Incidents et Événements, avec cache et exclusion des plages privées. Pare-feu de requêtes : filtrage optionnel, d’abord en surveillance, des chemins, requêtes et méthodes HTTP malveillants, avec exclusion des administrateurs et listes d’autorisation IP/chemins. Défi anti-bot : une preuve de calcul invisible résolue par le navigateur avant validation du formulaire de connexion, alternative aux CAPTCHA sans service externe ; d’abord en surveillance, puis en blocage. Outils complémentaires Login Armor inclut aussi un assistant de configuration, un score de sécurité de 0 à 100, la détection de conflits, les notifications par e-mail, Slack, Discord ou webhook, un widget de tableau de bord et une suite WP-CLI complète. Le briefing de sécurité IA optionnel utilise votre propre connecteur IA WordPress pour expliquer les trente derniers jours ou un incident précis. Il commence toujours par des faits déterministes, fonctionne sans IA et n’envoie rien tant qu’un administrateur ne demande pas explicitement une analyse. Conçu par Login Armor est conçu et maintenu par Fabrice Ducarme de WPFormation. Nous l’utilisons sur chaque site que nous livrons. Présentation et fonctionnement de Login Armor Guides de sécurité WordPress sur WPFormation Veille des vulnérabilités WordPress sur WPFormation GPL pour toujours. PHP 8.1+. WordPress 6.8+. Zéro dépendance. External Services Login Armor has no telemetry and requires no Login Armor account. The following services are contacted only when WordPress itself or an administrator enables the related feature. WordPress AI connector (optional) The AI Security Briefing sends a security prompt through the administrator’s own WordPress AI connector only after they click an analysis button. Minimised mode sends counts, categories, severities and role buckets without clear IP addresses or usernames. Explicit deep mode also sends IP addresses and event details. Login Armor stores no provider API key. The selected AI provider’s terms and privacy policy apply. Slack, Discord or custom webhook (optional) When an administrator enables an incident notification channel, Login Armor sends the incident type, severity, IP address, target username, event count and site URL to the configured endpoint. The separate signed Activity Log forwarding option sends the event, object, user ID/login/role, IP address, description, integrity hashes, site URL and plugin version to the administrator’s SIEM or custom webhook. Slack: Terms | Privacy Discord: Terms | Privacy Custom webhook: terms and privacy are controlled by the administrator’s chosen endpoint. Gravatar The Activity Log uses WordPress core’s get_avatar(). If avatars are enabled in WordPress, a hashed email address may be sent to Gravatar to retrieve the image. Gravatar: Terms | Privacy Have I Been Pwned (optional) Breach Check and the optional compromised-password policy send only the first 5 characters of a password’s SHA-1 hash to the Pwned Passwords API. The password and full hash never leave the site. Checks fail soft if the service is unavailable. Public registration and password-reset validation do not call the service; authenticated checks remain active. Have I Been Pwned: Privacy | Acceptable Use XposedOrNot (optional) The separate Email check, disabled by default, sends the user’s email address and a plugin-identifying User-Agent to XposedOrNot when a user is created or changes email. XposedOrNot: Service | Privacy ipwho.is (optional) IP Geolocation sends a displayed public IP address to ipwho.is when an administrator opens Incidents or Events. Results are cached for 30 days. Private and reserved ranges are never sent, and developers can replace the lookup through the login_armor_geoip_lookup filter. ipwho.is: Service | Documentation
RockScout AI
RockScout AI tells you what is happening on your WordPress site in language you can act on — which security gaps matter, what changed since last week, and what to do about it. Vulnerability Scanner — Checks your installed plugins, themes, and WordPress core against the Wordfence Intelligence vulnerability database. For every match you get the severity, the affected versions, and the recommended action, sorted so the urgent ones come first. Matching runs entirely on your own site. Requires a free Wordfence Intelligence API key. Plain-Language Explanations — For any finding, get an explanation of what the vulnerability actually means for your site, what the real-world risk is, what to do, and how urgently. Explanations are strictly grounded in the vulnerability record — no invented details. Requires an AI provider (see FAQ). Activity Tracker — Automatically logs plugin updates, theme changes, content edits, media uploads, user role changes, and logins. When something looks different, you can see what changed and when instead of guessing. Site Health Check — WordPress version, PHP version and end-of-life status, active plugins with pending updates, scheduled task status, recent errors, and database info in one place. Site Assistant — Ask questions about your site in plain language: “What changed this week?”, “Are any plugins outdated?”, “Why is the site slow?”. The assistant reads your activity log, health data, and vulnerability findings to answer. Two ways to connect a provider: paste an API key directly in plugin settings (OpenAI, Anthropic, Google Gemini), or use the WordPress AI Client on WordPress 7.0+. AI Agent Integration — Registers WordPress Abilities so MCP-compatible agents such as Claude Desktop or Cursor can read your site health, activity log, plugin status, and vulnerability findings. Read-only. Requires the MCP Adapter plugin. What it helps with Knowing which security gaps on your site actually matter, and which one to fix first Seeing what changed after a site went live — updates, edits, logins — without digging through logs Getting an answer in plain language instead of a technical dashboard Works the same whether you look after one site or twenty. How it works Install and activate the plugin Activity logging and the site health check start immediately — no configuration needed Add a free Wordfence API key to enable vulnerability scanning (Optional) Configure an AI provider for plain-language explanations and the site assistant External Services Nothing is sent anywhere until you enable a feature that needs it. Activity logging, the site health check, and vulnerability matching all run entirely on your own site. 1. Wordfence Intelligence — vulnerability data feed Optional. Requires a free Wordfence API key, configured in RockScout AI → Settings. Downloaded to your site: vulnerability records — title, CVE identifier, severity score, affected version ranges, and remediation guidance. Uploaded: nothing. Your list of installed plugins, themes, and versions is never sent to Wordfence. All matching happens locally on your site. Wordfence Intelligence — https://www.wordfence.com/threat-intel/ | Terms | Privacy Vulnerability records include data from the MITRE CVE Program and from Defiant, Inc. Attribution is displayed with each record. 2. AI provider — explanations and site assistant Optional. Active only once you configure an AI provider, and only at the moment you send a message or click “Explain in plain language”. There is no background or scheduled AI request. What is sent with a request: Your question, as you typed it A site summary: WordPress version, environment type, PHP version, time zone and local time, HTTPS status, site language, active theme, number of active plugins, number of pending updates, number of administrator accounts, and a count of vulnerability findings by severity A summary of recent changes on the site: what changed, when, and the role of the account that made the change Depending on what you asked about, one additional group of details may be included — for example plugin and theme names with version numbers, matched vulnerability records, recent lines from the PHP error log, scheduled task status, content counts, or upload and memory limits. Details unrelated to your question are not sent. What is never sent: Passwords or API keys Usernames, display names, email addresses, or IP addresses Post, page, or product content Customer, order, or form submission data Media files A note on the error log: PHP error messages can contain absolute file paths from your server. Error log lines are included only when your question relates to errors or something being broken, and are limited to the last few entries. RockScout AI does not operate a server of its own for these features. Requests go directly from your site to the provider you chose, and are subject to that provider’s terms: OpenAI — https://openai.com | Terms | Privacy Anthropic — https://www.anthropic.com | Terms | Privacy Google Gemini — https://ai.google.dev | Terms | Privacy When using the WordPress AI Client on WordPress 7.0+, requests are routed through whichever provider plugin you have installed, and that provider’s terms apply instead. Troubleshooting Vulnerability scan fails with “rate limit reached” The Wordfence Intelligence API allows one request per 30 minutes on the free tier. Clicking Scan Now repeatedly will hit this limit. Fix: Wait 30 minutes. The plugin enforces its own cooldown, and daily scans via WP Cron are unaffected. Saving your API key always succeeds even when the feed is temporarily unavailable. Vulnerability scan takes a long time or times out The Wordfence production feed is roughly 120 MB. On slow connections or low-memory hosting the download may time out. Fix: Ensure PHP max_execution_time is at least 120 seconds. The plugin raises the memory limit automatically. If the scan still times out from the admin button, it retries in the background via WP Cron. Google Gemini: “You exceeded your current quota” (limit: 0) Google’s free tier API keys may have a quota of zero requests for new projects or accounts without billing enabled. This is a Google restriction, not a plugin bug. Fix: Enable billing in the Google Cloud Console. Even on the free tier this raises the quota from 0 to 15 requests per minute. Alternatively switch to OpenAI or Anthropic in RockScout AI → Settings. Google Gemini: “This model only supports Interactions API” Some newer Gemini models, such as deep-research and preview builds, do not support the standard generateContent endpoint used by this plugin. Fix: The plugin clears its model cache and selects a compatible model on the next request. If the problem persists, set the model manually to gemini-2.5-flash in RockScout AI → Settings. Site assistant shows “Not connected” No AI provider is configured. Go to RockScout AI → Settings and either paste an API key, or configure a provider in Settings → Connectors on WordPress 7.0+. Scheduled scans are not running If DISABLE_WP_CRON is defined on your site, or WP Cron is not being triggered, daily refreshes will not happen. The site health data shows scheduled task status, including overdue tasks. Fix: Use Scan Now manually, or configure a real server cron job to hit wp-cron.php.
