安全

Decide what your site may load and who may use its files. Security headers are written for you.

Shows only the really critical vulnerabilities in widely used products – searchable, shareable and as RSS feeds. Data from BSI, CISA and NVD.

Audit WordPress plugins and themes for web shells, Tiny File Manager injections, modified files, and official repository checksum mismatches.

Set HSTS, CSP, X-Frame-Options and other HTTP security headers from your dashboard, with presets, testing and reporting.

Checks if your site is exposed to, or was hacked through, PHP2Shell (critical PHP bug) and wp2shell (WordPress bug). Optional fixes you can undo.

Export WordPress to a fast static site on Cloudflare Pages in pure PHP — no Node.js, no build server. Incremental deploys, SEO intact.

Daily malware scan, firewall, login protection and two-factor login. Checks files against WordPress.org and catches ClickFix fake-CAPTCHA injections.

Gate WordPress pages, posts, or custom content behind an email check, with an optional one-time password. No account required.

Lock the WordPress REST API for logged-out visitors. Allowlist routes, stop username enumeration, import from Disable REST API.

Security audit and hardening for WordPress in plain language: a clear 0-100 score, what every finding means, and safe one-click fixes.

Finds installed plugins and themes that are closed, removed, abandoned or untested on WordPress.org, and alerts administrators.

Add Subresource Integrity hashes to enqueued scripts and styles, approve changed files before they are trusted, and scan pages for missing SRI.

Admin-only live WordPress request diagnostics with filters, behavioral indicators, and temporary capture. No blocking or permanent access log.

Move wp-login.php to your own address, check WordPress core files against official checksums and keep a log of logins.

Scans your pages, builds one Content-Security-Policy and sends it with the other security headers. Nothing leaves your website.

Checks the PHP version of your server against known CVEs, the latest release of its branch and its official support dates.

Helps you meet PCI DSS 4.0 requirements 6.4.3 and 11.6.1 by loading the Proteside client-side protection on your payment pages.

Move the login page to your own address, stop password guessing, add a 2-step email code for admins and harden WordPress, with a log of every login.

Store-aware rules for AI agents: hold refunds over an amount, catch large price changes, and stop money before it moves.

Read-only security monitor. Sends a daily signed report of versions, file integrity and admin events to your DevaGuard dashboard.