Description
ArmorPro protects WordPress with a full security stack that runs before your site does. Every feature is free and unlimited. There is no premium tier, no locked panels, and no upgrade prompts.
Attacks get blocked at the PHP engine level, roughly a millisecond into the request, before WordPress loads a single file.
Features
- WAF Engine — Runs before WordPress loads via PHP’s auto_prepend_file, adding roughly 1ms of overhead. Blocks malicious requests at the PHP engine level before any WordPress code executes. Detects and configures Apache, NGINX, and LiteSpeed automatically, and falls back to the standard firewall when enhanced mode is unavailable. Enable it from the Firewall tab with one click.
- Firewall — 600+ built-in patterns covering SQL injection, XSS, path traversal, and shell access, matched across five categories (Request URI, Query String, User Agent, Referrer, IP Address) in three modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggles, hit counts, and your own custom patterns. Pure PHP, so it works on any server without .htaccess.
- Brute Force Protection — Session-based login tracking with automatic lockouts after a configurable number of failures. Repeat offenders can be auto-blacklisted with an optional expiry. Login activity log records IP, country, status, and the usernames tried.
- Two-Factor Authentication — TOTP for Google Authenticator, Authy, 1Password, and any compatible app. QR code setup, ten backup recovery codes, and role-based enforcement with a grace period.
- Passkey Authentication — Passwordless login with Face ID, Touch ID, Windows Hello, or a hardware security key (WebAuthn/FIDO2). Multiple passkeys per user with friendly names and clone detection.
- Bot Protection — Honeypot fields, timestamp validation, and JavaScript token verification on login, registration, and password reset forms. Bots are stopped before they can attempt a single password.
- Access Control — IP whitelist and blacklist with inline notes. Country blocking in allow or block mode, backed by a locally stored DB-IP country database.
- Custom Login URL — Move wp-login.php to any slug you choose. The default login returns a 404.
- Security Headers — Seven managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection, HSTS, Content-Security-Policy, Permissions-Policy) delivered via PHP and optionally .htaccess, with a header probe that avoids duplicating what your server already sends.
- Email Notifications — Daily and weekly security digests, plus event alerts for lockouts, blacklistings, and administrator logins.
- Privacy Hardening — Author slug randomization to stop user enumeration, and email obfuscation to keep addresses away from scrapers. XML-RPC and REST API protection included.
- Dashboard — Real-time stats, a blocks-over-time chart, protection status cards, and a WordPress dashboard widget.
- Tools — Health checks with database integrity verification, one-click table repair, settings export and import, CSV log export, and debug mode.
Privacy by default
Visitor IP addresses never leave your server. Geolocation is resolved against a DB-IP country database stored locally on your own site, not by calling a third-party lookup API. ArmorPro collects no usage statistics and has no license key. See External Services for the detail.
External Services
ArmorPro makes the outbound requests below. Visitor IP addresses are never sent to any external service.
Country Database Download (DB-IP)
To show the country for logged IPs and to power country blocking, ArmorPro downloads DB-IP’s free “IP to Country Lite” database straight from DB-IP and stores it on your server. All lookups then happen locally.
- When: once shortly after activation, via WP-Cron, then checked weekly and downloaded again when DB-IP publishes its monthly update
- Data sent: nothing beyond a standard file download request
- Service: https://download.db-ip.com, run by DB-IP (https://db-ip.com)
- Database license: Creative Commons Attribution 4.0 (https://creativecommons.org/licenses/by/4.0/)
- DB-IP terms: https://db-ip.com/db/lite.php
Individual IP addresses are never sent to this or any other service.
Update Checks (direct download from srworks.co only)
The copy downloaded from srworks.co checks for new versions itself. The WordPress.org version does not; WordPress.org handles its updates.
- When: whenever WordPress checks for plugin updates
- Data sent: nothing beyond a standard request for the update information and, when you update, the plugin file
- Service: https://api.srworks.co
- Terms: https://srworks.co/terms, Privacy: https://srworks.co/privacy
ArmorPro sends no usage statistics and has no license check.
Privacy Policy
ArmorPro stores the following in your WordPress database:
- IP addresses of visitors who trigger a security rule or attempt to log in
- Timestamps of security events
- Usernames used in login attempts
- Country codes resolved locally from the DB-IP country database
Clear all logs at any time from the Tools tab. Log retention is 90 days and old entries are pruned daily. Uninstalling the plugin deletes all of it, along with the WAF bootstrap file and any .htaccess or .user.ini directives ArmorPro added.
Visitor IP addresses are never transmitted off your server.
Support
Questions, bug reports, and feature requests: https://srworks.co/contact
Credits
Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com), used under GPLv2.
Charts by Chart.js (https://www.chartjs.org), MIT License.
Tooltips by Tippy.js (https://atomiks.github.io/tippyjs) and Popper (https://popper.js.org), MIT License.
QR codes by jquery-qrcode (https://larsjung.de/jquery-qrcode/), MIT License.
IP geolocation by DB-IP (https://db-ip.com), licensed under CC BY 4.0.
Installation
- Install through Plugins > Add New, or upload the plugin folder to /wp-content/plugins/
- Activate the plugin through the Plugins menu in WordPress
- Open ArmorPro in your admin menu
- Turn on the features you want
The firewall, brute force protection, and bot protection begin working immediately. The WAF engine, two-factor authentication, passkeys, and custom login URL are opt-in, so nothing changes how you log in until you choose it.
FAQ
-
Is anything paid or limited?
-
No. Every feature is free and unlimited, with no premium tier and no upgrade prompts.
-
Does ArmorPro work with NGINX?
-
Yes. It runs on Apache, NGINX, LiteSpeed, and others. The standard firewall is pure PHP and needs no server configuration. The WAF engine detects your server type and configures itself.
-
What is the WAF Engine?
-
It runs at the PHP engine level, before WordPress begins loading, using PHP’s auto_prepend_file directive to intercept malicious requests in roughly a millisecond. It reads from cached flat files for speed and fails open, allowing requests through, if anything goes wrong.
Enabling it writes a small bootstrap file to your site root and adds an auto_prepend_file directive to .user.ini or .htaccess, depending on your server. Both are removed when you disable it or uninstall the plugin.
-
Will this slow down my website?
-
No. The WAF engine adds roughly 1ms. The standard firewall uses fast string matching early in the WordPress load. Blocked requests stop before WordPress finishes loading, which reduces server load during an attack.
-
How does brute force protection work?
-
Failed logins are tracked per IP address. After a configurable number of failures the IP is locked out for a configurable duration. Repeat offenders can be auto-blacklisted after a set number of blocks, with an optional expiry so entries clear themselves.
-
Can I use this alongside another security plugin?
-
Yes, though features may overlap. Test before relying on both. Running two WAFs or two custom login URLs at once is not recommended.
-
How do I whitelist my IP address?
-
Go to ArmorPro > Access Control and add it to the whitelist. Whitelisted IPs bypass every security check, including brute force lockouts and firewall blocking.
-
I locked myself out. What now?
-
Add
define('ARMOR_DISABLE', true);to wp-config.php to bypass all protection, or create a file named.emergency-bypassin the plugin directory. Either one restores access so you can fix the setting and remove the bypass. -
What data does ArmorPro collect?
-
Security logs are stored locally in your WordPress database: IP addresses that trigger a rule or attempt a login, timestamps, and attempted usernames. Visitor data is never sent to a third party, and ArmorPro collects no usage statistics. See External Services below for every outbound connection the plugin can make.
-
What does the bot protection do?
-
Bot protection adds invisible honeypot fields, timestamp validation, and JavaScript token verification to login, registration, and password reset forms. Automated bots that submit forms without rendering JavaScript or that submit too quickly are blocked before they can attempt brute force attacks.
-
Can I block specific countries from accessing my site?
-
Yes. Country blocking lets you allow only specific countries (whitelist mode) or block specific countries (blacklist mode) from accessing your login page. Uses a DB-IP country database stored locally for fast, unlimited lookups. Country blocking applies to the whole site, not just the login page: it runs on every front-end request, and at the PHP engine level too when enhanced protection is enabled.
-
How do I protect my WordPress login page?
-
ArmorPro offers multiple login protection features: brute force protection with automatic lockouts, bot detection, two-factor authentication, passkey login, REST API protection to block enumeration, author slug obfuscation to hide usernames, and a custom login URL to hide wp-login.php entirely.
-
Does ArmorPro support two-factor authentication?
-
Yes! ArmorPro includes built-in two-factor authentication (2FA) using TOTP (Time-based One-Time Password). Users can set up any authenticator app like Google Authenticator, Authy, or 1Password. Backup codes are also provided in case you lose access to your device. Passkey authentication (Face ID, Touch ID, Windows Hello) is also supported as an alternative.
-
Does ArmorPro protect against malware?
-
ArmorPro focuses on prevention: stopping attacks before they compromise your site. The firewall blocks SQL injection, XSS, and other common attack vectors. For malware scanning and removal, we recommend pairing with a dedicated malware scanner.
-
How do I block bad bots and scrapers?
-
ArmorPro blocks malicious request patterns via the firewall and includes Bad User Agent blocking with a curated list of known malicious bots, scrapers, and vulnerability scanners that’s regularly updated. Bot protection adds additional automated detection on login forms.
-
What happens when an IP is blocked?
-
Blocked visitors see a professional “Access Blocked” page with a 403 status code. The page is clean and branded, informing them to contact the site administrator if they believe it’s an error.
-
Can I export security logs?
-
Yes. You can export login activity, firewall blocks, and blacklist data to CSV files for analysis or compliance reporting.
-
Is it compatible with caching plugins?
-
Yes, including WP Rocket, W3 Total Cache, LiteSpeed Cache, and WP Super Cache. The firewall runs ahead of caching layers and sets appropriate cache-control headers.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“SR WORKS ArmorPro” is open source software. The following people have contributed to this plugin.
Contributors
Translate “SR WORKS ArmorPro” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.0
- Every ArmorPro feature is free, with no license
- Changed: country blocking and GeoIP now use DB-IP’s free country database, downloaded straight to your site once a month instead of from SR WORKS
- Fixed: a failed license check could turn off security headers and empty the IP blocklist. The license check is gone entirely
- Removed: the license tab and anonymous usage telemetry. ArmorPro no longer sends any data to SR WORKS
- Fixed: the Try again link on the country database notice did nothing
1.0.33
- Security release. Fixes two ways the firewall could be bypassed, and stops forwarded IP headers being trusted from sources that are not your proxy. Recommended for all sites.
- Security: the firewall could be skipped by adding a harmless-looking parameter to a request. Both the standard firewall and the enhanced WAF decided whether to skip scanning by searching the whole URL including the query string, so appending something like ?x=/wp-admin/ bypassed every pattern, the blocked-method list and the request length limit. Both now match the request path only. Requests to the real admin area are unaffected.
- Security: the enhanced WAF could be skipped with a fake cookie. When ‘skip logged-in users’ was enabled, any request carrying a wordpress_logged_in_ cookie bypassed the firewall, and the cookie was never validated because the WAF runs before WordPress and cannot check it. The WAF no longer honours that setting. It still applies to the standard firewall, where the login really can be verified.
- Security: forwarded IP headers such as X-Forwarded-For and CF-Connecting-IP are no longer believed unless the request genuinely reached your site through a proxy. Previously anyone could send one and choose their own IP address, which allowed evading lockouts, blacklists and country blocking, impersonating a whitelisted address, or getting an innocent visitor auto-blacklisted. Sites behind Cloudflare or another CDN should add their ranges to the new Trusted Proxies setting; sites behind a local reverse proxy such as nginx keep working with no configuration.
- Security: X-Forwarded-For is now read from the right, so the part of it a visitor can write themselves is no longer mistaken for their real address.
- Security: a Content-Security-Policy value containing a line break could add arbitrary directives to .htaccess. Line breaks are now rejected when the policy is saved.
- Security: exported CSV logs no longer allow a crafted username or request to be treated as a formula by Excel or Google Sheets.
- Fixed: turning enhanced protection on could silently disable another security plugin’s firewall, and turning it off could disable one that was already configured. ArmorPro now refuses to take over an existing auto_prepend_file setting and no longer clears it on removal.
- Fixed: importing a settings file silently switched two-factor enforcement off, because those settings were included in exports but not accepted back on import.
- Fixed: upgrading from ArmorPro Lite could leave protections added since your Lite version switched off.
- Fixed: whitelist entries created by an email unlock link were permanent, leaving a lasting exemption on an address that is usually temporary. They now expire after 24 hours.
- Fixed: passkey logins ignored the Remember Me checkbox and always kept you signed in.
- Changed: internal error handling in the firewall, GeoIP and login paths now catches the full range of PHP errors, not just part of it.
1.0.32
- Fixed: the anonymous usage data setting referred to the plugin as ArmorLite instead of ArmorPro
1.0.31
- Changed: anonymous usage statistics are now enabled by default on the direct download from srworks.co. The WordPress.org version is unchanged and remains opt-in
- Added: telemetry can be disabled with define( ‘SRWORKS_TELEMETRY’, false ) in wp-config.php, or the srworks_telemetry_enabled filter
- Fixed: the readme listed ‘which features are enabled’ as data sent, which was never the case
1.0.30
- Security: passkey logins now enforce the configured user verification level. When set to “Required”, the server verifies that the authenticator actually performed PIN or biometric verification instead of accepting possession of the key alone. Applies to both passkey registration and login.
- Security: the redirect target after a passkey login is now restricted to your own site, falling back to the dashboard.
- Security: hardened HTML escaping in admin tables so logged request data cannot inject markup attributes when viewing the Firewall log.
- Fixed: settings import now merges over defaults instead of replacing them, so importing a partial or older export can no longer switch protections off. Bot protection is now included in import/export.
- Fixed: unlock request rate limiting is now per visitor. Previously a handful of requests from any one client could block the recovery route for every administrator.
- Deployment tooling now verifies the release host’s SSH key.
1.0.29
- ArmorPro is now completely free. Every feature that previously required a license is unlocked for everyone, with no limits: WAF engine, two-factor authentication, passkey login, custom login URL, IP blacklist, country blocking, HSTS, Content-Security-Policy, Permissions-Policy, email notifications, custom firewall patterns, and settings export/import.
- Your existing settings, firewall patterns, IP lists and logs are carried over automatically on update. Protection stays on throughout; nothing needs reconfiguring.
- Log retention increased from 7 to 90 days for all installs.
- New features arrive switched off. Upgrading changes nothing about how you or your users log in. The WAF engine, two-factor authentication, passkeys, and custom login URL are all opt-in, and none of them touch your site until you enable them.
- Removed: activating the plugin no longer writes to your site’s root .htaccess. Security headers are delivered over PHP from the first request, and .htaccess is only written when you save settings.
- Privacy: removed third-party geolocation lookups. Visitor IP addresses are no longer sent to any external service. Country data is now resolved entirely from the local GeoLite2 database.
- Anonymous usage statistics now default to off for every install and require explicit opt-in.
- Removed all upgrade prompts and the license activation screen.
1.0.28
- Fixed: Firewall false positive that could 403 legitimate requests carrying a URL in a query parameter (OAuth redirect_uri, social share links, payment return URLs, callbacks). Removed the over-broad http(s)/ftp(s) protocol-in-query rules; PHP stream wrapper signatures (php://, phps://) are unchanged. Existing installs are cleaned up automatically on update.
1.0.27
- Fixed: Firewall false positive that could 403 legitimate requests containing array or JSON style query parameters (e.g. Fluent Forms entry filters, WooCommerce faceted filters, REST list endpoints). Removed the over-broad bare [ ] { } ? query string rules; targeted bracket attack signatures (GLOBALS[, REQUEST[, etc.) are unchanged. Existing installs are cleaned up automatically on update.
1.0.26
- Fixed: Enhanced WAF verification incorrectly reported ‘not active’ on sites using page caching (fastcgi_cache, Cloudflare, Varnish, LiteSpeed, WP Super Cache, WP Rocket, BoostPro). The check now uses a cache-immune heartbeat and probes a URL that page caches always bypass.
1.0.25
- Bug fixes and improvements
1.0.24
- Bug fixes and improvements
1.0.23
- Bug fixes and improvements
1.0.22
- Remove bundle license auto-activation (per-plugin keys now)
1.0.21
- Switch file extension firewall patterns to contains_path match mode
1.0.20
- Fix false positives on file extension patterns matching query string URLs
- Widen match_mode column to support contains_path value
1.0.19
- Add input normalization pipeline to firewall, misc fixes
1.0.18
- Bug fixes and improvements
1.0.17
- Redesign firewall block pages with ASCII art branding
- Add email unlock recovery and emergency bypass file for lockout prevention
- Add email unlock recovery, branded HTML block page, and email template system
1.0.16
- Auto-update WAF engine on plugin upgrade
- Add REST API protection compatibility warning
1.0.15
- Fix WAF false positives on wp-login redirect URLs
- Plain text block pages with dynamic reasons
- Fix notification init order and per-IP rate limiting
1.0.14
- Bug fixes and stability improvements
1.0.13
- Replace partner SDK with lightweight telemetry
- Code cleanup and UI refinements
1.0.12
- Add standalone WAF engine with enhanced firewall patterns and endswith matching
- Remove login from reserved slugs for custom login URL
- Security hardening, dead code removal, and PHPCS compliance
- UI refinements and admin JS cleanup
1.0.11
- Allow ‘login’ as custom login slug
1.0.10
- Add authentication enforcement with grace period
- Suppress passkey nudge when enforcement is active
1.0.9
- Update readme.txt with high-level feature descriptions and vendor credits
1.0.8
- Remove all Pro/free tier distinctions from readme.txt
- Fix duplicate changelog entries in readme.txt
- Fix activation crash, security headers UI, and cleanup completeness
- Add license secret comment, RUJS firewall bypass, and uninstall completeness
- Unify toast notifications, fix firewall and TOTP improvements
- Audit fixes: firewall execution, pattern matching, XSS hardening, dead code removal
- Increment hit counts for all matching patterns, not just the first
- Switch firewall from regex to string matching for improved performance
- Admin UI improvements, database hardening, passkeys and firewall updates
1.0.7
- Admin UI refinements: card header font size, toggle colors, remove rule ID column
- Remove all Pro/free tier distinctions from readme.txt
- Split bundled firewall rules into individual toggles, remove cookies from rule manager
1.0.6
- Replace Space Grotesk with Inter for headings, remove unused font files
- Hide third-party admin notices on ArmorPro settings page
- Add security headers management, admin UI enhancements, and deploy script updates
1.0.5
- Bug fixes and improvements
1.0.4
- Bug fixes and improvements
1.0.3
- Bug fixes and enhancements
1.0.2
- Bug fixes and stability improvements
1.0.0
- Initial release
- Brute force protection with configurable thresholds
- PHP firewall with SQL injection and XSS protection
- Security headers (X-Content-Type, X-Frame-Options, Referrer-Policy, X-XSS-Protection, HSTS, CSP, Permissions Policy)
- XML-RPC and REST API protection
- Author slug and email obfuscation
- IP whitelist and temporary blocking
- Geolocation with MaxMind GeoLite2
- Two-factor authentication (TOTP) with backup codes
- Country blocking, custom login URL, permanent blacklist
- Auto-blacklist repeat offenders
- Email notifications and security digests
- Extended logging and CSV export