First stable release. Documents the full module set (incl. WAF) and corrects the Free\/Pro boundary in docs. No breaking changes; internal class\/table names unchanged.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3629833,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3629833,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3629571,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3629571,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.14.4","0.15.0","0.16.0","0.17.0","0.18.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3629613,"resolution":"1","location":"assets","locale":"","width":1388,"height":1458},"screenshot-10.png":{"filename":"screenshot-10.png","revision":3629613,"resolution":"10","location":"assets","locale":"","width":2560,"height":3552},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3629613,"resolution":"2","location":"assets","locale":"","width":2560,"height":4482},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3629613,"resolution":"3","location":"assets","locale":"","width":2560,"height":3200},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3629613,"resolution":"4","location":"assets","locale":"","width":2560,"height":1978},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3629613,"resolution":"5","location":"assets","locale":"","width":2560,"height":3386},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3629613,"resolution":"6","location":"assets","locale":"","width":2560,"height":4324},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3629613,"resolution":"7","location":"assets","locale":"","width":2560,"height":3424},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3629613,"resolution":"8","location":"assets","locale":"","width":2560,"height":5226},"screenshot-9.png":{"filename":"screenshot-9.png","revision":3629613,"resolution":"9","location":"assets","locale":"","width":1524,"height":3424}},"screenshots":{"1":"Dashboard widget \u2014 threat-score header, action items, 24h stat grid with trend arrows, system-status strip, top attackers + targeted users, recent events.","2":"Scanner tab \u2014 file-integrity baseline status, run-now controls, findings table with re-baseline \/ whitelist actions, code-snippet preview for malware-pattern hits.","3":"Vulnerabilities tab \u2014 per-component listing of known CVEs, CVSS scores, fixed-in versions, links to CVE \/ EUVD advisories, active-vs-inactive flagging.","4":"2FA tab \u2014 module enable, force-by-role policy, per-user enrollment status with rescue-disable for lost-device recovery.","5":"Audit tab \u2014 who-changed-what timeline with per-event-type renderer, filter dropdown, 7-day distribution badges.","6":"Modules tab \u2014 WAF with paranoia levels + false-positive viewer, security headers, HaveIBeenPwned, trusted devices, live traffic, captcha, magic links, privacy dashboard.","7":"Hardening+ tab \u2014 custom login URL with live-preview + lockout-recovery hint, honeypot anti-bot toggles, per-header security toggles incl. CSP report-only mode.","8":"Anomaly tab \u2014 Z-score model, per-user baseline status, recent anomalies with explainable context.","9":"Logs tab \u2014 searchable activity log with quick block \/ unblock actions.","10":"Privacy \/ GDPR \u2014 anonymization, pseudonymization, retention, data map, Art. 15 \/ Art. 17 workflows, privacy-policy snippet generator."}},"plugin_section":[262246],"plugin_tags":[2439,1174,55021,600,9217],"plugin_category":[54],"plugin_contributors":[268198],"plugin_business_model":[],"class_list":["post-334812","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-brute-force","plugin_tags-firewall","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor","plugin_category-security-and-spam-protection","plugin_contributors-brainwerk","plugin_committers-brainwerk"],"banners":{"banner":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/banner-772x250.png?rev=3629571","banner_2x":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/banner-1544x500.png?rev=3629571","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/icon-128x128.png?rev=3629833","icon_2x":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/icon-256x256.png?rev=3629833","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-1.png?rev=3629613","caption":"Dashboard widget \u2014 threat-score header, action items, 24h stat grid with trend arrows, system-status strip, top attackers + targeted users, recent events."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-2.png?rev=3629613","caption":"Scanner tab \u2014 file-integrity baseline status, run-now controls, findings table with re-baseline \/ whitelist actions, code-snippet preview for malware-pattern hits."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-3.png?rev=3629613","caption":"Vulnerabilities tab \u2014 per-component listing of known CVEs, CVSS scores, fixed-in versions, links to CVE \/ EUVD advisories, active-vs-inactive flagging."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-4.png?rev=3629613","caption":"2FA tab \u2014 module enable, force-by-role policy, per-user enrollment status with rescue-disable for lost-device recovery."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-5.png?rev=3629613","caption":"Audit tab \u2014 who-changed-what timeline with per-event-type renderer, filter dropdown, 7-day distribution badges."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-6.png?rev=3629613","caption":"Modules tab \u2014 WAF with paranoia levels + false-positive viewer, security headers, HaveIBeenPwned, trusted devices, live traffic, captcha, magic links, privacy dashboard."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-7.png?rev=3629613","caption":"Hardening+ tab \u2014 custom login URL with live-preview + lockout-recovery hint, honeypot anti-bot toggles, per-header security toggles incl. CSP report-only mode."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-8.png?rev=3629613","caption":"Anomaly tab \u2014 Z-score model, per-user baseline status, recent anomalies with explainable context."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-9.png?rev=3629613","caption":"Logs tab \u2014 searchable activity log with quick block \/ unblock actions."},{"src":"https:\/\/ps.w.org\/brainwerk-security-suite\/assets\/screenshot-10.png?rev=3629613","caption":"Privacy \/ GDPR \u2014 anonymization, pseudonymization, retention, data map, Art. 15 \/ Art. 17 workflows, privacy-policy snippet generator."}],"raw_content":"\n
Brainwerk Security Suite is a modern, lightweight security plugin built for the European market. It treats privacy as a first-class feature, not an afterthought, and is designed for WordPress Multisite from day one.<\/p>\n\n
Login & accounts<\/strong><\/p>\n\n Firewall & rate limiting<\/strong><\/p>\n\n File integrity & malware<\/strong><\/p>\n\n Vulnerability scanner<\/strong><\/p>\n\n Hardening<\/strong><\/p>\n\n Detection & response<\/strong><\/p>\n\n Threat Network (opt-in)<\/strong><\/p>\n\n Admin experience<\/strong><\/p>\n\n Privacy & GDPR<\/strong><\/p>\n\n Brainwerk Security Suite Pro is an optional paid companion plugin. Details and pricing: https:\/\/security-suite.brainwerk.at<\/p>\n\n The plugin makes no automatic outbound calls until you opt in. The one you are most likely to enable is the vulnerability scanner, which \u2014 once switched on \u2014 queries an EU-hosted vulnerability API (default Several opt-in<\/strong> features contact external services only after you enable them \u2014 see the External services<\/strong> section below for the full list, the exact data sent, and how to turn each off.<\/p>\n\n All Brainwerk Security Suite data is deleted on plugin uninstall (DB tables dropped, options removed, user-meta wiped, transients purged). The configurable log retention is enforced by a daily cron.<\/p>\n\n This plugin can connect to the external services listed below. Every one of them is opt-in and off by default<\/strong> \u2014 out of the box the plugin contacts nothing. Each can be disabled again at any time, and the vulnerability endpoint can be re-pointed at a self-hosted mirror.<\/p>\n\n 1. Brainwerk Vulnerability API \u2014 2. Brainwerk Threat Network (sensor) \u2014 3. Have I Been Pwned (Pwned Passwords) \u2014 4. hCaptcha \/ Cloudflare Turnstile (optional captcha) \u2014 5. WordPress.org (core checksums & repository integrity) \u2014 Brainwerk Security Suite ships with safe defaults \u2014 no configuration is required to get baseline protection, and out of the box it makes no outbound calls at all. The vulnerability scanner (the one feature that contacts an external API) is off by default; enable it under Vulnerabilities \u2192 Settings<\/strong> if you want daily CVE lookups.<\/p>\n\n\n Not until you ask it to. Out of the box the plugin makes no<\/strong> automatic outbound calls. Every integration that can reach an external service is opt-in and off by default:<\/p>\n\n Each is documented in full in the External services<\/strong> section below.<\/p>\n\n The core local features (WAF, file-integrity monitor, malware-pattern scan, brute-force protection, audit log, 2FA, honeypot, anomaly detection, security headers) make no outbound calls.<\/p><\/dd>\n Yes \u2014 IP anonymization, configurable retention, and a published data map are on by default. The admin includes copy-paste ready text for your privacy policy.<\/p><\/dd>\n Yes. Network-activate it and configure once at the network level; per-site overrides are supported. A cross-site aggregate dashboard is a Pro feature.<\/p><\/dd>\n Use one of the 8 recovery codes generated when you enrolled. If you also lost those, an administrator with Add this line to Then visit Open Brainwerk Security Suite \u2192 Modules \u2192 WAF<\/strong>. The false-positive viewer lists the last 30 blocks; click \"Whitelist\" next to your legitimate path to add it to the WAF path allowlist. Start at paranoia level 1 and raise it only after watching the block log.<\/p><\/dd>\n\n
\n
\n
eval(base64_decode(...))<\/code>, webshell signatures (c99\/r57\/WSO\/b374k), inline wp_insert_user(role=admin)<\/code>, preg_replace \/e<\/code>, remote include via URL \u2014 runs only against deltas, not full corpus, so it stays cheap.<\/li>\n\n
shieldforge-intel.brainwerk.at<\/code>), which aggregates public sources (wpvulnerability.net, EUVD). No API key. The endpoint is configurable \u2014 point it at a self-hosted mirror. See External services<\/strong> below for exactly what is sent.<\/li>\n\n
system.multicall<\/code>), hide WordPress version, block author enumeration, restrict REST API for anonymous visitors (users \/ comments \/ search \/ settings \/ themes \/ plugins endpoints).<\/li>\n\n
.env<\/code>, wp-config.bak<\/code>, xmlrpc.php<\/code> and friends).<\/li>\n\n
\n
\n
Pro features (separate companion plugin)<\/h4>\n\n
\n
Privacy Policy<\/h3>\n\n
Data stored in your WordPress database (never leaves the server)<\/h4>\n\n
\n
[changed]<\/code> markers for sensitive fields).<\/li>\nData sent to external services<\/h4>\n\n
https:\/\/shieldforge-intel.brainwerk.at\/<\/code>) once per day. It is off by default; the endpoint is configurable and the feature can be disabled again at any time.<\/p>\n\n\n
GET \/v1\/vulns\/plugin\/contact-form-7\/<\/code>.<\/li>\nshieldforge-intel.brainwerk.at<\/code> is Brainwerk's own EU-hosted API that aggregates public vulnerability data (wpvulnerability.net, EUVD).<\/li>\nLifecycle<\/h4>\n\n
External services<\/h3>\n\n
https:\/\/shieldforge-intel.brainwerk.at\/<\/code> \u2014 OPT-IN, default OFF<\/strong><\/p>\n\n\n
GET \/v1\/vulns\/plugin\/contact-form-7\/<\/code>). No site URL, no domain, no admin email, no IP, no user data, no content, no settings.<\/li>\nshieldforge-intel.brainwerk.at<\/code> is Brainwerk's own EU-hosted API that aggregates public vulnerability data (wpvulnerability.net \u2014 a community mirror of WPScan \/ Patchstack \u2014 and the EU Vulnerability Database, EUVD). Operated by Brainwerk (EU). Privacy: https:\/\/brainwerk.at\/privacy<\/a><\/li>\n<\/ul>\n\nhttps:\/\/shieldforge-intel.brainwerk.at\/<\/code> \u2014 OPT-IN, default OFF<\/strong><\/p>\n\n\n
https:\/\/api.pwnedpasswords.com\/<\/code> \u2014 OPT-IN, default OFF<\/strong><\/p>\n\n\n
https:\/\/hcaptcha.com\/<\/code>, https:\/\/challenges.cloudflare.com\/<\/code> \u2014 OPT-IN, default OFF<\/strong><\/p>\n\n\n
https:\/\/api.wordpress.org\/<\/code>, https:\/\/downloads.wordpress.org\/<\/code> \u2014 OPT-IN \/ on demand<\/strong><\/p>\n\n\n
\n
brainwerk-security-suite<\/code> folder to \/wp-content\/plugins\/<\/code> or install via the WordPress plugin uploader.<\/li>\n\n
Does Brainwerk Security Suite call any external service?<\/h3><\/dt>\n
\n
https:\/\/shieldforge-intel.brainwerk.at\/<\/code>) once per day for the slug + version of each installed component. Nothing else (no site URL, no admin email, no IP, no user data) is sent, and you can point it at a self-hosted mirror under Brainwerk Security Suite \u2192 Vulnerabilities \u2192 Settings<\/strong>.<\/li>\nIs the plugin GDPR-compliant out of the box?<\/h3><\/dt>\n
Does it work on Multisite?<\/h3><\/dt>\n
I lost my 2FA device. How do I get back in?<\/h3><\/dt>\n
manage_network_options<\/code> capability can disable 2FA for any user under Brainwerk Security Suite \u2192 2FA \u2192 Users with 2FA configured \u2192 Rescue: disable<\/strong>.<\/p><\/dd>\nI enabled the custom login URL and locked myself out. How do I recover?<\/h3><\/dt>\n
wp-config.php<\/code> (above the \"That's all\" comment):<\/p>\n\ndefine('SHIELDFORGE_LOGIN_RESCUE', 'choose-a-long-random-secret');\n<\/code><\/pre>\n\nhttps:\/\/your-site\/wp-login.php?shieldforge_rescue=choose-a-long-random-secret<\/code> to bypass the 404 and reach the standard login.<\/p><\/dd>\nThe WAF blocked one of my own URLs. What do I do?<\/h3><\/dt>\n
Will it slow down my site?<\/h3><\/dt>\n