Dwarpal

Dwarpal (Dwarpal WP Security Plugin) protects your WordPress site from common threats, including:

• Firewall Protection – Automatically blocks malicious requests containing SQL injection, XSS, code injection, and directory traversal attempts
• Login Security – Protects against brute force attacks by limiting login attempts and locking out suspicious IP addresses
• SEO Hack Protection – Detects Thai/gambling spam, wp-config injectors, and bot cloaking via local User-Agent comparison (no Google scraping)
• Bot View Scanner – Compares browser vs search-bot responses on your own site; scans wp-config.php and index.php for known malware signatures
• Critical Options Monitor – Alerts when key WordPress settings (site URL, admin email, registration) are changed—catches takeover and redirect hacks
• Outbound Request Monitor – Logs outbound HTTP requests from your site to detect backdoors and data exfiltration
• Security Logging – Comprehensive audit log of all security events for monitoring and analysis
• WordPress Hardening – Removes WordPress version information, disables XML-RPC, and implements other security best practices
• Malware Scanning – Scans files for malware and suspicious patterns
• File Integrity Monitoring – Monitors core files for unauthorized changes
• Two-Factor Authentication – Adds an extra layer of security to login
• IP Blocking & Whitelisting – Block malicious IPs and whitelist trusted ones
• Live Traffic Monitoring – Real-time monitoring of website traffic
• Vulnerability Scanner – Checks for known vulnerabilities in WordPress core, plugins, and themes
• Threat Defense – Opt-in signature feed, virtual patches, auto-block reputation, and security digests
• OWASP Coverage Report – Maps enabled controls to OWASP Top 10 categories

Features

Firewall

• Real-time request scanning
• Pattern-based threat detection
• Automatic blocking of malicious requests
• Configurable firewall rules

Login Security

• Failed login attempt tracking
• IP-based lockout system
• Configurable attempt limits
• Customizable lockout duration

Security Logging

• Complete audit trail
• Event type categorization
• IP address tracking
• Request URI logging
• User agent recording

WordPress Hardening

• WordPress version hiding
• XML-RPC disabling
• RSD link removal
• File editing protection

External services

This plugin can optionally connect to third-party services only when you enable the related feature in the plugin settings. Features that call external services are off by default unless noted.

Google Safe Browsing / Transparency Report (blocklist monitoring)

• What it is: A Google page used to check whether your domain appears to be flagged for unsafe browsing.
• When it is called: Only when Blocklist Monitoring is enabled (disabled by default; requires opt-in).
• What data is sent: Your site domain (host) is sent as part of the request URL.
• Why: To help you identify if your domain may be flagged and needs remediation.
• Service provider: Google.
• Terms: https://policies.google.com/terms
• Privacy: https://policies.google.com/privacy

ip-api.com (GeoIP country lookup)

• What it is: A GeoIP service used to map an IP address to a country code.
• When it is called: Only when Geo-blocking is enabled.
• What data is sent: The visitor IP address is sent to ip-api.com to determine the country code.
• Why: To enforce country-based access restrictions when you enable geo-blocking.
• Service provider: ip-api.com.
• Terms: https://ip-api.com/docs/legal
• Privacy: https://ip-api.com/docs/legal

Bot View Scanner (local cloaking detection)

• What it is: A local scan that requests your own site URLs with different User-Agent headers (normal browser vs search bot) to detect cloaking.
• When it is called: Only when you click Run Bot View Scan or enable Daily Bot View Scan in SEO Protection settings.
• What data is sent: HTTP requests are made to your own site (home_url()). No data is sent to Google or third-party search engines.
• Why: To detect SEO cloaking and wp-config/index.php injection patterns seen in real server compromises.
• External link: Google Search Console is linked for manual verification only (opens in your browser; the plugin does not scrape Google).

WordPress.org API (vulnerability scanner)

• What it is: Official WordPress.org endpoints for core/plugin version data.
• When it is called: When you run the vulnerability scanner.
• What data is sent: Plugin slugs and WordPress version identifiers (standard update API usage).
• Service provider: WordPress.org.
• Terms: https://wordpress.org/about/gpl/
• Privacy: https://wordpress.org/about/privacy/

Optional signature feed (Threat Defense)

• What it is: JSON feed of firewall, malware, and virtual-patch signatures.
• When it is called: Only when Signature feed sync is enabled. If no URL is set, the plugin refreshes from its bundled data/signatures.json. If you set a remote URL, that URL is fetched daily (or on demand).
• What data is sent: A normal HTTPS GET to your configured feed URL. No site visitor data is included.
• Why: To keep detection rules updatable without waiting for a full plugin release.
• Important: Leave disabled (default) if you do not want outbound feed requests.

Optional IP reputation lookup (Threat Defense)

• What it is: An optional JSON reputation endpoint you configure yourself.
• When it is called: Only when local auto-block and remote reputation lookup are both enabled and a reputation URL is set.
• What data is sent: The visitor IP address as a query parameter.
• Expected response: JSON such as {"block":true,"score":90}.
• Important: Disabled by default. Do not enable unless you understand and trust the endpoint you configure.

WordPress.org compliance (storage)

Database exports and plugin-generated files are stored only under:

wp-content/uploads/dwarpal/

This plugin does not:
– Copy or modify wp-config.php
– Write .htaccess to wp-content/ or WordPress core directories
– Define DISALLOW_FILE_EDIT globally (file editor is disabled via a setting + capability filter)
– Call remote files for CSS/JS/images (all assets are bundled)