Name: Ensomedia Security powered by shieldwave.io
Author: shieldwave

Ensomedia Security, powered by shieldwave.io, scans your site from the inside and tells you in plain language what is wrong and how to fix it. It is built around one idea: an alert has to be worth your attention. Every check, scan and alert is free, needs no account and has no limits. The screens and alert emails come in 17 languages (see the FAQ).

Why owners switch to it

Official checksums first. Core, directory plugins and directory themes are compared with files WordPress.org published for your version.
Malware detection that needs real evidence. One weak signal is never a finding. Unsure findings go under “Ask your developer to check” and send no email.
Change monitoring for what WordPress.org cannot verify: premium plugins, custom themes, must-use plugins and drop-ins.
Alerts that do not cry wolf. One email per scan for new or worse problems at or above your threshold, at most four a day, and at once when an account becomes administrator or the user name of an administrator gets locked. A check that could not run never sends email.
Never rewrites your site on its own. Files, users and settings change only when you press a button or turn on a switch.

The checks

Malware and backdoors in files WordPress.org cannot vouch for: web shells, decode-and-execute chains, obfuscated code, remote code loaders, PHP hidden in images, spam mailers, hidden administrators, injected JavaScript and malicious redirects.
Core, plugin and theme files against WordPress.org, plus PHP files the releases do not contain.
File changes against the recorded baseline, and plugin or theme folders that appear without the WordPress installer.
PHP files in uploads, and .htaccess or .user.ini rules that make the server run uploads as PHP.
Known vulnerabilities (opt-in) in plugins, themes and WordPress, premium ones included, with the version that fixes each one.
Closed, abandoned and unused plugins and themes, updates and PHP version support.
Injected content: scripts, hidden iframes and spam links in posts, widgets, every site option, code snippets and account data. Ordinary embeds and tracking codes are left alone.
What visitors and search engines see: the home page and checkout as a visitor, Googlebot and a search click, and spam pages in the site folder.
Exposed files your server hands out to anyone (wp-config.php copies, database dumps, backups, .git, .env, logs), confirmed by a request to your site; leftover installers; folder listings.
Accounts and configuration: administrators, user registration, wp-config.php, debug output, file editor, XML-RPC, HTTPS, user list exposure, suspicious scheduled tasks and backups.

Live protection (three features, all opt-in):

Known vulnerabilities: the lookup above.
Live threat feed: new malware rules and file signatures from ShieldWave reach your site within about an hour, verified by signature. It sends nothing about your site.
AI second opinion: for a file the local rules cannot judge, a redacted excerpt gets a verdict in plain words.

All three are off until you turn them on (the plugin asks once after activation) and run from WP-Cron once an hour, whether or not a scan is running. See External services.

Request firewall

An optional local firewall, off until you turn it on: attack rules for common injections and executable uploads, IP and country blocks, request limits and narrow exceptions. It sends no request data.

Login protection

Failed logins are limited per address (five by default, then a cooldown you set) and per user name across all addresses (20 an hour by default, any number from 1 to 500, 0 turns it off). Password reset requests are limited per address, 5 an hour by default. A lock is always temporary, and trusted addresses are never locked.
Only the connection’s own address counts, never a header a request can fake. Behind a proxy or CDN, list its addresses or CIDR ranges (/8 or narrower, up to 20 entries) under trusted proxies and pick the header with the visitor’s address.
User names are hidden from logged-out visitors: login errors, ?author=N, the REST API, embeds and the users sitemap.
On by default for new installs, off after an upgrade.
Opt-in: a bot check on the login forms, refusing breached passwords, a hidden login address and form spam traps.

Two-factor login, passkeys and sessions

Two-factor login with an authenticator app, ten recovery codes and wp shieldwave two-factor disable <user>, so nobody is locked out.
Required for the roles you choose, with 0 to 30 days (7 by default) to set it up.
Passkeys (WebAuthn) as the second step or, opt-in, to sign in without a password, on HTTPS with PHP’s OpenSSL extension.
See where your account is signed in, sign out other sessions or every user, and set how long an administrator’s session lasts.

Hardening

One switch each:

The plugin and theme file editor and XML-RPC, without editing wp-config.php.
PHP in uploads: a block in the uploads .htaccess file on Apache and LiteSpeed, the nginx and IIS rule, and Check now to test it.
Security headers, Strict-Transport-Security over HTTPS only. Headers already sent are kept.
Virtual patches. With the live threat feed on, a small must-use file stops requests exploiting a known vulnerability of an installed plugin, when the feed has a patch for it and the installed version is affected. Each patch is reviewed and tested against ordinary requests before it enters the feed. On by default. They block once you accept the offer after activation, else only record. Patch count: shieldwave.io/wordpress-plugin.
Security updates (WordPress 6.6 or newer), chosen per plugin: WordPress’s automatic updates install a release that fixes a known vulnerability of the installed version, and roll back if the update fails.

A file with a finding of medium severity or higher can be moved into quarantine with one button, and Restore puts it back. The FAQ explains what is never moved.

Activity log and privacy

Each history entry carries a keyed hash that includes the hash of the entry before it, so Check history integrity shows whether an entry was edited or deleted outside ShieldWave. Entries are kept for 7 to 730 days (90 by default) and can be exported as CSV. The plugin adds a suggested text to Settings > Privacy and takes part in the WordPress personal data export and erasure tools.

ShieldWave dashboard (optional)

Press Connect with shieldwave.io under ShieldWave > Settings and the site shows up in your dashboard at shieldwave.io with its score and open issues. Pro (12 USD a month) and Enterprise (29 USD a month) add the outside scan, monitoring and reports, other currencies on shieldwave.io/pricing. The dashboard cannot change anything on the site. See External services.

What this plugin does not do

It is not a full web application firewall and does not clean malware out of files. It can put back the WordPress.org original of a changed core, plugin or theme file; other fixes it explains are yours to make. Ensomedia Security is built by ENSOMEDIA (Radosław Fedorczuk, Wrocław, Poland), which also runs shieldwave.io.

External services

No outside requests are made on activation or when admin pages load, only when a scan runs, when you use the account actions, and once an hour from WP-Cron for the live protection features you turned on and a connected account. Requests to your own site are listed in the FAQ. Requests to WordPress.org and most requests to your own site use the WordPress HTTP API’s default user agent (WordPress version and site address). Requests to ShieldWave send a neutral user agent (ShieldWave-Security and the plugin version) and never your site address in their headers. Each request comes from your server’s IP address.

WordPress.org core checksums (api.wordpress.org/core/checksums/1.0/)
For the “WordPress core files” check. Sent: your WordPress version and package language. Cached for a day.

WordPress.org release list (api.wordpress.org/core/stable-check/1.0/)
Tells the same check which older releases to compare with. Sent: nothing about your site. Cached for a day.

WordPress.org plugin checksums (downloads.wordpress.org/plugin-checksums/)
For the “Plugin files” check. Sent: the folder name and version of each installed plugin. Cached for a week, or for a day when no list was available.

WordPress.org repository (core.svn.wordpress.org, plugins.svn.wordpress.org, themes.svn.wordpress.org)
Only when you press “Replace with the original” on a finding. Sent: the version and path of that one file.

WordPress.org theme packages (downloads.wordpress.org/theme/)
For the “Theme files” check: each directory theme’s release package is downloaded, hashed and deleted. Sent: the theme’s folder name and version. Cached for a week.

WordPress.org plugin information (api.wordpress.org/plugins/info/1.2/)
Used by the “Closed and abandoned plugins” check. Sent: the folder name of each installed plugin. Cached for a day.

WordPress.org theme information (api.wordpress.org/themes/info/1.2/)
Tells the “Theme files” check which installed themes come from the directory. Sent: the folder name of each installed theme. Cached for a day.

All seven are provided by WordPress.org: privacy policy.

ShieldWave vulnerability lookup (shieldwave.io, endpoint /api/plugin/vulnerabilities), off until you turn it on
For the “Known vulnerabilities” check. Sent: your WordPress version and the folder name and version of each installed plugin and theme, premium ones included. A premium plugin’s product name is compared on your site, never sent. No site address, no account, no personal data. The data comes from Wordfence Intelligence, and each result links to its record with its copyright notice; links go only to Wordfence, NVD, CVE.org, WPScan, Patchstack, shieldwave.io, WordPress.org and the GitHub advisory database. Runs with the scan and WP-Cron; cached 3 hours, source data refreshed every 6 hours.

ShieldWave threat feed (shieldwave.io, endpoints /api/plugin/intel and /api/plugin/intel/head), off until you turn it on
For the “Live threat feed” option and virtual patches. The plugin downloads a signed file of extra malware rules, file signatures and virtual patch rules once an hour from WP-Cron and verifies its signature before use. It checks every 15 minutes and can switch off parts of this plugin on a flawed version until updated. Sent: nothing about your site; only the plugin version, which every request carries.

ShieldWave AI second opinion (shieldwave.io, endpoint /api/plugin/ai/review), off until you turn it on
For a file the local rules cannot judge. Sent: an excerpt of up to 6,000 characters around the suspicious code; the file’s SHA-256 and MD5 fingerprints and size; its kind and where it sits (plugin or theme folder name, uploads and so on); the local verdict and the matched rule identifiers; the site language, the plugin version and a salted hash of the site. Removed before sending: your site address, email addresses, IPv4 and IPv6 addresses, the server paths of WordPress and of home folders (replaced by a neutral path), every DB_ constant and the arguments of database connections, values named like a password, key, salt, secret or token (from 6 characters) and long random tokens. Other web addresses stay. Never read: wp-config*, .env*, .htpasswd, .user.ini, php.ini, auth.json, backup copies (.bak, .old, .orig, .save, .swp, names ending in ~), .sql dumps, logs and .ini files. If the redaction fails, nothing is sent. shieldwave.io passes the excerpt to an AI provider of shieldwave.io, described in the ShieldWave privacy policy; the verdict is kept by the file’s fingerprint and shared across sites. Runs after a scan and once an hour from WP-Cron.

Link to the outside check (shieldwave.io)
The Overview links to the free outside check. Nothing is sent until you click; then your browser opens shieldwave.io/?check=yourdomain.com. Links to shieldwave.io carry utm_source=wordpress, utm_medium=plugin and utm_campaign=(the screen).

ShieldWave account (shieldwave.io), only after an administrator connects the site under ShieldWave > Settings

Connecting opens shieldwave.io/connect in your browser with this site’s address, the address to come back to and a random value. Back on the site, the plugin sends the single-use code, this site’s id and address, and the plugin, WordPress and PHP versions to /api/plugin/connect/exchange and receives a key for this site. With a pasted API key, /api/license/verify receives the key and /api/plugin/connect the same site facts.
While connected, the home page carries a meta tag named shieldwave-verify with a code of your account, and /api/plugin/verify-domain asks shieldwave.io to read it, after connecting and every few hours until the domain is confirmed.
Hourly and after each scan: /api/plugin/heartbeat receives the site id, the site address and language, the versions of the plugin, WordPress and PHP, the scan status, the score and grade, the issue counts and the times of the last and next scan.
Decoys, with the heartbeat and the sync: whether they are on, and per use the kind, time, how it came in, whether it locked the address out or why not, and a keyed hash of the address, whose key never leaves the site.
After each scan (if sending is on): /api/plugin/sync receives the scan summary (counters, score, active theme, number of active plugins, site language and the language of the administrator who started the sync), the open and ignored issues (severity, confidence, title, message, fix, when first seen, the file, plugin or setting involved, rule identifiers, line, the plugin or theme and its version, the vulnerability identifier, score and record link, and the AI second opinion when there is one) and the installed plugins and themes with their names, versions and source.
Never sent: posts, pages, comments, user names, email addresses or passwords. Private issues (accounts, site address, snippets, drafts) go with title and general advice only.
“Disconnect” calls /api/plugin/disconnect, which removes this site and its results from shieldwave.io. Deleting the plugin from the Plugins screen makes the same call once, with a 5 second limit, before the key is removed.
The key is kept in the database encrypted with a key derived from your wp-config.php salts, where the server has libsodium, and sent only in a request header.

Have I Been Pwned, Pwned Passwords (api.pwnedpasswords.com/range/), off until you turn it on
On new passwords and weekly at sign-in. Sent: the first 5 characters of the password’s SHA-1 hash. Privacy policy.

Cloudflare (challenges.cloudflare.com, api.cloudflare.com), only with your keys or token
Turnstile: login forms load its script; answers go with your secret key to /turnstile/v0/siteverify. Edge rules: your token, host name and rules. Terms and privacy policy.

The data above is processed by shieldwave.io, run by ENSOMEDIA in Poland, and for the AI second opinion by an AI provider of shieldwave.io. ShieldWave terms of service and privacy policy.