Locktura Security helps you filter suspicious requests, secure logins, and spot risky file changes from one dashboard. Its local firewall, two-factor authentication, File Scanner, logs, and alerts are included in this free plugin. Enable only the protections your site needs; no account or license is required.

What you can do with Free

Filter suspicious traffic – Use firewall rules, brute-force limits, country rules, and Monitor only mode before blocking.
Protect accounts – Add authenticator-app or passkey 2FA, recovery codes, password policies, account locks, and a custom login URL.
Find risky changes – Scan files and permissions, verify official checksums, monitor file integrity, and review HTTPS and software health.
See and respond – Review local security and user logs, live traffic, email alerts, and File Scanner quarantine or restore.
Harden daily operations – Configure anti-spam, access rules, updates, and email obfuscation.

Included modules

Firewall
Brute Force Defense
Hardening
Update Manager
Access Control
Geo Blocking
Hide Login
Anti-Spam Shield
Usernames & 2FA
Password Manager
Email Alerts
Security Logs
Live Traffic
User Log
File Scanner
File Permissions
SSL Control
Email Encoder

Separate Premium plugin

Locktura Premium is separately distributed outside WordPress.org and is not included in this package. Every Free feature above works without a license.

The separate Premium plugin adds:

Pattern Recognition
Behavior Analytics
Admin Lockdown
Virtual Patching
Header Hardening
API Guardian
Neural Bot Suppressor
Network Reputation Control
Domain Security
Cookie Security Center
Malware Scanner & Cleanup
Smart 404
Extra Hardening Tools
Monthly Reports
Session Management
Extra User Safety Tools
Premium Signature Pack

Buy Locktura Premium

Privacy

Locktura stores security data locally, including IP addresses, request and login details, usernames, events, alert settings, password-policy and 2FA settings, encrypted TOTP secrets, public passkey credential data, hashed recovery codes, enrollment state, scan history, and update history. Passkey private keys remain on the user’s authenticator and are never stored by Locktura. Optional geolocation and password-breach checks use the services below. Administrators control retention, recipients, lookups, and privacy settings.

Unique traffic estimates count each IP address once per calendar day, excluding recognized bots and blocked requests. This local counter stores a keyed hash of the IP address and date, without the raw IP address or a browser cookie. Identifiers change each day and follow the traffic aggregate retention period (up to 90 days). Shared IP addresses count together, and visits served without running WordPress may not be recorded. Daily unique counts are not a deduplicated total across multiple days.

External services

Locktura loads no scripts, styles, fonts, or images from third parties. It makes only the requests documented below when the related feature is enabled or used.

WordPress.org and extension update providers

Used for core, plugin, and theme update checks and downloads through WordPress.org and update endpoints declared by installed extensions. Requests occur during administrator-requested or scheduled checks and can contain the site URL, software versions, locale, and extension metadata. A manual Software Health scan and enabled Trusted Integrity Scanner also request official WordPress.org core and plugin checksums; the Software Health scan can additionally request plugin last-update metadata. These checksum requests contain the installed version, locale, and plugin slug. Scan results, local baselines, integrity findings, and update history are stored locally. Local file contents are never sent to WordPress.org by the integrity scanner.

Documentation: https://developer.wordpress.org/apis/handbook/wordpress-org/update-api/ and https://developer.wordpress.org/cli/commands/plugin/verify-checksums/
Policies: https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/ and https://wordpress.org/about/license/
Privacy: https://wordpress.org/about/privacy/

Have I Been Pwned Pwned Passwords

Used for optional breach checks through https://api.pwnedpasswords.com/range/{first5-sha1}. Only the first five characters of the password’s SHA-1 hash are sent, never the password or complete hash. Results can be cached locally, and stored status is discarded when the credential changes.

Documentation: https://haveibeenpwned.com/API/v3#PwnedPasswords
Terms: https://haveibeenpwned.com/TermsOfUse
Privacy: https://haveibeenpwned.com/Privacy

Geolocation providers

When enabled geolocation needs uncached data and no trusted country header exists, Locktura sends the public IP being looked up. Results can be cached locally for 24 hours. Providers are tried in this order:

Country (https://api.country.is/{ip}) – Primary provider. Service information and privacy: https://country.is/ | Source and self-hosting: https://github.com/lineofflight/country
IPWhois (https://ipwho.is/{ip}) – First fallback. Documentation: https://ipwhois.io/documentation | Terms: https://ipwhois.io/terms | Privacy: https://ipwhois.io/privacy
ipapi.co (https://ipapi.co/{ip}/json/) – Final fallback. Documentation: https://ipapi.co/api/ | Terms: https://ipapi.co/terms/ | Privacy: https://ipapi.co/privacy/

Performance and SEO tool verification

The optional Geo Blocking settings “Allow verified performance and SEO tools” and “Allow verified UptimeRobot monitoring” are independent and off by default. The first downloads the public GTmetrix locations page (https://gtmetrix.com/locations/) and Pingdom probe lists (https://my.pingdom.com/probes/ipv4 and /probes/ipv6). The second downloads UptimeRobot’s combined IPv4/IPv6 list (https://cdn.uptimerobot.com/api/IPv4andIPv6.txt). Only enabled services are contacted, on settings save or when an uncached verification is needed. Lists are cached locally for 12 hours; failed downloads are retried after five minutes and do not grant an exception. Requests send a fixed verification user agent, never visitor IPs, tested URLs, cookies or account credentials. Providers receive the server’s outgoing IP as part of the connection.

PageSpeed Insights requests are checked with reverse and forward DNS against Google-controlled google.com hosts. DNS lookups disclose the candidate IP/hostname to the server’s configured DNS resolver. General Google Cloud tenant hostnames are not trusted. Siteliner uses its four published server IPs, bundled locally. These exceptions only bypass country rules for GET and HEAD; other protections still apply. Independent hosting/CDN rules are not changed and may need separate provider-IP exceptions.

GTmetrix documentation: https://gtmetrix.com/locations/ | Terms: https://gtmetrix.com/terms-of-service.html | Privacy: https://gtmetrix.com/privacy-policy.html
Pingdom documentation: https://documentation.solarwinds.com/en/success_center/pingdom/content/topics/pingdom-probe-servers-ip-addresses.htm | Terms: https://www.solarwinds.com/legal | Privacy: https://www.solarwinds.com/legal/privacy
UptimeRobot documentation: https://uptimerobot.com/help/locations/ | Terms: https://uptimerobot.com/terms/ | Privacy: https://uptimerobot.com/privacy/
Google verification: https://developers.google.com/crawling/docs/crawlers-fetchers/verify-google-requests
Siteliner documentation: https://www.siteliner.com/faqs

Own-site HTTPS and TLS checks

SSL Control checks the configured home_url() or site_url(). An administrator-requested HEAD request or TLS handshake sends ordinary network metadata and a Locktura user-agent to the site’s own host. System Health also sends up to five small daily GET requests: one random missing path, /.env, /wp-config.php.bak, and the homepage use home_url(); debug.log uses content_url(). Requests stay within the configured home/site origins. An external content/CDN URL is not probed and produces an inconclusive check. These requests check public exposure and unexpected external redirects. Response bodies and possible secrets are never stored; only status information is retained. No third-party endpoint is selected by Locktura.

Site-configured email delivery

Enabled alerts and tests can contain the recipient, site URL, event type, timestamp, IP address, relevant context, and remediation links. WordPress uses the site’s configured mail transport; Locktura selects no provider.

Locktura website links

Links to https://locktura.com/ open only after an administrator clicks them; there are no background calls.

Terms: https://locktura.com/terms-and-conditions/
Privacy: https://locktura.com/privacy-policy/

Translations

Dutch translations are managed through translate.wordpress.org and delivered by WordPress when an approved package is available.

Bundled assets

Runtime assets are bundled locally. Flag Icons, QRCode for JavaScript, and lbuchs/WebAuthn use the MIT License; Inter and Bebas Neue use the SIL Open Font License 1.1. The modified Wikimedia Commons world map is public domain. Source and license details are included under assets/ and vendor/lbuchs/. Locktura artwork is GPLv2 or later.