SMEPlan Security Shield

SMEPlan Security Shield is a free, open-source security plugin built around a practical WordPress operations checklist: it watches the 3 most common attack surfaces (OWASP-class attacks plus WordPress-specific ones, persistence mechanisms, and entry vectors), detects issues with baseline/checksum + signature + thresholded heuristics, and remediates safely (quarantine instead of outright deletion; 1-click rollback).

Key features

• Batched, checkpointed file scanning: prioritizes mu-plugins, drop-ins, the active theme/plugins, and uploads; never loads the whole file tree into RAM at once.
• Safe database scanning: keyset pagination (no OFFSET) over options, posts, postmeta, usermeta, comments, commentmeta and termmeta; only flags a row when it decodes into an actually executable PHP/JS token, skipping image data URIs.
• Configuration checks: .htaccess/.user.ini rules that map media extensions to PHP, auto_prepend_file, file/directory permissions, weak salts/keys, unusual cron entries.
• Baseline/integrity: compares core files against WordPress.org’s official checksums; automatically builds a SHA-256 baseline for every plugin/theme on install/update; 1-click restore of any mismatched core file from a signature-verified WordPress.org package, with the current file quarantined first.
• Quarantine & rollback: moves suspicious files aside (never deletes), with a full transaction log and 1-click rollback.
• Per-component backups: a “last confirmed good” snapshot of each plugin/theme, refreshed on every trusted update, checksum-verified before every restore, with a best-effort local tamper-resistance layer.
• Maintenance mode with a TTL that turns on automatically when remediation touches a hot path or a large batch, and turns itself off once a health-check passes.
• Hardening: login rate-limit/lockout by IP + IP/username (real IP behind a CDN via trusted proxies), disables XML-RPC pingback + caps system.multicall, security headers (HSTS/X-Frame-Options/CSP Report-Only), controlled auto-updates (low-traffic time window, skips VCS-managed sites, health-check after updating).
• Multi-layer scan scheduling: WP-Cron + an internal watchdog + an HMAC-signed REST endpoint (for system cron/remote pings) + a WP-CLI command — the schedule keeps running even when WP-Cron is unreliable.
• Multisite: enumerates every site by blog_id, scanning each site’s own uploads folder and tables.

Two hardening behaviours worth knowing about before you enable them, because they change how the site answers requests that are not this plugin’s own:

• User-enumeration blocking is on by default. For visitors who are not signed in, the core wp/v2/users REST routes stop being served and ?author=<id> links redirect to the home page. This is a deliberate part of the login-hardening layer, but it is a change to an API this plugin does not own — a headless front end, a mobile app or a third-party integration that reads the public user list will see it disappear. Turn it off under Hardening if something depends on it. (rc-47)
• wp smeplan-ss scan run exits 75 when a scan is already running. 75 is EX_TEMPFAIL — “temporary failure, try again” — rather than 0, so a wrapper running under set -e will treat a busy lock as a failed command. Handle 75 explicitly if you schedule the command that way. (rc-49)

Not yet in this release (planned for later versions)

• 2FA (TOTP) and CAPTCHA for the login page.
• Anonymous telemetry (opt-in).
• Translations (every string is already wrapped in __(), ready for translators via translate.wordpress.org — no translation is bundled with the plugin itself).
• Action Scheduler integration for enterprise-grade durable queuing.

Privacy Policy

By default, this plugin does not send any data outside of the site it is installed on. Everything it collects (scan findings, logs, baseline data) stays in the local WordPress database and in a protected local storage folder inside the uploads directory (wp-content/uploads/smeplan-security-shield/, blocked from direct web access).

Two features send data off-site, and both are entirely opt-in — off unless the site admin explicitly sets them up:

• Alert email: if enabled, a summary of new findings is emailed to the site’s configured admin email address (admin_email) using WordPress’s own wp_mail().
• Alert webhook: if the admin enters a Webhook URL in Policies, a summary (site URL, alert subject, malicious/suspicious counts, timestamp — no personal or visitor data) is sent as JSON to that admin-provided URL whenever new findings are detected. Nothing is sent anywhere unless the admin fills in this field themselves.

That storage folder outlives the plugin on purpose: deleting the plugin removes its options, cron events and capabilities, but leaves the folder in place so a quarantined file is never destroyed by an uninstall performed mid-incident. See the FAQ entry “What is removed when I delete the plugin?” for the reasoning and for how to remove it yourself.

The plugin does not phone home to any SMEPlan-operated server, does not track usage/analytics, and does not include any third-party tracking or advertising code.