Vardalion Security
Behavioural WordPress security with threat scoring, brute-force protection, bot detection, automatic IP blocking, logging and recovery tools.
Solid choice
Vardalion Security is a solid plugin choice in 2026, with a few things worth checking first. Was last updated 1 week ago, and scores 64/100 on our health check.
- Actively developed — last update 1 week ago
- Tested with the latest WordPress (7.1)
- Small user base (<10 active installs)
- Very few reviews so far
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Vardalion Security stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| Activity Log | >100 |
| Brute Force | >100 |
| firewall | >100 |
| malware | >100 |
| security | >100 |
About Vardalion Security
From the official readme · v2.3.0Description
Vardalion Security is a security plugin for WordPress that monitors suspicious behaviour, assigns threat scores and can automatically block hostile IP addresses.
The free Core plugin includes:
- Request inspection for common exploit and malicious-request patterns.
- Brute-force and authentication protection.
- User-enumeration and REST user-endpoint protection.
- Login request rate limiting.
- Bot and security-scanner detection.
- Threat scoring with configurable automatic IP blocking.
- Repeat-offender escalation and optional permanent blocking.
- Manual IP and CIDR network blocking with lockout-safety checks.
- Subnet intelligence and administrator-reviewed network recommendations.
- Security event logging, filtering and CSV export.
- High-severity email alerts.
- Emergency Mode for recovering from an enforcement configuration problem.
- WordPress core-file checksum verification for protected wp-admin PHP paths.
- Trusted-proxy and Cloudflare-origin handling controls.
Vardalion Security Core is permanently free. It does not expire, require a licence key, or unlock included functionality after payment.
An optional separately distributed Vardalion Security Pro companion plugin can extend Core with additional commercial functionality. Pro code, licensing and update delivery are not included in the WordPress.org Core plugin.
Privacy
Vardalion Security is a security plugin and may process information that can be personal data, including IP addresses and user-agent strings.
Core security data is stored locally in the WordPress database. Administrators control the configured log-retention period and can manually remove blocks.
Vardalion Security Core does not send security logs or visitor telemetry to Vince Web Design.
Vardalion Security also supplies suggested privacy-policy text to WordPress under Settings > Privacy > Policy Guide so site administrators can adapt the disclosure to their own site.
For core-file integrity verification, Vardalion Security periodically requests the official checksum list from WordPress.org using the site’s installed WordPress version and locale. See the external service disclosure in the FAQ above.
Installation
- Upload the
wp-aegisfolder to/wp-content/plugins/, or install Vardalion Security through the WordPress Plugins screen. - Activate Vardalion Security.
- Open Vardalion Security > Security Settings.
- Review the default threat threshold, authentication protection, trusted proxy configuration and alert email.
- If the site is behind a reverse proxy or CDN, configure trusted proxy ranges before relying on forwarded client-IP headers.
- Review Vardalion Security > Security Log and IP Intelligence after the plugin has observed normal site traffic.
Frequently asked questions
Does Vardalion Security Core require a licence or paid account?
No. Vardalion Security Core is permanently free and its included functionality does not expire.
Does Vardalion Security send my security logs to Vince Web Design?
No. Core security logs and blocking data are stored in your WordPress database. Vardalion Security Core does not send those logs to Vince Web Design.
Does Vardalion Security contact any external service?
Vardalion Security retrieves official WordPress core checksums from the WordPress.org checksum API when its core-file integrity cache needs to be refreshed. The request includes the installed WordPress version and locale so the correct official checksum set can be returned. Service: WordPress.org Core Checksums API Service URL: https://api.wordpress.org/core/checksums/1.0/ WordPress.org privacy policy: https://wordpress.org/about/privacy/ The documentation button opens the Vardalion Security documentation website only when an administrator clicks it. Core does not transmit security telemetry…
What information does Vardalion Security store?
Vardalion Security can store security event details such as IP address, request path, HTTP method, user agent, rule identifier, threat points and event context. It also stores active and historical block information needed for enforcement and repeat-offender escalation. Administrators can configure security-log retention. Data should be handled according to the site’s own privacy and retention obligations.
Can Vardalion Security lock me out of wp-admin?
Security software can cause access problems if network or proxy settings are configured incorrectly. Vardalion Security includes Emergency Mode. If wp-admin is inaccessible, an administrator with file access can define WPAEGIS_EMERGENCY_DISABLE as true in wp-config.php to bypass active enforcement while retaining logging.
Does Vardalion Security block whole networks automatically?
Core provides subnet intelligence and recommendations, but network-range blocks require administrator approval. Automatic subnet blocking is not part of Core.
What is Vardalion Security Pro?
Vardalion Security Pro is an optional companion plugin distributed separately by Vince Web Design. It extends Core with commercial modules. Vardalion Security Core remains fully functional without Pro.
Changelog
Vardalion Security 2.2.0 introduces the permanently free Core architecture while preserving existing Core security data and settings.
2.3.0
- Added local anti-spam protection for WordPress comments using honeypot, timing, link and machine-pattern signals.
- Added anti-spam inspection for new untrusted WordPress posts; high-confidence detections are held for review rather than deleted.
- Added configurable comment and post anti-spam thresholds.
- Added an administrator-only Anti-Spam Diagnostics test that creates no content or security events.
- Fixed URL analysis for www-prefixed and bare domains and added a real-world spam regression check.
- Fixed comment scoring so high link volume reaches the default spam threshold and anti-spam detections can use Vardalion email alerts.
- Added an optional Vardalion 403 block screen for detected comment spam.
- Added conservative single-link intelligence and expiring local destination-domain reputation.
- Rebuilt all Vardalion enforcement screens with a unified high-impact visual system and category-specific styling.
- Fixed anti-spam log scoring so detected spam records its actual classification score.
- Vardalion security emails now use the configured WordPress Site Title as the sender display name instead of the generic WordPress name.
2.2.12
- Fixed remaining admin controller/view variable mismatches found during the release audit.
- Restored recent-event data and today’s event count on the Vardalion dashboard.
- Restored subnet data on IP Intelligence.
- Restored today’s event count in the WordPress dashboard widget.
- Retains the Security Log, Blocked IPs, SQL and block-page fixes from 2.2.8–2.2.11.
2.2.11
- Fixed malformed block-response HTML that prevented the Vardalion block-page stylesheet from rendering correctly.
- Restored the responsive viewport and external block-page stylesheet output.
- Retains the Security Log and Blocked IPs fixes from 2.2.8–2.2.10.
2.2.10
- Fixed the Blocked IPs controller/view variable mismatch that caused existing block records to appear empty.
- Retains the Security Log fixes from 2.2.8 and 2.2.9.
2.2.9
- Fixed the Security Log controller/view variable mismatch that caused event rows to appear empty even when matching records existed.
- Keeps the 2.2.8 SQL query correction.
2.2.8
- Fixed Security Log pagination showing a matching event count while returning an empty event table.
- Avoids a second SQL preparation pass over already-prepared security-log filter clauses.
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Vardalion Security alternatives
All Activity Log plugins →
FAQ
Vardalion Security: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 12, 2026
Is Vardalion Security free?
Yes. Vardalion Security is free to download and use from the official WordPress.org plugin directory.
Is Vardalion Security safe to use in 2026?
Vardalion Security is a solid plugin choice in 2026, with a few things worth checking first. Was last updated 1 week ago, and scores 64/100 on our health check.
How many websites use Vardalion Security?
Vardalion Security is active on <10 WordPress websites and has been downloaded 242 times since it launched in September 2026. It was downloaded 205 times in the last 30 days.
Does Vardalion Security work with WordPress 7.1?
Yes. The developer has tested Vardalion Security up to WordPress 7.1.3, the latest release. It requires WordPress 6.4 or newer.
What PHP version does Vardalion Security need?
Vardalion Security requires PHP 8.0 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Vardalion Security last updated?
The latest version, 2.3.0, was released on October 2, 2026 (1 week ago).
Who makes Vardalion Security?
Vardalion Security is developed and maintained by vincewebdesign.
What are the best alternatives to Vardalion Security?
The most popular alternatives to Vardalion Security are WP Activity Log (300K+ installs), Activity Log (200K+ installs) and Stream (70K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
