Recommended update: Enhances malware scanner accuracy, eliminates false alarms on safe vendor libraries, displays detected file paths and line numbers, and updates PHP EOL vulnerability checks.<\/p>","1.0.10":"
Major security hardening release. Adds Ghost Admin Protection, WAF encoded payload decoding, Wp2shell zero-day blocking, SSL MITM fix, and Open Redirect protection. Strongly recommended for all users.<\/strong><\/p>","1.0.3":" This update adds automated HTML security alert emails and important stability improvements. Update recommended for all users.<\/p>","1.0.1":" First stable release. Install now to protect your WordPress website with enterprise-level security \u2014 completely free.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3601451,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3601451,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3601451,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3601451,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3601451,"resolution":"1","location":"assets","locale":"","width":1732,"height":885},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3601451,"resolution":"2","location":"assets","locale":"","width":1729,"height":892},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3602207,"resolution":"3","location":"assets","locale":"","width":1722,"height":892},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3602207,"resolution":"4","location":"assets","locale":"","width":1718,"height":888},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3602207,"resolution":"5","location":"assets","locale":"","width":1718,"height":886},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3601451,"resolution":"6","location":"assets","locale":"","width":1715,"height":894},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3601451,"resolution":"7","location":"assets","locale":"","width":1715,"height":891}},"screenshots":{"1":"Security Dashboard<\/strong> \u2014 Your complete security overview at a glance: real-time security score, total issues detected, files scanned, and high-risk threats in a clean, modern interface.","2":"Malware Scanner<\/strong> \u2014 Deep heuristic scanner detecting suspicious files across your entire WordPress installation with severity ratings and one-click removal.","3":"Security Hardening<\/strong> \u2014 One-click hardening options to lock down your WordPress site in seconds against common attack vectors.","4":"Two-Factor Authentication<\/strong> \u2014 Full-screen QR code setup for Google Authenticator, Authy, and any TOTP-compatible app.","5":"Login Protection<\/strong> \u2014 Brute-force protection settings with configurable lockout rules, IP whitelisting, and real-time blocked IP table.","6":"Security Alert Email<\/strong> \u2014 Branded HTML security alert email sent automatically when threats are detected, with a direct link to the admin dashboard."}},"plugin_section":[262246],"plugin_tags":[1174,235296,55021,600,1909],"plugin_category":[54],"plugin_contributors":[78154,270827],"plugin_business_model":[],"class_list":["post-330348","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-firewall","plugin_tags-malware-removal","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor-authentication","plugin_category-security-and-spam-protection","plugin_contributors-freemius","plugin_contributors-nexurasecurity","plugin_committers-nexurasecurity","plugin_committers-prokashsarker2026"],"banners":{"banner":"https:\/\/ps.w.org\/nexura-security\/assets\/banner-772x250.png?rev=3601451","banner_2x":"https:\/\/ps.w.org\/nexura-security\/assets\/banner-1544x500.png?rev=3601451","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/nexura-security\/assets\/icon-128x128.png?rev=3601451","icon_2x":"https:\/\/ps.w.org\/nexura-security\/assets\/icon-256x256.png?rev=3601451","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/nexura-security\/assets\/screenshot-1.png?rev=3601451","caption":"Security Dashboard<\/strong> \u2014 Your complete security overview at a glance: real-time security score, total issues detected, files scanned, and high-risk threats in a clean, modern interface."},{"src":"https:\/\/ps.w.org\/nexura-security\/assets\/screenshot-2.png?rev=3601451","caption":"Malware Scanner<\/strong> \u2014 Deep heuristic scanner detecting suspicious files across your entire WordPress installation with severity ratings and one-click removal."},{"src":"https:\/\/ps.w.org\/nexura-security\/assets\/screenshot-3.png?rev=3602207","caption":"Security Hardening<\/strong> \u2014 One-click hardening options to lock down your WordPress site in seconds against common attack vectors."},{"src":"https:\/\/ps.w.org\/nexura-security\/assets\/screenshot-4.png?rev=3602207","caption":"Two-Factor Authentication<\/strong> \u2014 Full-screen QR code setup for Google Authenticator, Authy, and any TOTP-compatible app."},{"src":"https:\/\/ps.w.org\/nexura-security\/assets\/screenshot-5.png?rev=3602207","caption":"Login Protection<\/strong> \u2014 Brute-force protection settings with configurable lockout rules, IP whitelisting, and real-time blocked IP table."},{"src":"https:\/\/ps.w.org\/nexura-security\/assets\/screenshot-6.png?rev=3601451","caption":"Security Alert Email<\/strong> \u2014 Branded HTML security alert email sent automatically when threats are detected, with a direct link to the admin dashboard."},{"src":"https:\/\/ps.w.org\/nexura-security\/assets\/screenshot-7.png?rev=3601451","caption":""}],"raw_content":"\n Nexura Security<\/strong> is the ultimate, all-in-one free WordPress security plugin engineered to protect your website from malware, hackers, brute-force attacks, and recurring infections \u2014 100% free, forever<\/strong>.<\/p>\n\n Whether you run an eCommerce WooCommerce store, business site, blog, or agency network, Nexura Security delivers enterprise-grade cyber defense with zero performance bloat, no database clutter, and no paywalls on essential security features.<\/p>\n\n Most WordPress security plugins slow down your server, fill your database with millions of log rows, and lock their best features behind expensive subscriptions. Nexura Security is built differently:<\/strong><\/p>\n\n Every website deserves enterprise-grade protection. Here is what you get in the free version of Nexura Security:<\/p>\n\n \ud83d\udee1\ufe0f Reinfection Guard & Root Cause Analyzer (NEW)<\/strong>\nTired of cleaning malware only for it to return hours or days later?<\/em> Nexura's revolutionary Reinfection Guard scans all persistence vectors used by sophisticated hackers to automatically regenerate malware:\n* Hidden MU-Plugins:<\/strong> Uncovers hidden Must-Use scripts planted to reinstall backdoors.\n* Rogue Drop-ins:<\/strong> Inspects \ud83d\udd0d Deep WordPress Malware Scanner & Cleaner<\/strong>\n* Scans all core files, plugins, themes, and uploads for backdoors, web shells (WSO, B374k), trojans, eval-base64 obfuscation, phishing scripts, and spam injectors (Balada Injector, Sign1, ClearFake, WP-VCD).\n* Displays severity ratings (Critical, High, Medium, Low) with exact file locations and single-click cleanup.\n* Lightweight micro-batch scanner prevents PHP timeouts and server crashes on shared hosting.<\/p>\n\n \ud83d\udd25 Web Application Firewall (WAF)<\/strong>\n* Intercepts and blocks OWASP Top 10 web vulnerabilities before WordPress boots, including SQL Injection (SQLi), Cross-Site Scripting (XSS), Remote File Inclusion (RFI), and Local File Inclusion (LFI).\n* Loads via \ud83d\udd10 Two-Factor Authentication (2FA) & Login Security<\/strong>\n* Protect your administrator and user accounts with standard RFC 6238 TOTP Two-Factor Authentication.\n* Works seamlessly with Google Authenticator, Microsoft Authenticator, Authy, 1Password, and any TOTP app.\n* Includes a full-screen QR code onboarding wizard and emergency backup recovery codes.<\/p>\n\n \ud83d\udd17 Passwordless Magic Link Login<\/strong>\n* Log in securely with a one-time, time-limited magic link sent directly to your verified email address.\n* Eliminates the risk of password theft, keystroke loggers, and credential stuffing attacks entirely.<\/p>\n\n \ud83d\udeab Brute-Force Attack Protection & IP Lockout<\/strong>\n* Stops automated botnets and password-guessing attacks with intelligent IP lockout.\n* Customizable failed login thresholds, lockout durations, and IP whitelisting\/blacklisting.\n* Real-time blocked IP table with geolocation country flags.<\/p>\n\n \ud83d\udd11 Pwned Password Checker (HaveIBeenPwned Integration)<\/strong>\n* Checks user passwords against billions of leaked credentials using the secure mathematical k-Anonymity model.\n* Your real password is never transmitted across the internet. Alerts users instantly if their password is compromised.<\/p>\n\n \ud83d\udcc2 WordPress Core File Integrity Monitor<\/strong>\n* Continuously verifies your WordPress core files against official, clean checksums from WordPress.org.\n* Instantly alerts you if critical files like \ud83d\udcc1 Root Directory File Integrity Checker<\/strong>\n* Detects unfamiliar and rogue PHP files dropped into your WordPress root directory \u2014 the primary location hackers use to plant web shells and stealth scripts.<\/p>\n\n \ud83e\udd16 Anti-Spam CAPTCHA & Bot Defense<\/strong>\n* Block automated spam bots on login pages, user registration, lost password, and comment forms.\n* Native integration with privacy-first Cloudflare Turnstile<\/strong> and Google reCAPTCHA v2\/v3<\/strong>.<\/p>\n\n \ud83d\ude91 Fatal Error Auto-Heal (White Screen of Death Protection)<\/strong>\n* Uses WordPress drop-in technology ( \ud83d\uddc4\ufe0f Database Security Scanner & One-Click Backup<\/strong>\n* Scans database tables ( \ud83d\udcca Real-Time File Upload Scanner<\/strong>\n* Automatically checks all media uploads, plugins, and theme ZIP files for malicious code before they are saved to your server.<\/p>\n\n \ud83d\udd0d Google Safe Browsing & Blacklist Monitor<\/strong>\n* Check if your website has been flagged by Google as \"Deceptive site ahead\" or \"Site contains harmful programs\".\n* Monitor your domain reputation directly from your WordPress dashboard.<\/p>\n\n \ud83d\udee0\ufe0f One-Click Security Hardening<\/strong>\n* Apply WordPress hardening standards instantly:\n * Disable the built-in WordPress theme\/plugin file editor.\n * Block PHP execution in the \u26a0\ufe0f Automated Security Alert Emails<\/strong>\n* Receive beautifully formatted HTML security alerts when malware or unauthorized file changes are detected.\n* Built-in Anti-Email-Storm protection and hourly rate limiting prevents inbox spam during bot attacks.<\/p>\n\n\n\n Nexura Security Pro<\/strong> extends the free version with powerful automation, advanced scanning, and robust protection:<\/p>\n\n Upgrade to Nexura Security Pro \u2192<\/a><\/p>\n\n\n\n To provide comprehensive security, Nexura Security connects to several trusted third-party services. All connections are opt-in \u2014 nothing is sent automatically without your explicit action.<\/strong> Here is a complete and transparent list:<\/p>\n\n 1. Cloudflare Turnstile<\/strong>\nUsed for:<\/em> Privacy-friendly CAPTCHA on login, registration, and comment forms to stop spam bots.\nData sent:<\/em> Browser fingerprint and interaction data (processed by Cloudflare, never stored by us).\nWhen:<\/em> Only when you enable Turnstile in the Anti-Spam settings.\nLinks:<\/em> Cloudflare Privacy Policy<\/a> | Cloudflare Terms<\/a><\/p>\n\n 2. Google reCAPTCHA<\/strong>\nUsed for:<\/em> Alternative CAPTCHA option for login and registration pages.\nData sent:<\/em> Browser data and interaction signals (processed by Google).\nWhen:<\/em> Only when you enable Google reCAPTCHA in the Anti-Spam settings.\nLinks:<\/em> Google Privacy Policy<\/a> | Google Terms<\/a><\/p>\n\n 3. HaveIBeenPwned API (Pwned Passwords)<\/strong>\nUsed for:<\/em> Checking whether a user's password has appeared in known data breaches.\nData sent:<\/em> Only the first 5 characters of a SHA-1 hash of the password (k-Anonymity model). Your actual password is NEVER sent.\nWhen:<\/em> Only when a user sets or changes their password and the feature is enabled.\nLinks:<\/em> HaveIBeenPwned Privacy Policy<\/a> | API Terms<\/a><\/p>\n\n 4. Google Safe Browsing API<\/strong>\nUsed for:<\/em> Checking whether your website has been flagged by Google as containing malware or phishing.\nData sent:<\/em> Your website's URL.\nWhen:<\/em> Only when you manually trigger a Safe Browsing check from the dashboard.\nLinks:<\/em> Google Privacy Policy<\/a> | Safe Browsing Terms<\/a><\/p>\n\n 5. VirusTotal API<\/strong>\nUsed for:<\/em> Scanning file hashes against 70+ antivirus engines to detect malware.\nData sent:<\/em> Only the SHA-256 cryptographic hash of the file. The actual file is NEVER uploaded.\nWhen:<\/em> Only during a manual malware scan when unknown files are detected and the feature is enabled.\nLinks:<\/em> VirusTotal Privacy Policy<\/a> | VirusTotal Terms<\/a><\/p>\n\n 6. Nexura Threat Intel Cloud<\/strong>\nUsed for:<\/em> Syncing the latest WAF rules, malicious IP blocklists, and malware detection signatures.\nData sent:<\/em> Blocked attacker IP addresses and blocked payload patterns (anonymized). No personal user data is ever collected.\nWhen:<\/em> Only when Global Threat Intelligence is enabled in settings.\nLinks:<\/em> Nexura Privacy Policy<\/a> | Nexura Terms<\/a><\/p>\n\n 7. WordPress.org API<\/strong>\nUsed for:<\/em> Downloading official WordPress core file checksums for integrity scanning and official WordPress ZIP files for the Core Auto-Restore feature.\nData sent:<\/em> Your WordPress version number.\nWhen:<\/em> During core file integrity checks or when Core Auto-Restore is triggered.\nLinks:<\/em> WordPress Privacy Policy<\/a><\/p>\n\n 8. FlagCDN (flagpedia.net)<\/strong>\nUsed for:<\/em> Displaying country flags next to IP addresses in the Blocked IPs table.\nData sent:<\/em> Country code (derived from IP). No personal data is sent.\nWhen:<\/em> Only when viewing the Blocked IPs admin page.\nLinks:<\/em> FlagCDN Privacy Policy<\/a> | FlagCDN Terms<\/a><\/p>\n\n 9. Nexura GeoIP Service<\/strong>\nUsed for:<\/em> Identifying the country of origin for blocked attacker IP addresses, and (in Pro) displaying real-time visitor locations on the live traffic dashboard.\nData sent:<\/em> IP addresses (attacker IPs in the Free version; visitor IPs in the Pro version only if the Live Traffic GeoIP feature is explicitly enabled).\nWhen:<\/em> When viewing the Blocked IPs page or the Active Visitor Dashboard.\nRetention:<\/em> IPs are processed in memory at the edge and instantly discarded. Zero data retention. No tracking or profiling occurs.\nLinks:<\/em> Nexura Privacy Policy<\/a><\/p>\n\n 10. External AI Services (Pro Only)<\/strong>\nUsed for:<\/em> Analyzing potentially malicious files and auto-generating cleaned code via AI (OpenAI, Anthropic, Google Gemini, or Cloudflare AI).\nData sent:<\/em> When AI analysis is enabled, selected\/redacted file content and site URL may be sent to the selected AI provider.\nWhen:<\/em> Only when you explicitly configure an AI provider and click \"Fix with AI\" during a malware scan.\nRetention:<\/em> Depends on your chosen AI provider and your API key configuration (enterprise API endpoints typically do not train on user data).\nLinks:<\/em> OpenAI Privacy<\/a> | Anthropic Privacy<\/a> | Google Privacy<\/a> | Cloudflare Privacy<\/a><\/p>\n\n\n\n What We Collect:<\/strong>\nNexura Security does NOT collect any personal data from your website visitors. We do not track users, sell data, or place tracking cookies.<\/p>\n\n What We May Report:<\/strong>\nWhen the WAF blocks a malicious attack, the attacker's IP and the blocked payload pattern may be anonymously reported to the Nexura Threat Intel Cloud to help protect other WordPress sites. You can disable this at any time<\/strong> in Settings \u2192 Global Threat Intelligence.<\/p>\n\n Your Data, Your Control:<\/strong>\nAll scan results, logs, and settings are stored locally in your own WordPress database. Nothing is sent to any external server unless you explicitly enable a cloud feature.<\/p>\n\n Privacy Standards:<\/strong>\nWe are committed to respecting user privacy and designing our features with data protection in mind.<\/p>\n\n Full Policy:<\/strong> Privacy Policy<\/a> | Terms & Conditions<\/a><\/p>\n\n\n\n\u26a1 Why Nexura Security is the #1 Free Alternative to Wordfence & Sucuri<\/h4>\n\n
\n
\ud83d\udee1\ufe0f 100% Free Features (Everything Included at Zero Cost)<\/h3>\n\n
advanced-cache.php<\/code>, db.php<\/code>, and object-cache.php<\/code> for malicious hijackers.\n* Uploads Directory PHP Execution:<\/strong> Detects and flags unauthorized executable PHP scripts hidden inside media folders.\n* Malicious WP-Cron Persistence:<\/strong> Dynamically inspects scheduled cron tasks and callbacks to identify hidden persistence triggers.\n* Database Options Injections:<\/strong> Scans wp_options<\/code> for base64 payloads, rogue admin creation scripts, and cron injection strings.\n* Configuration File Tampering:<\/strong> Audits .htaccess<\/code>, .user.ini<\/code>, and wp-config.php<\/code> for unauthorized directives, auto-prepend injections, or malicious redirects.\n* Interactive Attack Vector Graph:<\/strong> Visualizes how malware connects across your filesystem and database so you can eliminate it at the root.<\/p>\n\nauto_prepend_file<\/code> for early-stage protection before malicious requests can touch your database.\n* Features automatic attack signature updates to protect against zero-day exploits.<\/p>\n\nwp-login.php<\/code>, wp-config.php<\/code>, or index.php<\/code> have been tampered with or modified by attackers.<\/p>\n\nwp-content\/fatal-error-handler.php<\/code>) to catch fatal PHP errors before your site goes down.\n* Automatically detects crashing plugins or themes, safely isolates them, and prevents the dreaded \"White Screen of Death\" (WSOD).<\/p>\n\nwp_options<\/code>, wp_users<\/code>, wp_posts<\/code>) for rogue admin users, SEO spam keywords, and malicious scripts.\n* Includes a built-in one-click database backup tool so you can create a safe restore point before cleaning malware.<\/p>\n\n\/wp-content\/uploads\/<\/code> directory.\n * Disable open directory browsing.\n * Block XML-RPC pingback and brute-force vectors.\n * Block REST API username enumeration (\/wp-json\/wp\/v2\/users<\/code>).<\/p>\n\n\ud83c\udf1f Pro Features \u2014 Advanced Protection & Automation<\/h3>\n\n
\n
token_get_all()<\/code> AST engine to detect zero-day backdoors and polymorphic malware that regex-based scanners miss entirely.<\/li>\nwp-login.php<\/code> and wp-admin<\/code> to a secret URL, which helps reduce automated brute-force traffic before they even reach your login page.<\/li>\n\/wp-json\/wp\/v2\/users<\/code>.<\/li>\n[nexura_visitors]<\/code>, [nexura_stats]<\/code>, [nexura_live]<\/code>, [nexura_popular]<\/code>, [nexura_page_views]<\/code>) to display live security and visitor stats anywhere on your site.<\/li>\n\ud83d\udd17 Third-Party Services & External API Connections<\/h4>\n\n
\ud83d\udcdc Privacy Policy<\/h4>\n\n
Changelog (Full)<\/h3>\n\n