{"id":14,"date":"2026-10-08T14:39:49","date_gmt":"2026-10-08T14:39:49","guid":{"rendered":"https:\/\/themes8.007aj.com\/?page_id=14"},"modified":"2026-10-08T14:39:49","modified_gmt":"2026-10-08T14:39:49","slug":"14-2","status":"publish","type":"page","link":"https:\/\/themes8.007aj.com\/?page_id=14","title":{"rendered":""},"content":{"rendered":"
\n
SPECIAL LIMITED-TIME PRICE<\/div>\n
\n
\n
\n
\"007AJ<\/p>\n
007AJ<\/div>\n<\/div>\n

007AJ Security Scanner & Firewall Suite<\/span><\/h1>\n

Login lockout, request firewall, integrity scan, repair and live traffic<\/p>\n

A standalone WordPress security suite by 007AJ. Switch on login lockout, a request firewall with rule categories, IP allow and block lists, rate limits, scheduled integrity scans against WordPress.org checksums, file change monitoring, repair with quarantine, live traffic and hardening \u2014 every protection stays off until you turn it on.<\/p>\n

Fully licensed version \u2014 use on your own sites<\/div>\n<\/div>\n
\"007AJ<\/div>\n<\/div>\n<\/div>\n
\n
\n
Fully licensed<\/div>\n
use on your own sites<\/div>\n<\/div>\n
\n
Opt-in protections<\/div>\n
off until you switch them on<\/div>\n<\/div>\n
\n
No GeoIP service<\/div>\n
CIDR lists only<\/div>\n<\/div>\n
\n
WordPress 6.3+<\/div>\n
PHP 7.4+<\/div>\n<\/div>\n<\/div>\n
\n

Security status at a glance<\/h2>\n

The dashboard shows which protections are on, today’s lockouts and blocks, locked-out addresses, temporary blocks and a module list.<\/strong><\/p>\n

\"ScreenshotThe dashboard: status cards, locked-out addresses, temporary blocks and modules. Demo install with sample data. (Clear-lockout controls are on this screen in the live plugin.)<\/p>\n<\/div>\n

\n

Protections you switch on<\/h2>\n

A full suite that does not need the free sibling plugin. If both are active, the free plugin pauses itself.<\/p>\n

\n
\n
<\/div>\n

Login lockout and login rate limit<\/h3>\n

After a number of failed logins (form, XML-RPC and application passwords) an IP is locked for a time you choose. Optional email alert. Locked addresses appear on the Dashboard so you can clear a lockout. A separate login rate limit returns HTTP 429 on wp-login.php.<\/p>\n<\/div>\n

\n
<\/div>\n

Request firewall with rule categories<\/h3>\n

Switch categories on or off: SQL injection, script injection (XSS), path traversal and file inclusion, code and command injection, sensitive file probes (.env, .git, dumps, backup archives, wp-config backups, known web shell names) and attack-tool user agents. Administrators and editors are not checked by the pattern rules.<\/p>\n<\/div>\n

\n
<\/div>\n

Custom skip and block paths<\/h3>\n

Paths that skip the pattern rules (for webhooks that legitimately receive code) and paths that are always blocked. Patterns that would cover wp-login.php or wp-admin are refused so you do not lock yourself out.<\/p>\n<\/div>\n

\n
<\/div>\n

XML-RPC switch<\/h3>\n

Refuse all xmlrpc.php requests and turn off pingbacks when you switch this on.<\/p>\n<\/div>\n

\n
<\/div>\n

IP allow and block lists<\/h3>\n

IPv4 and IPv6 addresses and CIDR ranges. Allowlisted addresses skip the firewall, rate limits, temporary blocks and login lockout. Block-listed addresses get 403 on every page. Your own current address cannot be added to the block list. Country blocking is not included \u2014 this plugin ships no GeoIP database and calls no outside GeoIP service.<\/p>\n<\/div>\n

\n
<\/div>\n

Rate limits and temporary blocks<\/h3>\n

Limits per IP for all requests, REST requests and \u201cnot found\u201d floods. An address that hits the 404 limit is blocked temporarily on the whole site. Temporary blocks are listed on the Dashboard so you can release them.<\/p>\n<\/div>\n

\n
<\/div>\n

Integrity scan vs WordPress.org checksums<\/h3>\n

Compares WordPress core with the official checksums and finds unknown files in wp-admin, wp-includes and the site root. Optionally compares plugins from WordPress.org. Custom and commercial plugins have no published checksums and are listed as not checked. Themes cannot be checked \u2014 WordPress.org publishes no theme checksums.<\/p>\n<\/div>\n

\n
<\/div>\n

Repair with quarantine undo<\/h3>\n

Repair restores a modified or missing core or WordPress.org plugin file from WordPress.org. The download is written only if it matches the official checksum, and the current copy is saved in quarantine first so every repair can be undone. Quarantine moves an unknown file into a protected uploads folder under a name the web server will not run.<\/p>\n<\/div>\n

\n
<\/div>\n

Scheduled scans and email digest<\/h3>\n

Run the integrity scan daily or weekly with WP-Cron and email a plain-text summary: only when something needs review, after every run, or never. Quiet sites may need a real system cron that hits wp-cron.php.<\/p>\n<\/div>\n

\n
<\/div>\n

File change monitoring<\/h3>\n

Keeps a baseline of core, plugin and theme files (size, mtime, MD5) and reports files added, modified or removed. When WordPress, a plugin or a theme reports a new version, changes inside it are accepted automatically. \u201cAccept all changes\u201d sets a new baseline. Uploads are not monitored.<\/p>\n<\/div>\n

\n
<\/div>\n

Live traffic<\/h3>\n

A short record of recent requests handled by WordPress: time, IP (optionally shortened), method, path without query string, status, user ID, the protection that blocked it and the user agent. Only the newest 1,000 requests from the last 7 days are kept. Block an address with one click.<\/p>\n<\/div>\n

\n
<\/div>\n

Hardening and activity log<\/h3>\n

Turn off the file editor, limit username discovery, hide the version tag and turn off application passwords. The activity log keeps logins, failed logins, lockouts, blocks, scans, repairs, quarantine actions and setting changes (newest 500 entries).<\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n

Firewall and login settings<\/h2>\n

Rule categories, custom paths, XML-RPC and login lockout \u2014 each on its own Settings tab.<\/p>\n

\"ScreenshotFirewall settings: rule categories and custom skip paths. Demo install with sample data.<\/p>\n<\/div>\n

\n

IP allow and block lists<\/h2>\n

IPv4, IPv6 and CIDR. Country blocking is not included \u2014 no GeoIP database and no outside GeoIP lookup.<\/p>\n

\"ScreenshotIP rules: allow list and block list with sample documentation addresses. Demo install with sample data.<\/p>\n<\/div>\n

\n

Integrity scan results<\/h2>\n

Core files compared with WordPress.org checksums. Optional plugin checks. Themes and custom plugins are listed as not checked.<\/p>\n

\"ScreenshotIntegrity scan results for WordPress core and plugins from WordPress.org. Demo install with sample data.<\/p>\n<\/div>\n

\n

File change monitoring<\/h2>\n

Baseline of core, plugins and themes. Unexpected adds and edits are listed; updates are accepted automatically.<\/p>\n

\"ScreenshotFile changes: added and modified files since the baseline. Demo install with sample data.<\/p>\n<\/div>\n

\n

Live traffic<\/h2>\n

Newest 1,000 requests from the last 7 days, with the protection that blocked them when a request was stopped.<\/p>\n

\"ScreenshotLive traffic: recent requests, status codes and blocking rules. Demo install with sample data.<\/p>\n<\/div>\n

\n

Activity log and hardening<\/h2>\n

Security events in one place, plus optional hardening switches for the file editor, username discovery, version tag and application passwords.<\/p>\n

\"ScreenshotActivity log of lockouts, blocks, scans and setting changes. Demo install with sample data.<\/p>\n

<\/div>\n

\"ScreenshotHardening: file editor, username discovery, version tag and application passwords. Demo install with sample data.<\/p>\n<\/div>\n

\n

Plus the details that keep you in control<\/h2>\n

Opt-in design, local processing and clear limits.<\/span><\/p>\n

\n
\n
<\/div>\n

Opt-in by design<\/span><\/h3>\n

Every protection starts off. Open Settings and switch on only what you need, one tab at a time.<\/span><\/p>\n<\/div>\n

\n
<\/div>\n

Runs on your server<\/span><\/h3>\n

Everything runs on your server. The plugin sends no data to 007AJ. Firewall rules change only through plugin releases.<\/span><\/p>\n<\/div>\n

\n
<\/div>\n

Honest about REMOTE_ADDR<\/span><\/h3>\n

IP addresses are read from REMOTE_ADDR only. Forwarded headers are not trusted. Behind a proxy or CDN that does not restore the visitor address, check the address shown on Settings before turning on lockouts or blocks.<\/span><\/p>\n<\/div>\n

\n
<\/div>\n

Privacy tools included<\/span><\/h3>\n

Suggested privacy policy text, plus a personal data exporter and eraser for activity log and live traffic of logged-in users.<\/span><\/p>\n<\/div>\n<\/div>\n

<\/div>\n
\"Illustration<\/span>Illustration, not a screenshot.<\/h5>\n<\/div>\n
\n

How it works<\/h2>\n

From install to a protection set you chose.<\/p>\n

\n
\n
1<\/div>\n
\n

Install and open Settings<\/h3>\n

Upload the suite plugin and switch it on. It is standalone \u2014 you do not need the free sibling. Open 007AJ Security > Settings.<\/p>\n<\/div>\n<\/div>\n

\n
2<\/div>\n
\n

Switch on what you need<\/h3>\n

Turn on login lockout, the firewall, rate limits, IP lists, scans, live traffic and hardening one tab at a time.<\/p>\n<\/div>\n<\/div>\n

\n
3<\/div>\n
\n

Run a scan and watch traffic<\/h3>\n

Run an integrity scan, optionally schedule daily or weekly digests, and review live traffic and the activity log.<\/p>\n<\/div>\n<\/div>\n

\n
4<\/div>\n
\n

Repair or quarantine when needed<\/h3>\n

Repair official files from WordPress.org with a quarantine backup, or quarantine unknown files you do not recognise.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

Made for real WordPress sites<\/h2>\n

Use it wherever you want opt-in, on-server protections without a GeoIP dependency.<\/p>\n

Agency client sites, Business and brochure sites, Online shops, Membership sites, Documentation sites, Staging and production, Local business sites, Blogs and magazines<\/div>\n<\/div>\n
\n
\n
<\/div>\n
\n

Fully licensed version<\/h2>\n

Fully licensed version \u2014 use on your own sites.<\/strong> You get the complete plugin, with every feature described on this page.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n

Requirements<\/h2>\n
<\/div>\n
    \n
  • WordPress 6.3 or newer (shown working on a current WordPress 7.1 install)<\/li>\n
  • PHP 7.4 or newer<\/li>\n
  • A single WordPress site (the suite is built for standard installs)<\/li>\n
  • Integrity scan and repair contact WordPress.org only (checksums and official file downloads) \u2014 nothing is sent to 007AJ<\/li>\n
  • No GeoIP database and no outside GeoIP or malware-signature cloud service<\/li>\n
  • If DISABLE_WP_CRON is true, configure a real system cron that requests wp-cron.php for scheduled scans<\/li>\n<\/ul>\n<\/div>\n
    \n

    Frequently asked questions<\/h2>\n
    <\/div>\n
    What licence do I get?<\/p>\n

    Each purchase is a fully licensed copy of the plugin for use on your own sites.<\/p>\n

    Do I need the free 007AJ Security plugin too?<\/p>\n

    No. This suite is standalone and includes everything the free plugin does. If both are active, the free plugin pauses itself.<\/p>\n

    Are protections on by default?<\/p>\n

    No. Every protection stays off until you switch it on under Settings.<\/p>\n

    Can I lock myself out?<\/p>\n

    The plugin tries to prevent it: your current IP cannot be added to the block list, custom block paths cannot cover wp-login.php or wp-admin, and administrators are exempt from the pattern rules and most rate limits. If you still get locked out, rename the plugin folder over FTP or your host\u2019s file manager.<\/p>\n

    Does repair change files without asking?<\/p>\n

    No. Scans only read files. Repair and quarantine run only when you click their buttons, and each one keeps a copy you can restore.<\/p>\n

    Does the plugin include country blocking?<\/p>\n

    No. Country blocking would need a GeoIP database or an outside lookup service. This plugin uses neither. Use CIDR ranges or your host\u2019s or CDN\u2019s country rules instead.<\/p>\n

    Does it scan for malware signatures in the cloud?<\/p>\n

    No. Integrity checks compare files with WordPress.org checksums. There is no outside malware-signature service and no cloud scanning beyond WordPress.org checksum and repair downloads.<\/p>\n

    What does the integrity scan cover?<\/p>\n

    WordPress core, and optionally plugins from WordPress.org. Themes and custom or commercial plugins have no published checksums and are listed as not checked.<\/p>\n

    How do I clear a login lockout or temporary block?<\/p>\n

    Locked-out addresses and temporary blocks are listed on the Dashboard. Use the clear-lockout control for a locked IP, or release a temporary block from the same screen.<\/p>\n

    Does the plugin contact other sites?<\/p>\n

    Only WordPress.org, and only for integrity scans and repairs. It sends no visitor data and nothing to 007AJ.<\/p>\n

    Can I remove all data when I delete the plugin?<\/p>\n

    Yes. A setting under Log and data lets you delete settings, logs, traffic, the file baseline and the quarantine folder when the plugin is deleted. It is off by default.<\/p>\n

    Is it translation-ready?<\/p>\n

    Yes. Text is prepared for translation and a languages folder is included.<\/p>\n<\/div>\n<\/div>\n

    \n

    Security you switch on when you are ready<\/span><\/h2>\n

    Login lockout, a request firewall, IP lists, rate limits, integrity scan with repair, file monitoring and live traffic \u2014 fully licensed version for your own sites.<\/span><\/p>\n

    007AJ<\/p>\n<\/div>\n

    007AJ Security Scanner & Firewall Suite by 007AJ. Screenshots are from a demo install with sample data; the graphic labelled \u201cIllustration\u201d is not a screenshot. WordPress is a trademark of the WordPress Foundation; this plugin is not affiliated with it.<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    SPECIAL LIMITED-TIME PRICE 007AJ 007AJ Security Scanner & Firewall Suite Login lockout, request firewall, integrity scan, repair and live traffic A standalone WordPress security suite by 007AJ. Switch on login lockout, a request firewall with rule categories, IP allow and block lists, rate limits, scheduled integrity scans against WordPress.org checksums, file change monitoring, repair with […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-14","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/themes8.007aj.com\/index.php?rest_route=\/wp\/v2\/pages\/14","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/themes8.007aj.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/themes8.007aj.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/themes8.007aj.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/themes8.007aj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14"}],"version-history":[{"count":2,"href":"https:\/\/themes8.007aj.com\/index.php?rest_route=\/wp\/v2\/pages\/14\/revisions"}],"predecessor-version":[{"id":16,"href":"https:\/\/themes8.007aj.com\/index.php?rest_route=\/wp\/v2\/pages\/14\/revisions\/16"}],"wp:attachment":[{"href":"https:\/\/themes8.007aj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}