All In One WP Security & Firewall

Even if the plugin might seem a little daunting for regular, non-technical users, it is actually extremely easy to use.

It was designed by experts in the security domain and comes with lots of simple explanations for every security feature it holds.

Installation:

Unpack and upload it to the /wp-content/plugins/ directory.
Activate the plugin through the 'Plugins' menu in WordPress.

What is new in this release:

• Fixed minor bug - IP addresses blocked due to '404' were not being listed in the display table.
• Updated the Russian language translation file.
• The automatic database table prefix generation value will use a-z characters only.
• Added esc_url sanitization to the add_query_arg/remove_query_arg function instances to prevent possible XSS.

What is new in version 3.9.5:

• Fixed minor bug - IP addresses blocked due to '404' were not being listed in the display table.
• Updated the Russian language translation file.
• The automatic database table prefix generation value will use a-z characters only.
• Added esc_url sanitization to the add_query_arg/remove_query_arg function instances to prevent possible XSS.

What is new in version 3.9.4:

• The sort order and orderby parameters now use a whitelisting approach for sanitization.

What is new in version 3.9.0:

• Added some robustness to the file-scan code.
• Added extra security to all relevant list table instances to prevent unlikely malicious deletion commands.
• Fixed the user agent part of the blacklist settings code to allow user-agents to be cleared upon saving.

What is new in version 3.8.9:

• Fixed a possible open redirect vulnerability related to logout events. Thanks to Sucuri for pointing this out.
• Fixed bug in the new feature which allows permanent blocking of IP addresses that create 404 events.
• Fixed minor bug for all instances where wpdb "prepare" was being used with order/orderby parameters.

What is new in version 3.8.7:

• Added an improvement for login lockdown feature - locked IP addresses will no longer be allowed to register.
• Added a "view" link for each account in the pending registration approval table list.
• Fixed 404 logging/lockout bug.
• Added ability to permanently block IP addresses from the 404 event list for both bulk and single cases.
• Added ability to do bulk temp blocking for IP addresses in 404 list.

What is new in version 3.8.4:

• Updated POT language file.
• Tweaked the function which retrieves the IP address to handle cases where traffic is coming from cloudflare
• The MySQL database will not be forced anymore at the time of creating the table. It also reads the characters set value from the system first.

What is new in version 3.8.2:

• Fixed a CSS issue with the honeypot feature.

What is new in version 3.8.1:

• Minor bug fix for the honeypot feature - loading of CSS style sheet was not occurring when main login page rendered.

What is new in version 3.7.9.2:

• Made a couple of changes in the copy protection feature's JS code.

What is new in version 3.7.9:

• Fixed a small bug related to the cookie test in the Cookie Based Brute Force feature.

What is new in version 3.7.7:

• Improved DB prefix change code to make it more robust.
• Fixed a minor bug for the Rename Login page feature.
• Added check when processing rename login page to see if maintenance (lockout) mode enabled. Plugin will now display lockout message instead of 404 page if site lockout enabled.

What is new in version 3.7.5:

• Added a new DB scan feature. Go to the "Scanner" menu to use this new feature.
• Added new settings import/export feature.
• Modified user accounts feature to alert administrator if one or both "admin" or "Admin" usernames are being used.

What is new in version 3.7.3:

• Added Brazilian language translation.
• Added two new action hooks for plugin activation and deactivation time.
• Improved the get_user_ip_address() function so it handles cases when multiple addresses are returned due to proxy.
• Fixed the mis-alignment of login page which was broken by WP3.9 when rename login feature is used.

What is new in version 3.7.2:

• Added a PHP Info section in the system info interface to show some important PHP details of the server.
• Added a filter to allow the user to have a custom translation in a place (which will be loaded instead of the default one from the plugin).
• Replaced myslqi fetch_all method with fetch_assoc to cover cases where some servers do not have the correct mysql drivers.
• Added a new filter to allow manipulation of the htaccess rules from your custom code. The name of the filter is 'aiowps_htaccess_rules_before_writing'.

What is new in version 3.7.1:

• Fixed a bug with the login page captcha. The captcha wansn't shown if the rename login page feature was enabled at the same time.

What is new in version 3.7:

• Added new dashboard info box to display number of blocked IP addresses in the lockout table.
• Fixed bug where user could not access login page when maintenance mode and rename login page features were both active.
• Tweaked the hotlinking .htaccess directives to cover both http and https.
• Fixed code to prevent mysql errors due to some variables not having default value in failed login and lockdown tables
• Replaced deprecated PHP function mysql_query with mysqli.
• Added language file for Spanish language. The Spanish translation was done by Samuel Montoya.
• Added code to hide the "DB Prefix" menu for the non-main sites in multi-site installation

What is new in version 3.6:

• Added a new feature to prevent image hot-linking. (See the "Prevent Hotlinks" tab in the firewall menu)
• Added a check in the Rename Login Page feature to prevent people from setting the slug to "wp-admin"

What is new in version 3.5:

• Added new feature which will Block Fake Googlebots from crawling your site. Check the Firewall menu for this new feature.
• Added code to prevent users from having both the Rename Login Page and Cookie-Based Brute Force features active at the same time.
• Added some useful info boxes in the dashboard: 1) to inform the user if the cookie based brute force or rename login page features are active, 2) last 5 logins to your site.
• Fixed minor bug with .htaccess backup feature.

What is new in version 3.4:

• Improved the file change detection scan feature: Introduced a button allowing admin to view the file change results from the last scan and fixed small bug whereby the change detected flag was not being cleared for applicable cases.
• Fixed a small bug with "rename login page" feature.
• Made wp-config.php and .htaccess file backups more secure. Thanks to @wzp for the tip.
• Made the login code more robust by catering for cases where the "wp_login" action was not passing 2 parameters.

What is new in version 3.1:

• Added ability to specify a system log file in the "Host System Logs" tab of the "File System Security" menu.
• Fixed a tab link bug. One link was going to the wrong menu tab.
• Updated the POT file of the plugin.

What is new in version 2.9:

• Added new feature which automatically sets the status of newly registered WordPress user accounts to "pending" and allows manual approval by an administrator.
• Improved robustness of file change detection iteration code.

What is new in version 2.8:

• Added a feature to insert a simple math captcha to the WordPress comment form (to reduce comment spam). Check the spam prevention menu for this new feature.
• Fixed a minor bug with bulk unlock/delete in user login menu.
• Fixed a minor bug with math captcha logic.

What is new in version 2.7:

• Added a simple math captcha functionality for the WP login page.

What is new in version 2.6:

• Added a new Login Whitelist feature. This feature enables you to specify one or more IP addresses in a special whitelist which will have access to your WP login page. All other IP addresses trying to access your WP login page which are not in the whitelist will be automatically blocked.
• The IP address will also be included in the email that gets sent to the admin for the ip address lockout notification.
• Language file loading fix for Chinese language.
• Tweaked the code which creates a .htaccess file in the backup directory to ensure it gets run even if the directory already existed.
• Made DB backups more secure.

What is new in version 2.4:

• Added new feature/checkbox which will instantly lockout IP address ranges which attempt to login with an invalid username.
• Fixed a bug in the Comment SPAM IP Monitoring page where trying to block one or more IPs was failing.
• Removed the word "config" from the list of bad query strings check (to add compatibility with a few more plugins)
• Added a notice in the dashboard menu to show you if there are any recent file changes that the plugin detected.
• Fixed bug with php File Editing feature. Code now also handles older style wp-config.php files which have the php end tag "?>"
• Fixed bug with "Disable All Security Features" button functionality. When clicked, this will now also make the appropriate changes to the .htacces and wp-config.php files if necessary.

What is new in version 2.3:

• Fixed "Deny Bad Query Strings" rules to not break the ability to drag components in the WordPress "Appearance->Menus" page
• Fixed an activation time warning (on sites with WP_DEBUG option enabled)
• Re-implemented the wp-config.php file content backup feature. It now directly downloads the contents of the file to your computer.
• Multi-site enhancements: Suppressed access to configuration settings for features which are not allowed to be configured from subsites of multi-site installations.
• Fixed a bug with login lockdown feature.

Requirements:

• WordPress 3.5 or higher