Title: SRWorks ArmorPro Author: SRWorks LLC Published: March 5, 2026 Last modified: August 28, 2026 --- Search plugins ![](https://ps.w.org/srworks-armorlite/assets/banner-772x250.png?rev=3475861) ![](https://ps.w.org/srworks-armorlite/assets/icon.svg?rev=3475861) # SRWorks ArmorPro By [SRWorks LLC](https://profiles.wordpress.org/srworks/) [Download](https://downloads.wordpress.org/plugin/srworks-armorlite.1.0.33.zip) * [Details](https://mri.wordpress.org/plugins/srworks-armorlite/#description) * [Reviews](https://mri.wordpress.org/plugins/srworks-armorlite/#reviews) * [Installation](https://mri.wordpress.org/plugins/srworks-armorlite/#installation) * [Development](https://mri.wordpress.org/plugins/srworks-armorlite/#developers) [Support](https://wordpress.org/support/plugin/srworks-armorlite/) ## Description **ArmorPro** protects WordPress with a full security stack that runs before your site does. Every feature is free and unlimited. There is no premium tier, no locked panels, and no upgrade prompts. Attacks get blocked at the PHP engine level, roughly a millisecond into the request, before WordPress loads a single file. #### Features * **WAF Engine** — Runs before WordPress loads via PHP’s auto_prepend_file, adding roughly 1ms of overhead. Blocks malicious requests at the PHP engine level before any WordPress code executes. Detects and configures Apache, NGINX, and LiteSpeed automatically, and falls back to the standard firewall when enhanced mode is unavailable. Enable it from the Firewall tab with one click. * **Firewall** — 600+ built-in patterns covering SQL injection, XSS, path traversal, and shell access, matched across five categories (Request URI, Query String, User Agent, Referrer, IP Address) in three modes: contains, ends-with, and path- only. Pattern manager with per-pattern toggles, hit counts, and your own custom patterns. Pure PHP, so it works on any server without .htaccess. * **Brute Force Protection** — Session-based login tracking with automatic lockouts after a configurable number of failures. Repeat offenders can be auto-blacklisted with an optional expiry. Login activity log records IP, country, status, and the usernames tried. * **Two-Factor Authentication** — TOTP for Google Authenticator, Authy, 1Password, and any compatible app. QR code setup, ten backup recovery codes, and role-based enforcement with a grace period. * **Passkey Authentication** — Passwordless login with Face ID, Touch ID, Windows Hello, or a hardware security key (WebAuthn/FIDO2). Multiple passkeys per user with friendly names and clone detection. * **Bot Protection** — Honeypot fields, timestamp validation, and JavaScript token verification on login, registration, and password reset forms. Bots are stopped before they can attempt a single password. * **Access Control** — IP whitelist and blacklist with inline notes. Country blocking in allow or block mode, backed by a locally stored MaxMind GeoLite2 database. * **Custom Login URL** — Move wp-login.php to any slug you choose. The default login returns a 404. * **Security Headers** — Seven managed headers (X-Content-Type-Options, X-Frame- Options, Referrer-Policy, X-XSS-Protection, HSTS, Content-Security-Policy, Permissions- Policy) delivered via PHP and optionally .htaccess, with a header probe that avoids duplicating what your server already sends. * **Email Notifications** — Daily and weekly security digests, plus event alerts for lockouts, blacklistings, and administrator logins. * **Privacy Hardening** — Author slug randomization to stop user enumeration, and email obfuscation to keep addresses away from scrapers. XML-RPC and REST API protection included. * **Dashboard** — Real-time stats, a blocks-over-time chart, protection status cards, and a WordPress dashboard widget. * **Tools** — Health checks with database integrity verification, one-click table repair, settings export and import, CSV log export, and debug mode. #### Privacy by default Visitor IP addresses never leave your server. Geolocation is resolved against a MaxMind GeoLite2 database stored locally on your own site, not by calling a third- party lookup API. Anonymous usage statistics default to off on the WordPress.org version and to on for the direct download from srworks.co, and can be turned off at any time either way. See External Services for the detail. ### External Services ArmorPro connects to srworks.co in the situations below. Visitor IP addresses are never sent to any external service. #### GeoIP Database Download To show the country for logged IPs and to power country blocking, ArmorPro downloads a MaxMind GeoLite2 country database and stores it on your server. All lookups then happen locally. * When: once when the database is missing, checked on an admin page load at most once per day, then weekly for updates * Data sent: your site URL and the plugin version * Service: https://api.srworks.co, which returns a link to the database file hosted on SRWorks infrastructure * Database: GeoLite2 Country by MaxMind, https://www.maxmind.com * Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy Individual IP addresses are never sent to this or any other service. Only the database file is transferred, and every lookup runs locally against it. #### Anonymous Usage Statistics ArmorPro shares anonymous statistics about the installation to help guide development.** The default depends on where you got the plugin:** * **WordPress.org version — off.** Nothing is sent unless you click “Enable” on the opt-in notice. Choosing “No Thanks” is remembered. * **Direct download from srworks.co — on by default.** It can be turned off at any time, see below. Either way, once you have made a choice it is remembered and the default no longer applies. * When: on activation, on deactivation, and once daily * Data sent: an anonymous site identifier; which SRWorks plugins are installed, their version numbers, and whether each has an active subscription; your WordPress version; and your PHP version * Not sent: your site address, visitor data, log contents, IP addresses, email addresses, or any other personal information * The site identifier is a one-way SHA-256 hash of your site address combined with a random value generated on your own server. It cannot be reversed to recover your address. * To turn it off: add `define( 'SRWORKS_TELEMETRY', false );` to your wp-config. php, or use the `srworks_telemetry_enabled` filter * Service: https://api.srworks.co * Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy No personal data, visitor data, or log contents are included. #### License Validation (Unused in This Version) ArmorPro contains a license client reserved for future AI-powered features, which will carry a per-request cost. No feature in this version is gated behind it, the admin interface has no field for entering a license key, and the AJAX endpoints that would trigger validation are not registered. This client makes no network requests. * When: never, in this version * Service: https://api.srworks.co * Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy ### Privacy Policy ArmorPro stores the following in your WordPress database: * IP addresses of visitors who trigger a security rule or attempt to log in * Timestamps of security events * Usernames used in login attempts * Country codes resolved locally from the GeoLite2 database Clear all logs at any time from the Tools tab. Log retention is 90 days and old entries are pruned daily. Uninstalling the plugin deletes all of it, along with the WAF bootstrap file and any .htaccess or .user.ini directives ArmorPro added. Visitor IP addresses are never transmitted off your server. ### Support Questions, bug reports, and feature requests: https://srworks.co/contact ### Credits Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https:// perishablepress.com), used under GPLv2. Charts by Chart.js (https://www.chartjs.org), MIT License. Tooltips by Tippy.js( https://atomiks.github.io/tippyjs) and Popper (https://popper.js.org), MIT License. QR codes by jquery-qrcode (https://larsjung.de/jquery-qrcode/), MIT License. This product includes GeoLite2 data created by MaxMind, available from https://www. maxmind.com. ## Installation 1. Install through Plugins > Add New, or upload the plugin folder to /wp-content/plugins/ 2. Activate the plugin through the Plugins menu in WordPress 3. Open ArmorPro in your admin menu 4. Turn on the features you want The firewall, brute force protection, and bot protection begin working immediately. The WAF engine, two-factor authentication, passkeys, and custom login URL are opt- in, so nothing changes how you log in until you choose it. ## FAQ ### Is anything paid or limited? No. Every feature is free and unlimited, with no premium tier and no upgrade prompts. ### Does ArmorPro work with NGINX? Yes. It runs on Apache, NGINX, LiteSpeed, and others. The standard firewall is pure PHP and needs no server configuration. The WAF engine detects your server type and configures itself. ### What is the WAF Engine? It runs at the PHP engine level, before WordPress begins loading, using PHP’s auto_prepend_file directive to intercept malicious requests in roughly a millisecond. It reads from cached flat files for speed and fails open, allowing requests through, if anything goes wrong. Enabling it writes a small bootstrap file to your site root and adds an auto_prepend_file directive to .user.ini or .htaccess, depending on your server. Both are removed when you disable it or uninstall the plugin. ### Will this slow down my website? No. The WAF engine adds roughly 1ms. The standard firewall uses fast string matching early in the WordPress load. Blocked requests stop before WordPress finishes loading, which reduces server load during an attack. ### How does brute force protection work? Failed logins are tracked per IP address. After a configurable number of failures the IP is locked out for a configurable duration. Repeat offenders can be auto-blacklisted after a set number of blocks, with an optional expiry so entries clear themselves. ### Can I use this alongside another security plugin? Yes, though features may overlap. Test before relying on both. Running two WAFs or two custom login URLs at once is not recommended. ### How do I whitelist my IP address? Go to ArmorPro > Access Control and add it to the whitelist. Whitelisted IPs bypass every security check, including brute force lockouts and firewall blocking. ### I locked myself out. What now? Add `define('ARMOR_DISABLE', true);` to wp-config.php to bypass all protection, or create a file named `.emergency-bypass` in the plugin directory. Either one restores access so you can fix the setting and remove the bypass. ### What data does ArmorPro collect? Security logs are stored locally in your WordPress database: IP addresses that trigger a rule or attempt a login, timestamps, and attempted usernames. Visitor data is never sent to a third party. Anonymous usage statistics are optional, and their default depends on where you got the plugin (see External Services). See External Services below for every outbound connection the plugin can make. ### What does the bot protection do? Bot protection adds invisible honeypot fields, timestamp validation, and JavaScript token verification to login, registration, and password reset forms. Automated bots that submit forms without rendering JavaScript or that submit too quickly are blocked before they can attempt brute force attacks. ### Can I block specific countries from accessing my site? Yes. Country blocking lets you allow only specific countries (whitelist mode) or block specific countries (blacklist mode) from accessing your login page. Uses MaxMind GeoLite2 database stored locally for fast, unlimited lookups. Country blocking applies to the whole site, not just the login page: it runs on every front-end request, and at the PHP engine level too when enhanced protection is enabled. ### How do I protect my WordPress login page? ArmorPro offers multiple login protection features: brute force protection with automatic lockouts, bot detection, two-factor authentication, passkey login, REST API protection to block enumeration, author slug obfuscation to hide usernames, and a custom login URL to hide wp-login.php entirely. ### Does ArmorPro support two-factor authentication? Yes! ArmorPro includes built-in two-factor authentication (2FA) using TOTP (Time- based One-Time Password). Users can set up any authenticator app like Google Authenticator, Authy, or 1Password. Backup codes are also provided in case you lose access to your device. Passkey authentication (Face ID, Touch ID, Windows Hello) is also supported as an alternative. ### Does ArmorPro protect against malware? ArmorPro focuses on prevention: stopping attacks before they compromise your site. The firewall blocks SQL injection, XSS, and other common attack vectors. For malware scanning and removal, we recommend pairing with a dedicated malware scanner. ### How do I block bad bots and scrapers? ArmorPro blocks malicious request patterns via the firewall and includes Bad User Agent blocking with a curated list of known malicious bots, scrapers, and vulnerability scanners that’s regularly updated. Bot protection adds additional automated detection on login forms. ### What happens when an IP is blocked? Blocked visitors see a professional “Access Blocked” page with a 403 status code. The page is clean and branded, informing them to contact the site administrator if they believe it’s an error. ### Can I export security logs? Yes. You can export login activity, firewall blocks, and blacklist data to CSV files for analysis or compliance reporting. ### Is it compatible with caching plugins? Yes, including WP Rocket, W3 Total Cache, LiteSpeed Cache, and WP Super Cache. The firewall runs ahead of caching layers and sets appropriate cache-control headers. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SRWorks ArmorPro” is open source software. The following people have contributed to this plugin. Contributors * [ SRWorks LLC ](https://profiles.wordpress.org/srworks/) [Translate “SRWorks ArmorPro” into your language.](https://translate.wordpress.org/projects/wp-plugins/srworks-armorlite) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/srworks-armorlite/), check out the [SVN repository](https://plugins.svn.wordpress.org/srworks-armorlite/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/srworks-armorlite/) by [RSS](https://plugins.trac.wordpress.org/log/srworks-armorlite/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.33 * Security release. Fixes two ways the firewall could be bypassed, and stops forwarded IP headers being trusted from sources that are not your proxy. Recommended for all sites. * Security: the firewall could be skipped by adding a harmless-looking parameter to a request. Both the standard firewall and the enhanced WAF decided whether to skip scanning by searching the whole URL including the query string, so appending something like ?x=/wp-admin/ bypassed every pattern, the blocked-method list and the request length limit. Both now match the request path only. Requests to the real admin area are unaffected. * Security: the enhanced WAF could be skipped with a fake cookie. When ‘skip logged- in users’ was enabled, any request carrying a wordpress_logged_in_ cookie bypassed the firewall, and the cookie was never validated because the WAF runs before WordPress and cannot check it. The WAF no longer honours that setting. It still applies to the standard firewall, where the login really can be verified. * Security: forwarded IP headers such as X-Forwarded-For and CF-Connecting-IP are no longer believed unless the request genuinely reached your site through a proxy. Previously anyone could send one and choose their own IP address, which allowed evading lockouts, blacklists and country blocking, impersonating a whitelisted address, or getting an innocent visitor auto-blacklisted. Sites behind Cloudflare or another CDN should add their ranges to the new Trusted Proxies setting; sites behind a local reverse proxy such as nginx keep working with no configuration. * Security: X-Forwarded-For is now read from the right, so the part of it a visitor can write themselves is no longer mistaken for their real address. * Security: a Content-Security-Policy value containing a line break could add arbitrary directives to .htaccess. Line breaks are now rejected when the policy is saved. * Security: exported CSV logs no longer allow a crafted username or request to be treated as a formula by Excel or Google Sheets. * Fixed: turning enhanced protection on could silently disable another security plugin’s firewall, and turning it off could disable one that was already configured. ArmorPro now refuses to take over an existing auto_prepend_file setting and no longer clears it on removal. * Fixed: importing a settings file silently switched two-factor enforcement off, because those settings were included in exports but not accepted back on import. * Fixed: upgrading from ArmorPro Lite could leave protections added since your Lite version switched off. * Fixed: whitelist entries created by an email unlock link were permanent, leaving a lasting exemption on an address that is usually temporary. They now expire after 24 hours. * Fixed: passkey logins ignored the Remember Me checkbox and always kept you signed in. * Changed: internal error handling in the firewall, GeoIP and login paths now catches the full range of PHP errors, not just part of it. #### 1.0.32 * Fixed: the anonymous usage data setting referred to the plugin as ArmorLite instead of ArmorPro #### 1.0.31 * Changed: anonymous usage statistics are now enabled by default on the direct download from srworks.co. The WordPress.org version is unchanged and remains opt-in * Added: telemetry can be disabled with define( ‘SRWORKS_TELEMETRY’, false ) in wp-config.php, or the srworks_telemetry_enabled filter * Fixed: the readme listed ‘which features are enabled’ as data sent, which was never the case #### 1.0.30 * Security: passkey logins now enforce the configured user verification level. When set to “Required”, the server verifies that the authenticator actually performed PIN or biometric verification instead of accepting possession of the key alone. Applies to both passkey registration and login. * Security: the redirect target after a passkey login is now restricted to your own site, falling back to the dashboard. * Security: hardened HTML escaping in admin tables so logged request data cannot inject markup attributes when viewing the Firewall log. * Fixed: settings import now merges over defaults instead of replacing them, so importing a partial or older export can no longer switch protections off. Bot protection is now included in import/export. * Fixed: unlock request rate limiting is now per visitor. Previously a handful of requests from any one client could block the recovery route for every administrator. * Deployment tooling now verifies the release host’s SSH key. #### 1.0.29 * **ArmorPro is now completely free.** Every feature that previously required a license is unlocked for everyone, with no limits: WAF engine, two-factor authentication, passkey login, custom login URL, IP blacklist, country blocking, HSTS, Content- Security-Policy, Permissions-Policy, email notifications, custom firewall patterns, and settings export/import. * Your existing settings, firewall patterns, IP lists and logs are carried over automatically on update. Protection stays on throughout; nothing needs reconfiguring. * Log retention increased from 7 to 90 days for all installs. * **New features arrive switched off.** Upgrading changes nothing about how you or your users log in. The WAF engine, two-factor authentication, passkeys, and custom login URL are all opt-in, and none of them touch your site until you enable them. * Removed: activating the plugin no longer writes to your site’s root .htaccess. Security headers are delivered over PHP from the first request, and .htaccess is only written when you save settings. * Privacy: removed third-party geolocation lookups. Visitor IP addresses are no longer sent to any external service. Country data is now resolved entirely from the local GeoLite2 database. * Anonymous usage statistics now default to off for every install and require explicit opt-in. * Removed all upgrade prompts and the license activation screen. #### 1.0.28 * Fixed: Firewall false positive that could 403 legitimate requests carrying a URL in a query parameter (OAuth redirect_uri, social share links, payment return URLs, callbacks). Removed the over-broad http(s)/ftp(s) protocol-in-query rules; PHP stream wrapper signatures (php://, phps://) are unchanged. Existing installs are cleaned up automatically on update. #### 1.0.27 * Fixed: Firewall false positive that could 403 legitimate requests containing array or JSON style query parameters (e.g. Fluent Forms entry filters, WooCommerce faceted filters, REST list endpoints). Removed the over-broad bare [ ] { } ? query string rules; targeted bracket attack signatures (GLOBALS[, REQUEST[, etc.) are unchanged. Existing installs are cleaned up automatically on update. #### 1.0.26 * Fixed: Enhanced WAF verification incorrectly reported ‘not active’ on sites using page caching (fastcgi_cache, Cloudflare, Varnish, LiteSpeed, WP Super Cache, WP Rocket, BoostPro). The check now uses a cache-immune heartbeat and probes a URL that page caches always bypass. #### 1.0.25 * Bug fixes and improvements #### 1.0.24 * Bug fixes and improvements #### 1.0.23 * Bug fixes and improvements #### 1.0.22 * Remove bundle license auto-activation (per-plugin keys now) #### 1.0.21 * Switch file extension firewall patterns to contains_path match mode #### 1.0.20 * Fix false positives on file extension patterns matching query string URLs * Widen match_mode column to support contains_path value #### 1.0.19 * Add input normalization pipeline to firewall, misc fixes #### 1.0.18 * Bug fixes and improvements #### 1.0.17 * Redesign firewall block pages with ASCII art branding * Add email unlock recovery and emergency bypass file for lockout prevention * Add email unlock recovery, branded HTML block page, and email template system #### 1.0.16 * Auto-update WAF engine on plugin upgrade * Add REST API protection compatibility warning #### 1.0.15 * Fix WAF false positives on wp-login redirect URLs * Plain text block pages with dynamic reasons * Fix notification init order and per-IP rate limiting #### 1.0.14 * Bug fixes and stability improvements #### 1.0.13 * Replace partner SDK with lightweight telemetry * Code cleanup and UI refinements #### 1.0.12 * Add standalone WAF engine with enhanced firewall patterns and endswith matching * Remove login from reserved slugs for custom login URL * Security hardening, dead code removal, and PHPCS compliance * UI refinements and admin JS cleanup #### 1.0.11 * Allow ‘login’ as custom login slug #### 1.0.10 * Add authentication enforcement with grace period * Suppress passkey nudge when enforcement is active #### 1.0.9 * Update readme.txt with high-level feature descriptions and vendor credits #### 1.0.8 * Remove all Pro/free tier distinctions from readme.txt * Fix duplicate changelog entries in readme.txt * Fix activation crash, security headers UI, and cleanup completeness * Add license secret comment, RUJS firewall bypass, and uninstall completeness * Unify toast notifications, fix firewall and TOTP improvements * Audit fixes: firewall execution, pattern matching, XSS hardening, dead code removal * Increment hit counts for all matching patterns, not just the first * Switch firewall from regex to string matching for improved performance * Admin UI improvements, database hardening, passkeys and firewall updates #### 1.0.7 * Admin UI refinements: card header font size, toggle colors, remove rule ID column * Remove all Pro/free tier distinctions from readme.txt * Split bundled firewall rules into individual toggles, remove cookies from rule manager #### 1.0.6 * Replace Space Grotesk with Inter for headings, remove unused font files * Hide third-party admin notices on ArmorPro settings page * Add security headers management, admin UI enhancements, and deploy script updates #### 1.0.5 * Bug fixes and improvements #### 1.0.4 * Bug fixes and improvements #### 1.0.3 * Bug fixes and enhancements #### 1.0.2 * Bug fixes and stability improvements #### 1.0.0 * Initial release * Brute force protection with configurable thresholds * PHP firewall with SQL injection and XSS protection * Security headers (X-Content-Type, X-Frame-Options, Referrer-Policy, X-XSS-Protection, HSTS, CSP, Permissions Policy) * XML-RPC and REST API protection * Author slug and email obfuscation * IP whitelist and temporary blocking * Geolocation with MaxMind GeoLite2 * Two-factor authentication (TOTP) with backup codes * Country blocking, custom login URL, permanent blacklist * Auto-blacklist repeat offenders * Email notifications and security digests * Extended logging and CSV export ## Meta * Version **1.0.33** * Last updated **4 days ago** * Active installations **Fewer than 10** * WordPress version ** 5.3 or higher ** * Tested up to **6.9.7** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/srworks-armorlite/) * Tags * [Brute Force](https://mri.wordpress.org/plugins/tags/brute-force/)[firewall](https://mri.wordpress.org/plugins/tags/firewall/) [login](https://mri.wordpress.org/plugins/tags/login/)[security](https://mri.wordpress.org/plugins/tags/security/) [two factor authentication](https://mri.wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://mri.wordpress.org/plugins/srworks-armorlite/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/srworks-armorlite/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/srworks-armorlite/reviews/) ## Contributors * [ SRWorks LLC ](https://profiles.wordpress.org/srworks/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/srworks-armorlite/)