Webforta
Sign inStart free trial

WordPress plugin

Webforta WordPress Security: a free plugin that protects the site from the inside, with an optional connection to your Webforta account.

Webforta WordPress Security is a free plugin that runs on your WordPress site and does its work on your own server. It works on its own straight after activation; connecting it to a Webforta account is optional and lets you see every site in one place. Every plan, including Free, can connect.

What it does on the site

  • Malware and file-integrity scanner: WordPress core files (and plugins from wordpress.org) checked against official checksums, PHP files hidden in uploads, known malicious code reported with file and line.
  • A firewall and login protection: limits on failed logins, lockouts, and two-factor authentication for user accounts.
  • Hardening you can switch on, such as security headers, hiding the WordPress version, turning off XML-RPC and blocking username enumeration.
  • A security activity log: logins, failed logins, new users, role changes, password resets, plugin and theme changes and updates.
  • Safe automatic plugin updates with rollback (opt-in, off by default): when an update breaks the site, the plugin rolls it back and records why.
  • Breached-password warnings: passwords are checked against Have I Been Pwned with k-anonymity. Only the first 5 characters of a SHA-1 hash of the password are sent, from your site directly to Have I Been Pwned. Nothing about passwords is sent to Webforta.

Install

  • Open the website in Webforta and go to its WordPress tab, then download the plugin zip (if the download is not offered, ask Webforta support).
  • In WordPress: Plugins > Add New > Upload Plugin, choose the zip and click Activate.

Connect to your Webforta account

  • One-click connect: in WordPress open Webforta > Webforta Cloud and click Connect with Webforta. Sign in to Webforta, approve the connection for the organization you choose, and you are done.
  • License key instead: on the website's WordPress tab in Webforta, click Create a license key instead, then paste the key in the plugin's Webforta account settings. A key works only on the site it was created for.
  • Connecting a site again replaces its previous license key. New license key and Disconnect are on the same WordPress tab.

What a connected plugin reports, and how often

  • A report about every 6 hours: protection status (firewall on or off, blocked requests and lockouts in the last 7 days, hardening applied), the latest file-scan results and new activity-log entries.
  • The site inventory (WordPress, PHP, plugin and theme versions, pending updates and administrator usernames) only when it changed, and otherwise about once a day.
  • Login security counts: how many administrators have two-factor authentication on, how many use a password found in known breaches, and weak usernames. Counts only, never passwords.
  • Automatic-update history: what was updated, rolled back, skipped or failed, and why. You get an email when an update is rolled back or more administrators use breached passwords.
  • Reports rely on WP-Cron, which runs when the site has visitors. Webforta also pings an overdue site's WP-Cron; for a site with very little traffic, add a real cron job that requests wp-cron.php every 15 minutes (most hosts offer this in their control panel).

Security fixes sent from Webforta (2.4.0 and later)

Administrators of your Webforta organization can send a fix for a scan finding to the plugin (see One-click fixes). The plugin applies it only if "Allow Webforta to apply security fixes" is turned on in the plugin, and a fix can only switch on one of the plugin's own protections from a fixed list. It never turns anything off, edits content or runs code. Turn the setting off at any time and the plugin refuses every fix; the dashboard then shows why.

File integrity watch (2.5.0 and later)

The plugin compares WordPress core and the plugins installed from wordpress.org with their official checksums and sends the result with its report. The website's WordPress tab shows when the check last ran, the core status (OK, Issues or Unavailable when the official checksums could not be fetched), and the lists of modified, unknown and missing files per component. Premium plugins, themes and uploads are not covered by this check.

  • You get one critical alert (category "WordPress file integrity" in Alerts, on by default) when a check finds modified or unknown core or plugin files that were not reported before. The same files reported again do not alert again. Missing core files are shown but not emailed. When the files match again, the activity log records it without an email.
  • Modified files are not always malicious (e.g. a developer edited a file), but unknown PHP files in wp-admin or wp-includes are a strong sign of compromise.
  • To fix core files, re-install WordPress from Dashboard > Updates > Re-install version X (your content and wp-config.php are kept). For a plugin, delete and reinstall the plugin from wordpress.org. Then remove unknown files you did not add and change all passwords.
  • File paths come from the site and are shown for information only. Older plugin versions show "Requires Webforta WordPress Security 2.5.0 or later".

Safe to update check (2.6.0 and later)

For every plugin, theme and WordPress core update the site reports, Webforta compares the installed version and the available version with the known vulnerabilities for that component. The website's WordPress tab (Updates card) and the plugin show, most urgent first, how many known vulnerabilities the update fixes, how many were exploited in the wild, and whether any are known to remain in the new version.

  • Urgent: the update fixes a critical or high-severity flaw, or one CISA lists as exploited in the wild. Recommended: it fixes other known flaws. No known fixes: the databases list no flaw fixed by it.
  • Still vulnerable after update: some known flaws are fixed only in a later version, have no fix yet, or have no fixed version listed (the new version may still be affected).
  • Update not offered: a fixed version exists but WordPress is not offering it, often a premium plugin without a license key; update it manually. No fix available: no fixed version is known; consider replacing or removing the plugin or theme.
  • This uses public vulnerability databases only. An update with no known fixes is not risk-free, and any update can break something: take a backup first and test important updates on a staging copy.

Remove the plugin

  • In WordPress: Plugins > Webforta WordPress Security > Deactivate, then Delete.
  • In Webforta: open the website's WordPress tab and click Disconnect. The license key stops working and the stored results are removed. Without this, the site is shown as Not reporting.

Legacy: Webforta Connector 1.x

Webforta Connector 1.x is the older, read-only plugin (Settings > Webforta in WordPress). It reports hourly, runs a full file scan every 12 hours, never changes the site and cannot receive fixes. Sites that still run it keep reporting. To move to Webforta WordPress Security, install and connect the new plugin, then deactivate and delete the Connector.