WordPress Security
WordPress security in Panelica is a full suite per site: a scored hardening checklist with one-click fixes, a malware and integrity scanner, and a resident security agent inside WordPress handling login protection, rate limiting, IP and country blocking and bot filtering. Five tabs: Overview, Scanner, Hardening, Login Activity and WP Users.
WP Toolkit → Securityhttps://YOUR-SERVER-IP:8443/wordpress/securityOverview: the score and the agent
The Overview tab opens with a 0-100 security score (the share of hardening checks currently passing) and quick counters for threats, modified files and login attempts. Below it lives the Security Agent: install it once per site and it runs inside WordPress as a must-use plugin, giving you four configurable protections saved together with one button:
- Login Protection: cap failed login attempts (default 5) within a time window, then block the source IP for a chosen duration, from minutes to a day. This is the brute-force killer.
- HTTP Rate Limiting: a requests-per-minute ceiling per client with a temporary ban for offenders, for scrapers and layer-7 floods that never touch the login page.
- Firewall: IP blacklist and whitelist (IPv4/IPv6, CIDR supported, validated as you type) and optional country blocking by two-letter codes.
- Bot Protection: category toggles for search engines, social-media crawlers, monitoring services, SEO tools and AI crawlers (the one category off by default), plus custom user-agent patterns. Reverse-DNS verification can be required so a "Googlebot" that does not resolve back to Google is treated as an impostor.
Scanner: quick or deep
Two scan modes with a live step-by-step progress list:
| Step | What it checks |
|---|---|
| Core Integrity | Every WordPress core file against the official checksums for that version |
| Plugin Integrity | Installed plugins against their official releases |
| Suspicious Files | A signature sweep for malware patterns (obfuscated eval chains, injected uploaders and the like), with known-good files whitelisted |
| PHP in Uploads | Executable PHP hiding in wp-content/uploads, the classic shell drop |
| ClamAV Malware | Full Scan mode only: an antivirus pass over the installation |
Results are actionable, not just a report: modified core or plugin files are listed by name, and suspicious files, rogue uploads and ClamAV hits each carry a delete button behind a cannot-be-undone confirmation. A clean run ends in an explicit all-clear.
Hardening: nine checks, one-click fixes
The Hardening tab is a table of nine concrete checks, each showing its current value, a secure/insecure verdict and, where safe to automate, a Fix button, with Undo available after. The list, and what fixing actually does on disk:
| Check | The fix, concretely |
|---|---|
| File Editor | Writes DISALLOW_FILE_EDIT into wp-config, removing the built-in code editor attackers love |
| Debug Mode | Turns off WP_DEBUG so stack traces stop leaking paths and versions |
| DB Table Prefix | Warns when the default wp_ prefix is in use (manual to change safely) |
| wp-config Permissions | Tightens the file to owner-only readability |
| Info Files | Deletes readme.html and license.txt, which advertise the WordPress version |
| PHP in Uploads | Drops an .htaccess into uploads that refuses to execute PHP there |
| XML-RPC | Blocks xmlrpc.php, the favorite amplifier for brute force |
| Auto Updates | Warns if WordPress's automatic security updates are disabled |
| Comments | Site-wide comment shutdown for sites that do not need them (spam surface gone) |
A separate Delete All Comments action, behind a confirmation, empties the comment table for brochure sites. Fixes apply instantly with no per-item dialog, and everything is written as the site's own Linux user; frozen sites refuse all of it until unfrozen.
Login Activity and WP Users
The remaining tabs surface what the agent sees. Login Activity is a small threat dashboard: recent login attempts with their sources and outcomes, an attack timeline, a top-attackers list with countries resolved via GeoIP, and a per-IP detail view from which an address can be blocked or unblocked. WP Users lists the site's WordPress accounts for a quick audit of who actually has access.
Access
Behind the wordpress license feature, scoped to your own sites. Freeze status gates every write on this page, so a frozen site is exactly as immutable as promised.