WP Cerber Security, Anti-spam & Malware Scan
ExtensionProtection against hacker attacks and bots. Malware scanner & integrity checker. User activity log. Antispam reCAPTCHA. Limit login attempts.
- 0 étoile
- 0 personne le suit
- 0 téléchargement
- Licence non déclarée
Afficher 106 versions pas encore disponibles
Publications citées dans le journal des modifications de l’éditeur ou sur WordPress.org que le dépôt ne contient pas encore.
-
9.9.5 Pas encore disponible Date de publication non indiquée
Improved: A setting link in admin UI now opens the matching role tab in the role-based settings and highlights the target setting, so you ca...
-
9.9.3 Pas encore disponible Date de publication non indiquée
Fixed: When error logging was active, an uncaught PHP failure such as an unhandled exception, a type error, or a parse error could stop the...
-
9.9 Pas encore disponible Date de publication non indiquée
New: WP Cerber now automatically maintains a backup copy of the last known valid plugin settings. The backup is refreshed after successful s...
-
9.8.3 Pas encore disponible Date de publication non indiquée
New: The Activity log and Traffic log CSV exports now report the date range they cover, adding the oldest and newest record timestamps to th...
-
9.8 Pas encore disponible Date de publication non indiquée
Changed: Renamed the "White IP Access List" and "Black IP Access List" terms to "Allowed IP Access List" and "Blocked IP Access List" across...
-
9.7.4 Pas encore disponible Date de publication non indiquée
New: Timestamps in the fail2ban log now follow the operating system timezone instead of UTC, so fail2ban can correctly evaluate failed login...
-
9.7.3 Pas encore disponible Date de publication non indiquée
Improved: Plugin settings that accept REGEX patterns are now validated for syntax errors when an administrator saves settings, helping detec...
-
9.7 Pas encore disponible Date de publication non indiquée
New: Implemented a "System Readiness" dashboard widget that surfaces configuration and environment issues impacting security and stability,...
-
9.6.11 Pas encore disponible Date de publication non indiquée
New: Added detection of AI bots and LLM scrapers (OpenAI, Claude, Meta, Apple, etc.) to easily identify AI-driven traffic in logs and alerts...
-
9.6.10 Pas encore disponible Date de publication non indiquée
Important: WP Cerber now requires PHP 7.4 or newer to run, with PHP 8.x recommended for optimal performance and security.
-
9.6.9 Pas encore disponible Date de publication non indiquée
Important: The behavior of the 'authenticate' hook has been reverted to restore the behavior from versions before WP Cerber 9.6.6. Custom lo...
-
9.6.7.3 Pas encore disponible Date de publication non indiquée
Fixed: A fatal PHP error triggered by a conflict with InfiniteWP.
-
9.6.7 Pas encore disponible Date de publication non indiquée
Important: The minimum required PHP version is now 7.3, with PHP 8.x recommended for optimal performance and security.
-
9.6.6 Pas encore disponible Date de publication non indiquée
New: Introduced automatic translation of the plugin interface and messages for non-English websites, powered by AI and delivered via the WP...
-
9.6.5 Pas encore disponible Date de publication non indiquée
New: Dashboard widgets can now be rearranged using drag-and-drop, giving you full control over their placement.
-
9.6.4 Pas encore disponible Date de publication non indiquée
New: WP Cerber continuously monitors IP detection issues and provides diagnostic messages. If IP detection fails due to configuration or ser...
-
9.6.3 Pas encore disponible Date de publication non indiquée
New: The integrity scanner now monitors installed plugins and notifies you if any have been abandoned, helping you maintain site security.
-
9.6.2 Pas encore disponible Date de publication non indiquée
New: Introduced an admin tool that provides clear explanations of security events in WP Cerber logs and security settings WP Cerber applied...
-
9.6.1 Pas encore disponible Date de publication non indiquée
Fixed: An issue where you could not change the mode of two-factor authentication (2FA) for a user if 2FA was previously enabled or completel...
-
9.6 Pas encore disponible Date de publication non indiquée
New: You can control the amount of sign-in attempt details that are shown in 2FA email messages. You can also disable this section completel...
-
9.5.8 Pas encore disponible Date de publication non indiquée
New: Mitigating excessive use of the WordPress password reset form. Whenever WP Cerber detects multiple attempts to reset password for non-e...
-
9.5.7 Pas encore disponible Date de publication non indiquée
New: When two-factor authentication is enabled, users can now optionally click a checkbox on the 2FA form to remember their devices for a pr...
-
9.5.6 Pas encore disponible Date de publication non indiquée
New: WP Cerber now sends 2FA verification codes via SMTP. If an SMTP server is set up in the WP Cerber settings, it will be used to send the...
-
9.5.5 Pas encore disponible Date de publication non indiquée
New: WP Cerber now supports establishing outgoing network connections via a proxy server that is configured for WordPress.
-
9.5.4 Pas encore disponible Date de publication non indiquée
Improved: The breaking changes introduced in WooCommerce 7.5.1 interfered with the WP Cerber anti-spam engine when enabled, causing issues w...
-
9.5.3 Pas encore disponible Date de publication non indiquée
New: You can define a more secure location of the protected WP Cerber directory by using a PHP constant.
-
9.5 Pas encore disponible Date de publication non indiquée
New: Get an email notification whenever a new version of a plugin is available.
-
9.4 Pas encore disponible Date de publication non indiquée
New: In addition to weekly reporting, WP Cerber can be configured to generate and send monthly activity reports once a month.
-
9.3.3 Pas encore disponible Date de publication non indiquée
Fixed: A bug that prevents loading default values of some WP Cerber settings upon the plugin activation. On some websites the bug can cause...
-
9.3.2 Pas encore disponible Date de publication non indiquée
Improved: Every locked-out IP address on the "Lockout" tab has a link to check its suspicious activity in the Activity log.
-
9.3 Pas encore disponible Date de publication non indiquée
Fixed: Unable to remove a blocked IP network class C (with an asterisk) from the list of locked out IP addresses by clicking the "Remove" li...
-
9.2 Pas encore disponible Date de publication non indiquée
New: Custom login error message. If showing the default WordPress login error message is disabled, you can optionally specify your own login...
-
9.1 Pas encore disponible Date de publication non indiquée
New: A new feature that prevents exposing user’s first name, last name, and ID via an HTTP request with a username (login) in an authorname...
-
9.0 Pas encore disponible Date de publication non indiquée
New: Different alerts can be sent through different channels. You can select delivering notifications through Pushbullet and email simultane...
-
8.9.6 Pas encore disponible Date de publication non indiquée
New: A new alert creation dialog with a set of new alert settings enables you to create alerts with new limits: an expiration time, the maxi...
-
8.9.5 Pas encore disponible Date de publication non indiquée
New: A new setting for WP Cerber's anti-spam engine: "Disable bot detection engine for IP addresses in the White IP Access List".
-
8.9.3 Pas encore disponible Date de publication non indiquée
Improved: The scanner: now checksums generated using manually uploaded ZIP archives have priority over the remote ones.
-
8.9 Pas encore disponible Date de publication non indiquée
Improved: An updated scan statistic and filtering widget. Dynamically displays the most important issues with sorting.
-
8.8.5 Pas encore disponible Date de publication non indiquée
New: Quick user activity analytics (user insights) with filtering links on the Activity and Live Traffic log pages. Select a user to see how...
-
8.8.3 Pas encore disponible Date de publication non indiquée
New: Mimicking the default WordPress user authentication through the wp-login.php to detect slow brute-force attacks.
-
8.8 Pas encore disponible Date de publication non indiquée
New: You get control over the WordPress application passwords and the ability to monitor related events in the log with email and mobile not...
-
8.7 Pas encore disponible Date de publication non indiquée
New: Limiting the number of allowed concurrent user sessions. Depending on settings, WP Cerber will either block new logins or terminate the...
-
8.6.8 Pas encore disponible Date de publication non indiquée
New: A shortcode to display WP Cerber’s cookies. You can display a list of cookies set by WP Cerber on any page.
-
8.6.7 Pas encore disponible Date de publication non indiquée
New: In the professional version of WP Cerber, you can now permit user registrations for IP addresses in the White IP Access List only.
-
8.6.6 Pas encore disponible Date de publication non indiquée
New: On the user sessions page, you can now search sessions by a user name, email, and the IP address from which a user has logged in.
-
8.6.5 Pas encore disponible Date de publication non indiquée
New: File system analytics. It's generated based on the results of the last full integrity scan.
-
8.6.3 Pas encore disponible Date de publication non indiquée
New: Ability to load IP access list's entries in the CSV format (bulk load).
-
8.6 Pas encore disponible Date de publication non indiquée
New: An integration with the Cloudflare firewall. It’s implemented as a special WP Cerber add-on.
-
8.5.9 Pas encore disponible Date de publication non indiquée
New: On the Live Traffic log, now you can search and filter our requests with software errors if they occurred.
-
8.5.8 Pas encore disponible Date de publication non indiquée
New: A personal data export and erase features which can be used through the WordPress personal data export and erase tool. This feature hel...
-
8.5.6 Pas encore disponible Date de publication non indiquée
New: Ability to separately set the number of days of keeping log records in the database for authenticated (logged in) website users and non...
-
8.5.5 Pas encore disponible Date de publication non indiquée
New: IP Access Lists now support IPv6 networks, ranges, and wildcards. Add as many IPv6 entries to the access lists as you need. We've devel...
-
8.5.3 Pas encore disponible Date de publication non indiquée
New: The malware scanner and integrity checker window has got a new filter that enables you to filter out and navigate to specific issues qu...
-
8.5 Pas encore disponible Date de publication non indiquée
New: Data Shield module for advanced protection of user data and vital settings in the website database. Available in the PRO version.
-
8.4 Pas encore disponible Date de publication non indiquée
New: More flexible role-based GEO access policies.
-
8.3 Pas encore disponible Date de publication non indiquée
New: Two-Factor Authentication.
-
8.2 Pas encore disponible Date de publication non indiquée
New: Automatic recovery of infected files. When the malware scanner detects changes in the core WordPress files and plugins, it automaticall...
-
8.1 Pas encore disponible Date de publication non indiquée
New: On a main Cerber.Hub website you can get a list of active plugins and available plugin updates on a managed website.
-
8.0 Pas encore disponible Date de publication non indiquée
New: Manage multiple WP Cerber instances from one dashboard.
-
7.9.7 Pas encore disponible Date de publication non indiquée
New: Authorized users only mode.
-
7.9.3 Pas encore disponible Date de publication non indiquée
New: New settings for the Traffic Inspector firewall allow you to fine-tune its behavior. You can enable less or more restrictive firewall r...
-
7.9 Pas encore disponible Date de publication non indiquée
New: The plugin monitors suspicious requests that cause 4xx and 5xx HTTP errors and blocks IP addresses that aggressively generate such requ...
-
7.8.5 Pas encore disponible Date de publication non indiquée
New: A new set of heuristics algorithms for detecting obfuscated malicious JavaScript code.
-
7.8 Pas encore disponible Date de publication non indiquée
New: An ignore list for the malware scanner.
-
7.7 Pas encore disponible Date de publication non indiquée
New: Automatic cleanup of malware and suspicious files. This powerful feature is available in the PRO version and automatically deletes troj...
-
7.6 Pas encore disponible Date de publication non indiquée
New: The quarantine has got a separate admin page in the WordPress dashboard which allows viewing deleted files, restoring or deleting them.
-
7.5 Pas encore disponible Date de publication non indiquée
New: Firewall algorithms have been improved and now inspect the contents of all files that are being tried to upload on a website.
-
7.2 Pas encore disponible Date de publication non indiquée
New: Monitoring new and changed files.
-
7.0 Pas encore disponible Date de publication non indiquée
Cerber Security Scanner: system integrity checker, malware detector and malware removal tool.
-
6.7.5 Pas encore disponible Date de publication non indiquée
A new button View Activity has been added to the user edit page in the WordPress dashboard.
-
6.7 Pas encore disponible Date de publication non indiquée
New: Regular expressions are now available for the Traffic Inspector Request whitelist and Antispam Query whitelist.
-
6.5 Pas encore disponible Date de publication non indiquée
New: A new, advanced initialization mode which reinforces overall security performance.
-
6.2 Pas encore disponible Date de publication non indiquée
New: Protection against (DoS) attacks that exploit recently discovered vulnerability (CVE-2018-6389).
-
6.1 Pas encore disponible Date de publication non indiquée
New: Traffic Inspector has got a Request White List setting.
-
6.0 Pas encore disponible Date de publication non indiquée
New: Traffic Inspector. It’s a specialized request inspection algorithm that performs inspection all suspicious incoming HTTP requests and b...
-
5.9 Pas encore disponible Date de publication non indiquée
New: You can add comments for new entries in the access lists
-
5.8.6 Pas encore disponible Date de publication non indiquée
New: Regular expressions (REGEX) in the list of prohibited usernames.
-
5.8 Pas encore disponible Date de publication non indiquée
New: Now the plugin will send a brief security report (activity for past seven days) to specified email addresses.
-
5.7 Pas encore disponible Date de publication non indiquée
New: Limit access to WordPress REST API for logged in users only.
-
5.5 Pas encore disponible Date de publication non indiquée
New: White list for the WordPress anti-spam engine.
-
5.2 Pas encore disponible Date de publication non indiquée
Bug fixed: Hidden custom login URL may be discovered by using specially formatted URL.
-
5.1 Pas encore disponible Date de publication non indiquée
New: Anti-spam and anti-bot for contact and other forms. Cerber antispam and bot detection engine now protects all forms on a website. It’s...
-
5.0 Pas encore disponible Date de publication non indiquée
New: A new antispam and bot detection engine that protects comment and user registration forms from bot attacks. After several attempts bot...
-
4.9 Pas encore disponible Date de publication non indiquée
New: Additional details will be logged and displayed on the Activity page: the URL of a request and decision the plugin engine had made.
-
4.8.2 Pas encore disponible Date de publication non indiquée
New: Starting with this version all database tables will be created with a default database engine. It should be InnoDB.
-
4.8 Pas encore disponible Date de publication non indiquée
New: You can enable/disable applying limit login rules to IP addresses in the White IP Access List.
-
4.7.7 Pas encore disponible Date de publication non indiquée
New: invisible reCAPTCHA (classic, visible also available).
-
4.5 Pas encore disponible Date de publication non indiquée
New: Instant mobile and browser notifications with Pushbullet.
-
4.3 Pas encore disponible Date de publication non indiquée
New: Use powerful subscriptions to get email notifications according to filters for events you have set.
-
4.1 Pas encore disponible Date de publication non indiquée
New: Date format field allows you to specify a desirable format for displaying dates and time.
-
4.0 Pas encore disponible Date de publication non indiquée
New: reCAPTCHA for WooCommerce forms. How to set up reCAPTCHA.
-
3.0 Pas encore disponible Date de publication non indiquée
New: reCAPTCHA to protect WordPress forms spam registrations. Also available for lost password and login forms.
-
2.9 Pas encore disponible Date de publication non indiquée
New: Checking for a prohibited username (login). You can specify list of logins manually on the new settings page (Users).
-
2.7.2 Pas encore disponible Date de publication non indiquée
Fixed bug for non-English WordPress configuration: the plugin is unable to block IP in some server environment. If you have configured langu...
-
2.7.1 Pas encore disponible Date de publication non indiquée
Fixed two small bugs related to 1) unable to remove IP subnet from the Access Lists and 2) getting IP address in case of reverse proxy doesn...
-
2.7 Pas encore disponible Date de publication non indiquée
New: Now you can view extra WHOIS information for IP addresses in the activity log including country, network info, abuse contact, etc.
-
2.0.1.6 Pas encore disponible Date de publication non indiquée
New: Added Reason column on the Lockouts screen which will display cause of blocking particular IP.
-
1.8 Pas encore disponible Date de publication non indiquée
New! added Hostname column for the Activity and Lockouts tabs.
-
1.7 Pas encore disponible Date de publication non indiquée
Added ability to remove old records from the user activity log. Log will be cleaned up automatically. Check out new Keep records for field o...
-
1.6 Pas encore disponible Date de publication non indiquée
New: beautiful widget for the dashboard to keep an eye on things. Get quick analytic with trends over 24 hours and ability to manually deact...
Les 106 publications pas encore disponibles, dans le journal des modifications
Lisez-moi
LicenceWP Cerber Security, Anti-spam & Malware Scan
Protection against hacker attacks and bots. Malware scanner & integrity checker. User activity log. Antispam reCAPTCHA. Limit login attempts.
Defends WordPress against hacker attacks, spam, trojans, and malware. Mitigates brute-force attacks by limiting the number of login attempts through the login form, XML-RPC / REST API requests, or using auth cookies. Tracks user and bad actors activity with flexible email, mobile and desktop notifications. Stops spammers by using a specialized anti-spam engine. Uses Google reCAPTCHA to protect registration, contact, and comments forms. Restricts access with IP Access Lists. Monitors the website integrity with an advanced malware scanner and integrity checker. Reinforces the security of WordPress with a set of flexible security rules and sophisticated security algorithms.
Security Features To Fortify Your WordPress
- Limit login attempts when logging in by IP address or entire subnet.
- Monitors logins made by login forms, XML-RPC requests or auth cookies.
- Permit or restrict access by IP Access Lists with a single IP, IP range or subnet.
- Create Custom login URL (rename wp-login.php).
- Cerber anti-spam engine for protecting contact and registration forms.
- Automatically detects and moves spam comments to trash or denies them completely.
- Manage multiple WP Cerber instances from one dashboard.
- Two-Factor Authentication for WordPress.
- Logs users, bots, hacker and other suspicious activities.
- Security scanner verifies the integrity of WordPress files, plugins and themes.
- Monitors file changes and new files with email notifications and reports.
- Mobile and email notifications with a set of flexible filters.
- Advanced users' sessions manager
- Protects wp-login.php, wp-signup.php and wp-register.php from attacks.
- Hides wp-admin (dashboard) if a visitor isn't logged in.
- Immediately blocks an intruder IP when attempting to log in with non-existent or prohibited username.
- Restrict user registration or login with a username matching REGEX patterns.
- Restrict access to WP REST API with your own role-based security rules.
- Block access to WordPress REST API completely.
- Block access to XML-RPC (block access to XML-RPC including Pingbacks and Trackbacks).
- Disable feeds (block access to the RSS, Atom and RDF feeds).
- Restrict access to XML-RPC, REST API and feeds by White IP Access list by an IP address or an IP range.
- Authorized users only mode
- Block a user account.
- Disable automatic redirection to the hidden login page.
- Stop user enumeration (blocks access to author pages and prevents user data leaks via REST API).
- Proactively blocks IP subnet class C.
- Anti-spam: reCAPTCHA to protect WordPress login, register and comment forms.
- reCAPTCHA for WooCommerce & WordPress forms.
- Invisible reCAPTCHA for WordPress comments forms.
- A special Citadel mode for massive brute force attacks.
- Play nice with fail2ban: write failed attempts to the syslog or a custom log file.
- Filter out and inspect activities by IP address, user, username or a particular activity.
- Filter out activities and export them to a CSV file.
- Reporting: get weekly reports to specified email addresses.
- Limit login attempts works on a site/server behind a reverse proxy.
- Be notified via mobile push notifications.
- Trigger and action for the jetFlow.io automation plugin.
- Protection against (DoS) attacks (CVE-2018-6389).
Limit login attempts done right
By default, WordPress allows unlimited login attempts through the login form, XML-RPC or by sending special cookies. This allows passwords to be cracked with relative ease via brute force attack.
WP Cerber blocks intruders by IP or subnet from making further attempts after a specified limit on retries is reached, making brute force attacks or distributed brute force attacks from botnets impossible.
You will be able to create a Black IP Access List or White IP Access List to block or allow logins from a particular IP address, IP address range or a subnet any class (A,B,C).
Moreover, you can create your Custom login page and forget about automatic attacks to the default wp-login.php, which takes your attention and consumes a lot of server resources. If an attacker tries to access wp-login.php they will be blocked and get a 404 Error response.
Malware scanner
Cerber Security Scanner is a sophisticated and extremely powerful tool that thoroughly scans every folder and inspects every file on a website for traces of malware, trojans, backdoors, changed and new files.
Read more about the malware scanner.
Integrity checker
The scanner checks if all WordPress folders and files match what exist in the official WordPress core repository, compares your plugins and themes with what are in the official WordPress repository and alerts you to any changes. As with scanning free plugins and themes, the scanner scans and verifies commercial plugins and themes that are installed manually.
Scheduled Scans With Automatic File Recovery
Cerber Security Scanner allows you to configure a schedule for automated recurring scanning easily. Once the schedule is configured the scanner automatically scans the website, deletes malware and recovers modified and infected WordPress files. After every scan, you can get an optional email report with the results of the scan.
Read more about the scheduled scans.
Two-Factor Authentication
Two-Factor Authentication (2FA) provides an additional layer of security requiring a second factor of identification beyond just a username and password. When 2FA is enabled on a website, it requires a user to provide an additional verification code when signing into the website. This verification code is generated automatically and sent to the user by email.
Read more about Two-Factor Authentication.
Log, filter out and export activities
WP Cerber tracks time, IP addresses and usernames for successful and failed login attempts, logins, logouts, password changes, blocked IP and actions taken by itself. You can export them to a CSV file.
Limit login attempts reinvented
You can hide WordPress dashboard (/wp-admin/) when a user isn't logged in. If a user isn't logged in and they attempt to access the dashboard by requesting /wp-admin/, WP Cerber will return a 404 Error.
Massive botnet brute force attack? That's no longer a problem. Citadel mode will automatically be activated for awhile and prevent your site from making further attempts to log in with any username.
Cerber anti-spam engine
Anti-spam and anti-bot protection for contact, registration, comments and other forms. WP Cerber anti-spam and bot detection engine now protects all forms on a website. No reCAPTCHA is needed. It’s compatible with virtually any form you have. Tested with Gravity Forms, Caldera Forms, HappyForms, Contact Form 7, Ninja Forms, Formidable Forms, Fast Secure Contact Form, Contact Form by WPForms.
Anti-spam protection: invisible reCAPTCHA for WooCommerce
- WooCommerce login form
- WooCommerce register form
- WooCommerce lost password form
Anti-spam protection: invisible reCAPTCHA for WordPress
- WordPress login form
- WordPress register form
- WordPress lost password form
- WordPress comment form
Integration with Cloudflare
A special Cloudflare add-on for WP Cerber keeps in sync the list of blocked IP addresses with Cloudflare IP Access Rules.
Stay in compliance with GDPR
How to get full control of personal data to be in compliance with data privacy laws such as GDPR in Europe or CCPA in California.
Documentation & Tutorials
- Configuring Two-Factor Authentication
- How to set up notifications
- Push notifications with Pushbullet
- How to set up invisible reCAPTCHA for WooCommerce
- Changing default plugin messages
- 2FA alternatives to the Clef plugin
- Why reCAPTCHA does not protect WordPress from bots and brute-force attacks
Translations
- Czech, thanks to Hrohh
- Deutsche, thanks to mario, Mike and Daniel
- Dutch, thanks to Jos Knippen and Bernardo
- Français, thanks to hardesfred
- Norwegian (Bokmål), thanks to Eirik Vorland
- Portuguese (Portugal), thanks to Helderk
- Portuguese (Brazil), thanks to Felipe Turcheti
- Spanish, thanks to Ismael Murias and leemon
- Український, thanks to Nadia
- Русский, thanks to Yui
- Italian, thanks to Francesco Venuti
- Swedish, thanks to Fredrik Näslund
Thanks to POEditor.com for helping to translate this project.
Compatibility is not verified
There are some plugins that were not checked to be compatible: Login LockDown, Login Security Solution, BruteProtect, Ajax Login & Register, Lockdown WP Admin, Loginizer, Sucuri, Wordfence, BulletProof Security, SiteGuard WP Plugin, iThemes Security, All In One WP Security & Firewall, Brute Force Login Protection
Another reliable plugins from the trusted author
Checks plugins for deprecated WordPress functions, known security vulnerabilities, and some unsafe PHP functions
Make your website instantly available in 90+ languages with Google Translate Widget. Add the power of Google automatic translations with one click.
Ce qu’il apporte
- Codes courts :
[wp_cerber_cookies] - S’intègre avec WooCommerce
Installation
Installing the WP Cerber Security plugin is the same as other WordPress plugins.
- Install the plugin through Plugins > Add New > Upload or unzip plugin package into wp-content/plugins/.
- Activate the WP Cerber through the Plugins > Installed Plugins menu in the WordPress admin dashboard.
- Read carefully: Getting Started Guide
Important notes
- Before enabling invisible reCAPTCHA, you must obtain separate keys for the invisible version. How to enable reCAPTCHA.
- If you want to test out plugin's features, do this on another computer (or incognito browser window) and remove computer IP address or network from the White Access List. Cerber is smart enough to recognize "the boss".
- If you've set up the Custom login URL and you use some caching plugin like W3 Total Cache or WP Super Cache, you have to add the new Custom login URL to the list of pages not to cache.
- Read this if your website is under CloudFlare
- If you use the Jetpack plugin or another plugin that needs to connect to wordpress.com, you need to unlock XML-RPC. To do that go to the Hardening tab, uncheck Disable XML-RPC, and click the Save changes button.
The following steps are optional but they allow you to reinforce the protection of your WordPress.
- Fine tune Limit login attempts settings making them more restrictive according to your needs
- Configure your Custom login URL and remember it (the plugin will send you an email with it).
- Once you have configured Custom login URL, check 'Immediately block IP after any request to wp-login.php' and 'Block direct access to wp-login.php and return HTTP 404 Not Found Error'. Don't use wp-admin to log in to your WordPress dashboard anymore.
- If your WordPress has a few experienced users, check 'Immediately block IP when attempting to log in with a non-existent username'.
- Specify the list of prohibited usernames (logins) that legit users will never use. They will not be permitted to log in or register.
- Configure mobile and browser notifications via Pushbullet.
- Obtain keys and enable invisible reCAPTCHA for password reset and registration forms (WooCommerce supported too).
Faq
Can I use the plugin with CloudFlare?
Yes. WP Cerber settings for CloudFlare.
Is WP Cerber Security compatible with WordPress multisite mode?
Yes. All settings apply to all sites in the network simultaneously. You have to activate the plugin in the Network Admin area on the Plugins page. Just click on the Network Activate link.
Is WP Cerber Security compatible with bbPress?
Yes. Compatibility notes.
Is WP Cerber Security compatible with WooCommerce?
Completely.
Is reCAPTCHA for WooCommerce free feature?
Yes. How to set up reCAPTCHA for WooCommerce.
Are there any incompatible plugins?
The following plugins can cause some issues: Ultimate Member, WPBruiser {no- Captcha anti-Spam}, Plugin Organizer, WP-SpamShield. The Cerber Security plugin won't be updated to fix any issue or conflict related to them, you should decide and stop using one or all of them. Read more: https://wpcerber.com/compatibility/.
Can I change login URL (rename wp-login.php)?
Yes, easily. How to rename wp-login.php
Can I hide the wp-admin folder?
Yes, easily. How to hide wp-admin and wp-login.php from possible attacks
Can I rename the wp-admin folder?
Nope. It's not possible and not recommended for compatibility reasons.
Can I hide the fact I use WordPress?
No. We strongly encourage you not to use any plugin that renames wp-admin folder to protect a website. Beware of all plugins that hide WordPress folders or other parts of a website and claim this as a security feature. They are not capable to protect your website. Don't be silly, hiding some stuff doesn't make your site more secure.
Can WP Cerber Security work together with the Limit Login Attempts plugin?
Nope. WP Cerber is a drop in replacement for that outdated plugin.
Can WP Cerber Security protect my site from DDoS attacks?
Nope. The plugin protects your site from Brute force attacks or distributed Brute force attacks. By default WordPress allows unlimited login attempts either through the login form or by sending special cookies. This allows passwords to be cracked with relative ease via a brute force attack. To prevent from such a bad situation use WP Cerber.
Is there any WordPress plugin to protect my site from DDoS attacks?
Nope. This hard task cannot be done by using a plugin. That may be done by using special hardware from your hosting provider.
What is the goal of the Citadel mode?
Citadel mode is intended to block massive bot (botnet) attacks and also a slow brute force attack. The last type of attack has a large range of intruder IPs with a small number of attempts to log in per each.
How to turn off the Citadel mode completely?
Set Threshold fields to 0 or leave them empty.
What is the goal of using Fail2Ban?
With Fail2Ban you can protect site on the OS level with iptables firewall. See details here: https://wpcerber.com/how-to-protect-wordpress-with-fail2ban/
Do I need to use Fail2Ban to get the plugin working?
No, you don't. It is optional.
Can I use this plugin on the WP Engine hosting?
Yes! WP Cerber Security is not on the list of disallowed plugins.
Is the plugin compatible with Cloudflare?
Yes, read more: https://wpcerber.com/cloudflare-and-wordpress-cerber/
Does the plugin works on websites with SSL(HTTPS)
Absolutely!
It seems that old activity records are not removing from the activity log
That means that scheduled tasks are not executed on your site. In other words, WordPress cron is not working the right way. Try to add the following line to your wp-config.php file:
define( 'ALTERNATE_WP_CRON', true );
I'm unable to log in / I'm locked out of my site / How to get access (log in) to the dashboard?
There is a special version of the plugin called WP Cerber Reset. This version performs only one task. It resets all WP Cerber settings to their initial values (excluding Access Lists) and then deactivates itself.
To get access to your dashboard you need to copy the WP Cerber Reset folder to the plugins folder. Follow these simple steps.
- Download the wp-cerber-reset.zip archive to your computer using this link: https://wpcerber.com/downloads/wp-cerber-reset.zip
- Unpack the wp-cerber folder from the archive.
- Upload the wp-cerber folder to the plugins folder of your WordPress using any FTP client or a file manager in your hosting control panel. If you see a question about overwriting files, click Yes.
- Log in to your website as usual. Now WP Cerber is disabled completely.
- Reinstall the WP Cerber plugin again. You need to do that, because WP Cerber Reset cannot work as a normal plugin.
Screenshots
- The WP Cerber dashboard provides a real-time overview of important security metrics, displays activity of WordPress users, and shows important security events.
- The activity log in WP Cerber helps website owners and WordPress administrators monitor user activity, identify potential security threats, and troubleshoot issues that may arise on the website.
- A user session management console is a tool that enables WordPress administrators to manage user sessions on their websites from a central location. It allows administrators to search for, monitor, and manage active user sessions, including the ability to view user activity and terminate user sessions.
- A list of blocked malicious IP addresses is another tool for WordPress administrators. It provides a detailed overview of all IP addresses that have been blocked by WP Cerber, including host names, countries of origin, reasons for being blocked, and the ability to unlock an IP address if necessary.
- The Main Settings tab enables you to configure login security features, brute-force protection parameters, custom WordPress login page and other important plugin settings.
- On the Hardening tab you can manage multiple access control features that block access to sensitive website data, prevent user enumeration, disable user detail exposure, restrict access to WordPress REST API, and other WordPress data interfaces that are vulnerable to bad actors and data scraping bots.
- On the Notification tab administrators configure email parameters for notifications, alerts, and reports. WP Cerber provides mobile alerts and email notifications to WordPress administrators to keep them informed about security-related events on their websites.
Installer
composer require meteorgpl-plugin/wp-cerberLes vérifications de licence de l’éditeur sont intactes : activez l’extension dans WordPress avec une clé de licence achetée auprès de l’éditeur.
Licence
L’extension ne déclare aucune licence. Le code est redistribué sous la licence que l’éditeur a déclarée dans les en-têtes de l’extension.
Les illustrations, polices, médias et documents susceptibles d’être soumis à une licence distincte ne sont pas redistribués ; la page sur les licences explique ce qui est remplacé ou supprimé, et l’onglet Sécurité le détaille par version. Le droit au support et aux mises à jour vient avec la licence que vous achetez auprès de l’éditeur.