If you are looking for a WordPress security plugin that won’t make you lose an afternoon in screens full of options, that is why we wrote Cisilino Site Defense Network. You activate it and it gets to work. You switch on the rest when you need it.
A WordPress site is targeted long before it becomes important. Bots trying passwords on wp-login.php, scripts hunting for forgotten files, stolen accounts used to publish spam. Everyday stuff, not movie-style attacks.
What the plugin does
The core of this WordPress security plugin is login defence. When an IP address goes over the threshold of failed attempts, it is blocked with a rule in the .htaccess file. Around that there is an activity log, an integrity check of the plugin’s own files, upload monitoring, a few optional hardening switches, limits on people who publish or comment too much, and a policy for creating users.
Every feature has its own article, you will find them at the bottom of this page.
It works even without configuring it
As soon as it is activated, this WordPress security plugin detects failed logins and blocks locally. It makes no external call. The hardening options and HTTP headers stay off until you turn them on. Each one explains what it does and what it can break.
Protecting several sites together
Anyone who manages many sites knows that the same hostile IP tries them one after the other. By connecting this WordPress security plugin to a Cisilino panel, an address seen failing on one site is blocked on the others too. Without a panel, everything stays on the single site.
Compatibility: PHP and WordPress versions
This WordPress security plugin runs within the following requirements:
- WordPress: 5.8 and later, tested up to 7.1.
- PHP: 7.4 and later, also used on PHP 8.5.
- Web server: Apache 2.4 (or 2.2) and LiteSpeed in compatible mode for blocking IPs in
.htaccess. On nginx the plugin detects attacks but cannot write the rule at server level.
The limits of this WordPress security plugin, stated upfront
IP blocking writes to .htaccess. You need Apache or LiteSpeed in compatible mode. On nginx this WordPress security plugin detects but cannot block at server level. The integrity check reports tampering, it does not prevent it. And it is not an antivirus: updates, backups and strong passwords are still necessary.
If you deactivate it, the rules written in .htaccess are removed. When you reactivate it, everything is back as it was.
Download the plugin from WordPress.org: the official page is where you will find the current release.
Frequently asked questions
Does the plugin work without configuration?
Yes. As soon as it is activated it detects failed logins and blocks the IPs that go over the threshold. It works locally only, with no external calls.
Does it work on nginx hosting?
IP blocking requires Apache or LiteSpeed in compatible mode, because it writes to .htaccess. On nginx detection stays active, server-level blocking does not.
Does a WordPress security plugin replace an antivirus?
No. It reduces the most common risks but does not replace updates, backups and strong passwords.
Leave a Reply