Description
Qevix Shield is a complete WordPress security plugin for the parts of the site attackers hit first — the login form, XML-RPC, file access, and the URLs that leak information about your install. It stops brute force attacks, adds two-factor authentication and reCAPTCHA, scans for malware, and writes everything it blocks to a searchable activity log that can email you the moment something matters.
It installs neutral: activating it changes nothing about your site. Every protection stays off until you switch it on, so you enable them one at a time and see the effect of each — no surprises, no lockouts on activation. (The audit log runs from the start; that is monitoring only.)
Why Qevix Shield
- Turning it on breaks nothing. Every protection ships off. Enable them one at a time and watch what each does.
- You can’t lock yourself out. A one-line safe mode in
wp-config.phpsuspends everything without touching your settings. reCAPTCHA keys must pass a live test before they can be enabled, 2FA has recovery codes plus an admin reset, and lockouts are temporary. - One plugin, the whole checklist. Hide login URL, brute force lockouts, 2FA, reCAPTCHA, password rules, XML-RPC control, malware scanning, file and server hardening, a firewall, and an audit log — instead of five single-purpose plugins.
- You hear about it. Every block, login, and admin action lands in a live, searchable log you can export to CSV. Critical events email you as one grouped summary — an attack wave is one message, not fifty.
- No measurable slowdown. With everything enabled, response times match the deactivated site within measurement noise. Nothing waits on an external service.
- It leaves your other plugins alone. No patching or overriding another plugin’s code — WooCommerce, membership, and front-end login pages keep working, even with the hidden login URL on.
- Everything here is free. No account, no license key, no trial, no feature that expires, no greyed-out controls. The optional Pro add-on only adds capabilities of its own on top — it never unlocks something already in this plugin.
Login protection
- Hide the login page: move it off
/wp-login.phpto a custom login URL of your choosing (off by default). - Choose what a blocked request sees: a 404, your homepage, or a custom redirect.
- A honeypot field catches basic bots without affecting real visitors.
- Limit login attempts: rate-limit failed logins and temporarily lock out an IP, so a brute force run stops after a handful of tries instead of millions.
- Whitelist trusted IPs or whole CIDR ranges (IPv4 or IPv6) so they’re never rate-limited or locked out.
Two-factor authentication (2FA)
- One-time codes from any authenticator app (Google Authenticator, Authy, 1Password, and similar). Setup is per-user: scan a QR code, confirm a code.
- Recovery codes issued at setup with a one-click download, plus an admin reset — a lost phone is never a lockout.
- Require 2FA for any role you choose: an enforced user who hasn’t enrolled sees only the setup screen until they do.
- Closes the XML-RPC side door: require the code appended to the password over XML-RPC, or block XML-RPC password logins for 2FA accounts. Application passwords are unaffected.
reCAPTCHA
- Google reCAPTCHA on your login, registration, and lost-password forms — the v2 “I’m not a robot” checkbox or invisible v3 scoring, your choice.
- Covers WooCommerce’s my-account and checkout forms too, and a developer hook drops the same check into any other plugin’s form.
- v3 adds a tunable score threshold and an optional email fallback: a real person the score misjudges gets a one-time sign-in link instead of a dead end.
- A required “Test keys” step proves your keys work before the switch can be turned on — a wrong-type key would otherwise break login for everyone, including you. Fails open if Google is unreachable, so an outage never locks you out.
Password policy
- Require a minimum length and character classes (upper, lower, number, symbol).
- Block passwords that are just the account’s username or email.
XML-RPC protection
- One switch to disable all XML-RPC methods, or disable pingbacks only.
- Log every XML-RPC request with its method and whether it was allowed or blocked.
Malware scanner
- Scan WordPress core, plugins, themes, and uploads — pick any combination.
- Core files and plugins from WordPress.org are compared against their official per-file checksums, so tampering is spotted and untouched files are skipped instead of producing false alarms.
- A pattern engine flags suspicious PHP, obfuscated JavaScript, and common malware signatures in everything that can’t be checksum-verified — themes, uploads, premium plugins, and any modified file.
- Report-only: it shows what it found without changing any files.
File & server hardening
- Block direct access to sensitive files (
.env,.git,wp-config.php, and more). - Block backup and database dumps (
.sql,.bak,.tar.gz,.wpress), plus your own filenames or*.extensionpatterns. - Disable directory listing and PHP execution in uploads. Writes the Apache
.htaccessrules for you, and shows the nginx equivalent to paste. - Hide the WordPress version, REST API discovery links, and identifying server headers. Block author/user enumeration.
- A lightweight firewall blocks common SQL-injection, XSS, file-inclusion, and command-injection patterns plus known scanner user agents.
Sessions, audit log & dashboard
- Every user can see and end their own active login sessions; a password reset logs out that account’s other sessions.
- The audit log (activity log) records every login, admin action, and block with the who/what/when/where — searchable, filterable, live-updating, CSV-exportable, with a configurable retention period.
- Critical events email your administrators, grouped into one summary instead of fifty (opt-in).
- A WordPress dashboard widget shows threats blocked in the last 24 hours and recommends the next protection to switch on.
- Grant other roles manage or read-only access to Qevix Shield without full
manage_options.
Qevix Shield Pro
Qevix Shield is complete on its own, and everything above is free and stays free. The optional Pro add-on (sold at qevixlabs.com, never required) adds what happens after detection:
- Malware remediation and deeper detection — quarantine or delete infected files, dismiss reviewed findings, extra web-shell and backdoor signatures, cron-abuse and rogue-admin checks, a database scan for injected content, and scheduled daily/weekly scans.
- Breached-password protection — a privacy-preserving check against the Have I Been Pwned database of a billion leaked passwords, plus a common-password blocklist, expiration, reuse prevention, and forced resets.
- Advanced login blocking — permanent IP blacklists, user-agent filtering, and auto-blacklisting of repeat offenders.
- Multi-channel alerts — SMS, WhatsApp, Slack, Discord, and webhooks, as grouped digests routed by category and severity.
- Session & access control — an admin view of every user’s sessions with idle-timeout enforcement, plus WP-CLI commands.
- Extras — trusted devices and an emailed backup code for 2FA, and granular XML-RPC (authenticated-only, allowlist, or trusted IPs).
External services
Qevix Shield makes no external requests by default. Two optional features each contact one service, and only after you set them up:
Google reCAPTCHA — used only if you enable reCAPTCHA and enter your own Google keys. The login page then loads Google’s reCAPTCHA script, and each protected attempt sends the reCAPTCHA token, your secret key, and the visitor’s IP to Google’s verification endpoint (https://www.google.com/recaptcha/api/siteverify). The “Test keys” button also contacts Google. Provided by Google: terms, privacy policy.
WordPress.org checksums API — when you run a malware scan, the plugin fetches official checksums so it can tell genuine files from modified ones. For the core scope it calls WordPress core’s own get_core_checksums(), which contacts api.wordpress.org and sends only your WordPress version and locale. For the plugins scope it fetches each installed plugin’s public per-file manifest from https://downloads.wordpress.org/plugin-checksums/<slug>/<version>.json; the request carries only the plugin slug and version in the URL, results are cached for seven days, and plugins that have no manifest (premium or custom) are simply scanned in full. Both are provided by WordPress.org: privacy policy.
Built-in alerts are sent by email through your site’s own mail configuration — no third party is contacted. The other alert channels (Slack, Discord, webhooks, SMS, WhatsApp) and the Have I Been Pwned check belong to the separate Qevix Shield Pro add-on; this free plugin never contacts them. No other data leaves your site — audit logs, lockout records, 2FA secrets, and settings live only in your own database.
Screenshots
/wp-login.php and choose what a blocked request sees — a 404, your homepage, or a custom redirect.
/wp-admin/ returns a plain 404 to logged-out visitors — no login form to find, and no hint that one exists.
.env, wp-config.php, dotfiles, backups and database dumps — with your own additions to the list.
Installation
- Upload the
qevix-shieldfolder to/wp-content/plugins/, or install it from the Plugins screen. - Activate the plugin.
- Open Qevix Shield Settings and switch on the protections you want, one at a time.
FAQ
-
Is everything really free?
-
Yes. Every feature on this page works the day you install it — no account, no license key, no trial, no expiry, and no greyed-out settings. The separate Pro add-on adds its own extra capabilities on top; it never unlocks anything already in this plugin.
-
Do I need to configure anything after activating?
-
Only what you want. Qevix Shield installs neutral — activation changes nothing about your site. You switch on each protection deliberately from its settings tab, so you always know what’s active and why. (The audit log starts monitoring right away, but it doesn’t alter your site.)
-
Will it slow down my site?
-
No measurable difference. With every protection enabled, response times match the same site with the plugin deactivated, within measurement noise. There is no external service your visitors wait on.
-
Will it lock me out of my own site?
-
It’s built not to. Rate limiting and IP lockouts only apply to failed logins and are temporary; add your own IP to the whitelist to be certain. Login-URL hiding is off by default — if you enable it, bookmark the new address first. And there’s always the recovery switch below.
-
I’ve locked myself out. How do I recover?
-
Add this one line to
wp-config.php:define( 'QEVIX_SHIELD_SAFE_MODE', true );It suspends every Qevix Shield protection without changing any of your settings, so you can log in and fix things, then remove the line. It works even when you can’t reach the dashboard, because
wp-config.phploads before the plugin. (One exception: server rules already written to.htaccess/nginx are enforced by the web server — edit that block out by hand if you enabled them.) -
Does it work with WooCommerce and plugins that have their own login pages?
-
Yes. WooCommerce, membership and LMS plugins, and page-builder login widgets keep working, including with the hidden login URL on — they use their own pages, not
wp-login.php. -
I use the Pro add-on. Do the versions need to match?
-
They release together with the same version number, and matching is the supported pairing. If they drift, nothing breaks: Pro shows a notice telling you which side to update.
Reviews
Contributors & Developers
“Qevix Shield – 2FA, Hide Admin, Firewall/File Security & Malware Scan” is open source software. The following people have contributed to this plugin.
Contributors
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.3
- The Audit Log now names each event in plain English — “Signed in”, “Idle session ended”, “Sensitive file blocked — .env” — instead of the internal key it was stored under. The key is still shown under the name, because that is what the search box and the CSV export match on.
- Severity and outcome are now shown the same way on every screen: a coloured Severity badge and a tinted Status word, matching the Dashboard’s activity list. The Module column reads “File Security” rather than “file_security”.
- Fixed: the WordPress Dashboard widget stopped recommending the firewall, the login honeypot and sensitive-file blocking as soon as those switches were on, even when the File Security or Login Protection master switch was off and none of them could run. The recommendation now stands until the protection is actually active — the same test the Security Score already used.
- Fixed: the Password Policy Status card could read “Strong” while the Password Security master switch was off and no rule was being applied. Rules now count only when they are actually enforced.
- Fixed: four settings accepted a number the save then silently replaced with the default — password expiry (max 3650 days), expiry warning (365), permanent block after N lockouts (100) and trusted device days (365). Each field now states its limit, so an out-of-range value is caught as you type.
- Fixed: on the Two-Factor Auth screen, “XML-RPC logins”, “Trust device for” and “Email fallback” stayed editable while two-factor was switched off, although none of them acted. They are now greyed out with the rest of the policy, and the screen says plainly that nothing is enforced while the switch is off.
- The Login Protection status pill no longer reads “Enforcing” when the master switch is on but neither the honeypot nor rate limiting is enabled; the screen now says so and points at what to turn on.
- The rate-limiting example under the switch now quotes your own thresholds instead of the defaults, which contradicted the numbers in the boxes directly beneath it.
- Empty cells in the audit and session tables show an em dash rather than a blank, so an event recorded without a user or an address no longer looks like missing data.
- Fixed: the Malware Scanner and Two-Factor Auth screens repeated the same HTML element id on every form they render, which makes the page invalid and leaves scripts and assistive technology picking whichever form happened to come first. Each form now carries its own. Nothing about how a form is submitted or checked has changed.
- No settings were added, removed, renamed or re-defaulted, and no protection behaves differently.
1.1.2
- Fixed: the “Enable 2FA” master switch now turns two-factor authentication off completely. Previously a user who had enrolled was still asked for a code at login even with the switch off, because it only controlled whether enrolment was mandatory. It now behaves like every other tab’s master switch — off means nothing is enforced.
- Enrolments are kept when the switch is off, so turning it back on restores every user’s second factor with no need to re-enrol. Users can still enrol or un-enrol their own account either way.
1.1.1
- Now runs on WordPress 6.5 and PHP 7.2, down from WordPress 6.8 and PHP 8.1. Nothing else changed: no setting was added, removed, renamed or re-defaulted, and no protection behaves differently.
1.1.0
- Redesigned every admin screen: a header band naming the open section, one row of section pills in place of the old tab strip, and settings grouped into cards with two columns where a screen holds two separate decisions.
- Switches replaced the plain checkboxes on every on/off setting, and each screen now shows a live status pill (“Enforcing”, “Login hidden”, “Alerts silent”) reading the setting’s real state.
- A setting that cannot act while another is off is now greyed out until the setting it depends on is switched on, all the way down a chain.
- Fixed: on the reCAPTCHA screen the Site Key, Secret Key, Version and “Test keys” button no longer grey out while reCAPTCHA is off. reCAPTCHA cannot be switched on until the keys pass that test, so greying the test out left no way to run it.
- Fixed: “Test keys” with v2 keys could report that the checkbox had loaded without ever drawing one, leaving the test impossible to finish. The test now waits for Google’s script to finish loading before drawing the checkbox.
- Notices moved to one place on every screen — directly under the header, above the section pills — instead of appearing wherever the setting that raised them happened to sit.
- Two-factor recovery codes now sit in the card for your own account, above the button that issues them, rather than as a message at the top of the screen. Between issues, that card reports how many of your codes are still unused.
- The Audit Log is a screen of its own rather than a Settings section: it holds no settings, it is a record.
- The Sessions list is now one shared table, so every screen that lists logins shows the same columns.
- The login-hiding screen is now called “Hide Login” everywhere — the section bar, the screen heading and the documentation previously disagreed.
- No settings were added, removed, renamed or re-defaulted. Your saved configuration carries over untouched.
1.0.0
- Initial release.