وضاحت
Vardalion Security is a security plugin for WordPress that monitors suspicious behaviour, assigns threat scores and can automatically block hostile IP addresses.
The free Core plugin includes:
- Request inspection for common exploit and malicious-request patterns.
- Brute-force and authentication protection.
- User-enumeration and REST user-endpoint protection.
- Login request rate limiting.
- Bot and security-scanner detection.
- Threat scoring with configurable automatic IP blocking.
- Repeat-offender escalation and optional permanent blocking.
- Manual IP and CIDR network blocking with lockout-safety checks.
- Subnet intelligence and administrator-reviewed network recommendations.
- Security event logging, filtering and CSV export.
- High-severity email alerts.
- Emergency Mode for recovering from an enforcement configuration problem.
- WordPress core-file checksum verification for protected wp-admin PHP paths.
- Trusted-proxy and Cloudflare-origin handling controls.
Vardalion Security Core is permanently free. It does not expire, require a licence key, or unlock included functionality after payment.
An optional separately distributed Vardalion Security Pro companion plugin can extend Core with additional commercial functionality. Pro code, licensing and update delivery are not included in the WordPress.org Core plugin.
Privacy
Vardalion Security is a security plugin and may process information that can be personal data, including IP addresses and user-agent strings.
Core security data is stored locally in the WordPress database. Administrators control the configured log-retention period and can manually remove blocks.
Vardalion Security Core does not send security logs or visitor telemetry to Vince Web Design.
Vardalion Security also supplies suggested privacy-policy text to WordPress under Settings > Privacy > Policy Guide so site administrators can adapt the disclosure to their own site.
For core-file integrity verification, Vardalion Security periodically requests the official checksum list from WordPress.org using the site’s installed WordPress version and locale. See the external service disclosure in the FAQ above.
انسٽاليشن
- Upload the
wp-aegisfolder to/wp-content/plugins/, or install Vardalion Security through the WordPress Plugins screen. - Activate Vardalion Security.
- Open Vardalion Security > Security Settings.
- Review the default threat threshold, authentication protection, trusted proxy configuration and alert email.
- If the site is behind a reverse proxy or CDN, configure trusted proxy ranges before relying on forwarded client-IP headers.
- Review Vardalion Security > Security Log and IP Intelligence after the plugin has observed normal site traffic.
FAQ
-
Does Vardalion Security Core require a licence or paid account?
-
No. Vardalion Security Core is permanently free and its included functionality does not expire.
-
Does Vardalion Security send my security logs to Vince Web Design?
-
No. Core security logs and blocking data are stored in your WordPress database. Vardalion Security Core does not send those logs to Vince Web Design.
-
Does Vardalion Security contact any external service?
-
Vardalion Security retrieves official WordPress core checksums from the WordPress.org checksum API when its core-file integrity cache needs to be refreshed. The request includes the installed WordPress version and locale so the correct official checksum set can be returned.
Service: WordPress.org Core Checksums API
Service URL: https://api.wordpress.org/core/checksums/1.0/
WordPress.org privacy policy: https://wordpress.org/about/privacy/The documentation button opens the Vardalion Security documentation website only when an administrator clicks it. Core does not transmit security telemetry to that site.
Documentation: https://vinceweb.co.uk/wp-aegis/documentation/
-
What information does Vardalion Security store?
-
Vardalion Security can store security event details such as IP address, request path, HTTP method, user agent, rule identifier, threat points and event context. It also stores active and historical block information needed for enforcement and repeat-offender escalation.
Administrators can configure security-log retention. Data should be handled according to the site’s own privacy and retention obligations.
-
Can Vardalion Security lock me out of wp-admin?
-
Security software can cause access problems if network or proxy settings are configured incorrectly. Vardalion Security includes Emergency Mode. If wp-admin is inaccessible, an administrator with file access can define
WPAEGIS_EMERGENCY_DISABLEastrueinwp-config.phpto bypass active enforcement while retaining logging. -
Does Vardalion Security block whole networks automatically?
-
Core provides subnet intelligence and recommendations, but network-range blocks require administrator approval. Automatic subnet blocking is not part of Core.
-
What is Vardalion Security Pro?
-
Vardalion Security Pro is an optional companion plugin distributed separately by Vince Web Design. It extends Core with commercial modules. Vardalion Security Core remains fully functional without Pro.
جائزا
ھن پلگ ان لاءِ ڪي به رايا ناھن.
تعاون ڪندڙ & ڊولپرز
“Vardalion Security” اوپن سورس سافٽ ويئر آهي. ھيٺين ماڻھن ھن پلگ ان ۾ حصو ورتو آھي.
تعاون ڪندڙ
ترجمو ڪريو “Vardalion Security” توهان جي ٻولي ۾.
ڊولپمينٽ ۾ دلچسپي؟
ڪوڊ براؤز ڪريو، چيڪ ڪريو SVN مخزن، يا رڪنيت حاصل ڪريو ڊولپمينٽ لاگ پاران RSS.
لاگ تبدیل ڪريو
2.2.7
- Replaced the final dynamic cursor comparison expression in event-log export queries with fixed prepared SQL branches.
- Resolves the remaining Plugin Check PreparedSQL errors without suppressing them.
2.2.6
- Corrected event-log prepared-query placeholder handling identified by the full WordPress Plugin Check.
- Prepared each dynamic filter value while building the validated WHERE fragment.
- Replaced dynamic ORDER BY interpolation with fixed ASC/DESC query branches.
- Passed pagination and export limits as individual prepared-query replacement arguments.
2.2.5
- Refactored filtered event-log queries so prepared SQL is passed directly to WordPress database methods.
- Removed intermediate
$sqland$preparedvariables flagged by Plugin Check. - Kept validated filter grammar and prepared external values while preserving real-time uncached security-log reads.
2.2.4
- Converted the final threat-score and expired-block table identifiers to WordPress
%iplaceholders. - Documented the remaining intentional uncached audit-log reads for Plugin Check.
- Completed the final full Plugin Check warning-remediation pass.
2.2.3
- Reworked dynamic security-table queries to use WordPress
%iidentifier placeholders. - Documented intentional uncached direct database access used for real-time security enforcement and audit logging.
- Documented uninstall-only schema removal for plugin-owned tables.
- Further reduced full Plugin Check warnings without changing existing security behaviour.
2.2.2
- Hardened Plugin Check compliance for translation placeholders, request sanitization and database-query validation.
- Removed the explicit close of the streamed CSV output handle.
- Prepared dynamic database identifiers using WordPress
%iidentifier placeholders where applicable. - Documented intentional read-only GET handling and security-table database access for code-quality analysis.
2.2.1
- Renamed the public plugin identity to Vardalion Security and requested the WordPress.org slug
vardalion-security. - Updated the Vardalion Security logo and visible branding.
- Moved standalone firewall response CSS to an enqueued stylesheet.
- Removed the unnecessary
load_plugin_textdomain()call for WordPress.org distribution. - Preserved existing
wpaegis_*hooks, settings, database tables and extension APIs for legacy migration compatibility.
2.2.0
- Split Vardalion Security into a permanently free Core plugin with a stable extension API for optional companion plugins.
- Removed commercial licence, trial and external executable updater code from Core.
- Kept firewall inspection, threat scoring, brute-force protection, bot detection, IP blocking, repeat-offender escalation, logging and recovery in Core.
- Kept manual CIDR network blocking and subnet intelligence in Core while leaving automatic subnet enforcement to companion extensions.
- Added WordPress.org-focused documentation, privacy and external-service disclosures.
- Corrected Core maintenance health checks so they no longer expect Pro-only scheduled tasks.
- Removed stale licensing and updater-development references from the Core administration UI.
- Added a restrained Core-to-Pro comparison screen and dashboard link that disappear automatically when Pro is active.
- Added a prominent Upgrade to Pro button to the main Vardalion Security dashboard when Pro is not installed.
- Improved compatibility with standard WordPress/third-party admin notices so notice text remains readable on Vardalion Security screens.
- Corrected the Pro comparison page layout so the comparison table displays vertically at full admin-page width.
- Removed a false maintenance warning for an obsolete wpaegis_reputation_sweep schedule.