Features

Security dashboard

See your security posture, attacks blocked and what to fix next on one screen.

A posture score built from every protection domain, the day's blocked attacks, failed logins, file changes, an attack timeline, a live threat feed and quick actions.

Hardening checklist

Close common WordPress weak spots with safe one-click fixes.

20 checks — PHP execution in uploads, directory listing, wp-config permissions, file editing, XML-RPC, REST user enumeration, HTTPS, the "admin" username, update settings and more — each tested on your server and fixable in one click where it is safe to do so.

Setup wizard

Five steps, about three minutes, and the site is protected.

A guided first-run wizard that turns on the firewall, runs the first scan and sets up login protection and notifications. You can leave and come back.

Security tools

One-off fixes: fresh keys, a safer admin username, permissions and leftovers.

Rotate WordPress salts, rename an "admin" account, fix file permissions, clean up leftover and exposed files, sign everyone out and set an idle-session timeout.

Security scan

A 17-stage scan for malware, backdoors and tampering.

Checks WordPress core and plugin checksums, unexpected PHP in uploads, hidden files, backdoor and web-shell heuristics (45 local signatures), database injections, spam links and malicious redirects across 17 stages, with results you can repair, ignore or quarantine.

Malware scanner

Find backdoors, web shells and injected code with signatures updated hourly from the Coxwall network.

• Cloud signature set. Malware signatures maintained by the Coxwall team and delivered to your site from the Coxwall server, refreshed hourly.
• Deep heuristic scan. Detects obfuscated eval chains, base64/gzinflate droppers and polymorphic shells that a checksum scan cannot see.
• Quarantine vault. Neutralise infected files in one click and restore them for 90 days if something was a false positive.

File integrity monitoring

Know exactly which core, plugin and theme files changed.

Fingerprints every core, plugin and theme file, compares them with the official WordPress originals, shows side-by-side diffs and restores the original in one click.

Vulnerability monitoring

Know the moment a plugin, theme or core version you run gets a public CVE — and patch it virtually before you can update.

• Live vulnerability database. Every installed component checked against the Coxwall vulnerability feed daily.
• Virtual patching. Firewall rules that block the exploit path while you wait for a vendor fix.
• Instant alerts. Critical CVEs reach you by email, Slack or webhook within minutes of disclosure.

Auto-patching

Automatically update plugins and themes the moment a security fix for a known vulnerability is released.

• Security-only auto-updates. Only components with known vulnerabilities are updated automatically, with a safety snapshot first.
• Health check & rollback. If the site breaks after an update, Coxwall rolls it back and tells you.

Scheduled scans

Hands-off scanning on your timetable, with results waiting in your inbox.

• Flexible schedules. Hourly, daily or weekly quick and full scans, run in low-traffic hours.
• Digest emails. A summary after every run; critical findings skip the queue.

Web application firewall

Blocks attacks before WordPress even loads.

A firewall that runs before WordPress with a curated set of 29 rules against SQL injection, XSS, path traversal, file probing, XML-RPC abuse, user enumeration and known attack tools. Learning mode lets you watch before you block. Typically about a millisecond per request.

Custom firewall rules

Write your own firewall rules from conditions on URL, query, user agent, country, IP, method, referer and body — and dry-run them against last week's traffic before they go live.

• Visual rule builder. Combine conditions with contains, is, starts with and regex operators. No code.
• Dry run before enabling. See exactly how many requests and signed-in visitors a rule would have hit in the last 7 days.
• Block, challenge, throttle or log. Pick how strict each rule is, and start in log-only mode.

Rate limiting

Throttle scrapers, credential stuffers and aggressive crawlers without slowing real visitors.

• Per-endpoint limits. Separate budgets for login, XML-RPC, REST API, search and 404s.
• Automatic temporary blocks. Repeat offenders are blocked for a configurable period, then released.

Bot protection

Stop fake Googlebots, vulnerability scanners and content scrapers while verified crawlers pass untouched.

• Crawler verification. Reverse-DNS verification of Google, Bing, Apple and other search bots.
• Bad-bot signatures. Known scanner and scraper fingerprints from the Coxwall network.

Country blocking

Block or allow whole countries before WordPress even loads.

• GeoIP database included. Updated weekly from Coxwall — no MaxMind account needed.
• Login-only mode. Keep your shop open worldwide but allow wp-admin from your own countries only.

Cloud protection

Block IPs flagged by the Coxwall reputation feed and push blocks to your CDN edge.

• Network IP reputation. IPs attacking any Coxwall site are blocked on yours before they try.
• Cloudflare edge sync. Blocked IPs are pushed to your Cloudflare firewall so attacks never reach your server.

Form protection

Stop bots on login, sign-up, comments and WooCommerce forms.

A built-in proof-of-work CAPTCHA with no third party, or Cloudflare Turnstile, hCaptcha or reCAPTCHA, on login, registration, lost password, comments and WooCommerce forms. Blocks 8,883 disposable and temporary email domains at sign-up.

Security headers

Content-Security-Policy builder with report-only testing, plus every modern browser hardening header.

• CSP builder. Start in report-only mode, see what would break, then enforce.
• Violation reports. Browser reports collected and grouped so you can spot injected scripts.

Emergency lockdown

One switch during an incident: freeze logins, file changes and admin access until you are safe.

• Instant lockdown. Signs out everyone else, blocks new logins except your allowlist, and freezes plugin and theme changes.
• Admin area allowlist. Restrict wp-admin to your own IPs or countries any day, not just during incidents.

Live traffic

Watch every request the firewall sees in real time, with one-click blocking.

• Real-time stream. IP, country, URL, user agent, rule matched and response time for every request.
• Full log history. Search and export up to 90 days of events (Free keeps 24 hours).

Security logs (24 hours)

Every firewall event from the last 24 hours.

The Free plugin keeps the last 24 hours of firewall events so you can see what was blocked and why. Pro keeps up to 90 days.

Threat intel

See what attackers are doing across the Coxwall network and which of it targets you.

• Attack campaigns. Active campaigns, their targets and whether your site is exposed.
• Reputation lookups. Score any IP against the network before you allow it.

Reports

Client-ready security reports, emailed weekly or monthly.

• White-label PDF/HTML. Your logo, your colours, the numbers your clients care about.
• Scheduled delivery. Weekly summaries, incident reports and compliance packs.

Login security & 2FA

Two-factor authentication and a hidden login URL.

TOTP two-factor authentication with backup codes, per-role 2FA requirements, a custom login URL, generic login errors and user-enumeration blocking.

Brute-force protection

Lock out password guessers on every login endpoint.

Lockouts with escalation for repeat offenders, covering wp-login.php, XML-RPC and REST API authentication.

Passwordless login

Sign in with an email link, a one-time code or a passkey.

Magic-link and one-time-code sign-in on wp-login.php with a method switcher. Links are single-use, signed and bound to the browser that asked for them, and every method still passes 2FA, risk checks and brute-force limits.

Passkeys (WebAuthn)

Face ID, Touch ID, Windows Hello or a security key instead of passwords.

Sign in with Face ID, Touch ID, Windows Hello, a phone or a security key, as a second factor or instead of the password, with per-role requirements and a self-service profile screen.

Verification & OTP

One-time codes by email, SMS, WhatsApp and Telegram.

Email, SMS and WhatsApp one-time codes (6 digits, 10 minutes, single use, 5 attempts, stored only as a keyed hash), phone number verification with disposable-number blocking, verified email and phone changes, and Telegram and Truecaller sign-in.

Risk-based authentication

Score every sign-in and challenge only the risky ones.

Risk scoring, new-device verification, VPN/proxy/Tor detection, country login rules, session-hijacking protection, secure account recovery, login alerts with a "this wasn't me" button and per-user login history.

Signup protection

Keep fake and duplicate accounts out of your site.

Mandatory email verification, email domain block and allow lists, fake-account prevention (honeypot, time trap, risk), signup rate limits, IP-based signup blocking and duplicate-account detection.

Password security

Strong, unbreached passwords for every role.

Per-role strength policy with a built-in estimator, breached-password check through Have I Been Pwned (k-anonymity — the password never leaves your server), expiry, reuse prevention and forced resets.

User audit

Find dormant admins, risky roles and accounts that should not exist.

• Privilege review. Every account with admin-level capabilities, its 2FA status and last login.
• Dormant accounts. Flags and optionally demotes admins who have not logged in for months.

IP manager

Block or allow addresses and ranges, with expiry.

Block and allow lists for single IPs and IPv4/IPv6 CIDR ranges, with reasons and automatic expiry. Coxwall refuses to block your own address.

Active sessions

See who is signed in, where, and sign anyone out.

Every signed-in user with device and IP address, one-click revoke, idle timeout, per-role session limits and sign-out on password change.

Audit log

Who changed what, and when.

Records logins, user, plugin, theme and settings changes so you can trace any change on the site.

Notifications

Security alerts by email, Slack, webhook or Telegram.

Alerts by email, Slack, signed webhook or Telegram, with per-channel severity, quiet hours, an hourly digest and a weekly summary.

SMS & messaging gateways

15 built-in gateways for SMS, WhatsApp and Telegram codes.

Delivers verification codes and security notices through Twilio, WhatsApp Cloud API, Infobip, MSG91, Fast2SMS, SSL Wireless, BulkSMSBD, Alpha SMS, Greenweb, Veevo Tech, SendPK, Lifetimesms, Telenor Corporate SMS, Telegram Bot API and Custom HTTP, with per-country routes, fallbacks, abuse limits and encrypted credentials.

Uptime & blocklist monitoring

Coxwall checks your site from outside every few minutes and watches blocklists, SSL and DNS.

• External uptime checks. Alerts when your site is down, slow, or suddenly serving injected content.
• Blocklist & SSL watch. Know before Google, browsers or email providers flag your domain, and before certificates expire.

Backups

Verified database and file backups you can restore in one click after an incident.

• Scheduled backups. Database and files, compressed and stored outside the web root.
• Restore points. Roll back to any snapshot after a compromise.

Performance

See exactly what security costs you per request, and tune it.

• Overhead profiling. Firewall and scanner cost measured on your real traffic.
• Tuning advice. Specific changes that cut overhead without lowering protection.

Diagnostics

See exactly what your server supports and what needs attention.

Checks PHP version and limits, HTTPS, loopback requests, WP-Cron, REST API reachability and write access to the Coxwall data folder, and explains how to fix anything that fails.