Documentation

Getting started

1. Install and activate Coxwall from Plugins → Add New.
2. Open Coxwall in the admin menu and follow the five-step setup wizard.
3. To upgrade, open Coxwall → License, sign in with your Coxwall account or paste your license key.

How do I upgrade to Pro?

1. Install Coxwall Free. From Plugins → Add New. The five-step wizard turns on the firewall, scanner and login protection in about three minutes.
2. Choose a Pro plan. Your key arrives in the order email and under My Account → Coxwall licenses the moment payment is confirmed.
3. Pro installs itself. In Coxwall → License, sign in or paste the key. The site activates, installs Pro and unlocks every Pro screen — settings and logs are kept.

What are the requirements?

• WordPress 6.6 or newer (tested up to 6.8).
• PHP 7.4 or newer.
• A writable wp-content folder for the firewall configuration and the must-use loader. If it is read-only, nothing breaks — the plugin explains what it could not set up.

What if I lock myself out?

Add one of these to wp-config.php (or create the file) to stand the protection down:

• define( 'COXWALL_DISABLE_WAF', true ); — Turns the firewall off.
• define( 'COXWALL_DISABLE_LOGIN_SLUG', true ); — Restores the default wp-login.php URL.
• define( 'COXWALL_LOCKDOWN_OFF', true ); — Ends a Pro emergency lockdown.
• wp-content/coxwall/waf-off — Empty file that stands the firewall down when Extended protection runs it before wp-config.php.

Which external services does it contact?

WordPress.org (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org)

To download official checksums and original files for integrity checks and repairs. No personal data is sent; only your WordPress, plugin and theme versions.

Have I Been Pwned (api.pwnedpasswords.com)

When the breached-password check is on (Password security), Coxwall sends the first 5 characters of the password's SHA-1 hash, never the password, and compares the returned list locally. Turn it off under Coxwall → Password security.

CAPTCHA providers

Only if you choose one instead of the built-in CAPTCHA under Coxwall → Form protection: Cloudflare Turnstile (challenges.cloudflare.com), hCaptcha (hcaptcha.com) or Google reCAPTCHA (google.com/recaptcha). The visitor's browser loads the provider's script and Coxwall sends the response token and visitor IP to the provider to verify it.

Notification channels

Only those you configure under Coxwall → Notifications: Slack (hooks.slack.com), Telegram (api.telegram.org) or your own webhook URL. Alerts contain the event description, time, IP address and user name involved.

Coxwall license server (coxwall.com)

Only if you activate a Pro license. Sends your site URL, a random per-install identifier, WordPress/PHP/plugin versions and, for vulnerability checks, the list of installed plugin and theme versions.

What do the 17 scan stages check?

1. WordPress core
2. Plugins
3. Themes
4. Uploads
5. Database
6. Backdoors
7. Malware signatures
8. Virus patterns
9. Cron jobs
10. Scheduled tasks
11. DB injection
12. Spam links
13. SEO spam
14. Redirects
15. Hidden files
16. PHP shells
17. JavaScript malware

Which 20 hardening checks are included?

• Block PHP execution in /uploads
• Coxwall data folder private
• Disable directory listing
• Protect wp-config, readme and log files
• Correct wp-config.php permissions
• wp-config.php above the web root
• Hide PHP errors from visitors
• Disable file editing in wp-admin
• Disable XML-RPC
• Disable pingbacks
• Hide the WordPress version
• Security response headers
• Disable REST user enumeration
• Site served over HTTPS
• Safe default role for new users
• No account named "admin"
• Database table prefix
• Automatic security releases
• Plugins, themes and core up to date
• Supported PHP version