Title: Liveupx Security Author: Liveupx Published: 9 ژانویه 2026 Last modified: 4 آگوست 2026 --- جستجوی افزونه‌ها ![](https://ps.w.org/liveupx-security/assets/banner-772x250.png?rev=3447278) ![](https://ps.w.org/liveupx-security/assets/icon.svg?rev=3447278) # Liveupx Security توسط [Liveupx](https://profiles.wordpress.org/liveupx/) [دانلود](https://downloads.wordpress.org/plugin/liveupx-security.4.0.2.zip) * [جزئیات](https://fa.wordpress.org/plugins/liveupx-security/#description) * [نقد و بررسی‌ها](https://fa.wordpress.org/plugins/liveupx-security/#reviews) * [نصب](https://fa.wordpress.org/plugins/liveupx-security/#installation) * [توسعه](https://fa.wordpress.org/plugins/liveupx-security/#developers) [پشتیبانی](https://wordpress.org/support/plugin/liveupx-security/) ## توضیحات Liveupx Security is a complete, 100% free WordPress security plugin that rivals paid solutions. No paywalls, ever. #### Core Features **Login Security** * Brute force protection with progressive lockouts (1st/2nd/ 3rd+ strikes escalate automatically) * Multi-provider CAPTCHA: Math, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile * Honeypot bot detection (wp-login.php + WooCommerce)* Passwordless magic link login * Two-factor authentication: TOTP (Google Authenticator) + Email OTP * Trusted device (30-day bypass cookie) * Geolocation login alerts — notify when login comes from a new country * Subnet auto-blocking (repeated attacks from /24 range) * Custom login URL (hide wp-login.php) **Firewall / WAF** * PHP-based Web Application Firewall running at priority 1 * Remote WAF rule feed (auto-updated from liveupx.com) * Admin-defined custom firewall rules * Per-endpoint rate limiting (REST API, checkout, search, etc.) * REST API security controls (block guests, hide /users endpoint) * Country/geo blocking with API fallback chain * Bad bot blocking with verified bot allowlist (Google, Bing, etc.) * Referrer blocking with spam referrer presets * Bad query/XSS/SQL injection blocking * .htaccess security rules **Malware Scanner** * Chunked AJAX scanner — scans plugins, themes, uploads, mu- plugins * 30+ malware patterns including backdoors, crypto miners, shell injections* Heuristic risk scoring (0–100) per suspicious file * Auto-quarantine critical findings during scan * Scan diff — shows new threats vs last scan * Database malware scanner( posts, options, comments, users) * File quarantine and permanent delete **Vulnerability Scanner** * Powered by WPScan API (free tier) * Scans all active plugins and active theme for known CVEs * CVSS severity scoring (Critical/High/Medium/ Low) * Dashboard widget showing unresolved critical/high count * Dedicated Vulnerabilities admin page **File Integrity** * WordPress core file integrity check (vs WordPress.org checksums API) * Plugin & theme checksum verification (vs WordPress.org checksums) * wp-config. php and .htaccess tampering detection * Unknown PHP file detection in core directories **Core File Repair** * Downloads clean copies from WordPress.org SVN * MD5 verification before writing * Single file or bulk repair **Security Headers** * X-Frame-Options, X-Content-Type-Options, X-XSS-Protection* Referrer-Policy, Permissions-Policy (per-feature builder) * HSTS with preload support* Content-Security-Policy with visual builder * CSP violation reporting endpoint ( REST API) * A–F letter grade for your header configuration **User Security** * User enumeration protection (?author= + REST API) * Strong password enforcement * Block dangerous usernames (admin, root, etc.) * Inactive user auto-lock (configurable threshold) * Admin action audit trail * Active session manager (view & revoke) * GDPR IP anonymization **Post-Hack Recovery** * Lock PHP execution in uploads and wp-includes * Log out all users instantly * Force password reset for all users * Reinstall free plugins from WordPress.org * Delete version-revealing files (readme.html, etc.) * Weekly security summary email report **Monitoring & Notifications** * Activity log (filterable, paginated, CSV export, configurable retention) * HTML branded email alerts * Slack/webhook notifications( compatible with Make.com, Zapier, Discord) * Real-time dashboard stats (auto-refresh every 30s) * 7-day login attempt chart **Developer Tools** * WP-CLI commands (wp xsec status|scan|block-ip|unblock-ip| 2fa-reset|export-settings|import-settings) * Settings import/export (JSON) * Security score with category breakdown Developed by [Liveupx.com](https://liveupx.com) Cloud hosting partner: [xHost](https://xhost.live)— by Liveupx.com [Featured on JustHunt.co](https://justhunt.co/startups/x-security) ## عکس‌های صفحه [[ [[ [[ [[ [[ [[ ## نصب 1. Upload the plugin files to `/wp-content/plugins/liveupx-security` 2. Activate the plugin through the ‘Plugins’ screen 3. Navigate to **Liveupx Security** in the admin menu 4. Review your security score and enable recommended features ## سوالات متداول ### Is this plugin really 100% free? Yes. All features are free forever. No premium tier, no feature paywalls, no upsells. ### Will it conflict with other security plugins? It’s designed to work standalone. Deactivate conflicting security plugins (Wordfence, iThemes) before using. ### Does it support WooCommerce? Yes — honeypot and CAPTCHA protection apply to WooCommerce login forms. ### Does it support multisite? Basic multisite support in v4.0.0. Network-wide management is planned for v5. ## نقد و بررسی‌ها نقد و بررسی‌ای برای این افزونه یافت نشد. ## توسعه دهندگان و همکاران “Liveupx Security” نرم افزار متن باز است. افراد زیر در این افزونه مشارکت کرده‌اند. مشارکت کنندگان * [ Liveupx ](https://profiles.wordpress.org/liveupx/) [ترجمه “Liveupx Security” به زبان شما.](https://translate.wordpress.org/projects/wp-plugins/liveupx-security) ### علاقه‌ مند به توسعه هستید؟ [کد را مرور کنید](https://plugins.trac.wordpress.org/browser/liveupx-security/)، [مخزن SVN](https://plugins.svn.wordpress.org/liveupx-security/) را بررسی کنید، یا از طریق [RSS](https://plugins.trac.wordpress.org/log/liveupx-security/?limit=100&mode=stop_on_copy&format=rss) در [گزارش توسعه](https://plugins.trac.wordpress.org/log/liveupx-security/) مشترک شوید. ## گزارش تغییرات #### 4.0.2 * FIX: Malware scanner no longer scans its own plugin directory — the signature list itself was being matched, so the scanner reported its own files as a critical backdoor * FIX: Detection signatures are no longer stored as plain literals, so other security plugins stop flagging Liveupx Security as malware * NEW: Whitelist — “Mark as safe” on any scan result. Entries are bound to a SHA- 256 hash, so a whitelisted file that is later modified is scanned again automatically * NEW: “Files Marked as Safe” management table on the Malware Scanner page * NEW: Excluded paths setting (one glob per line, relative to wp-content) * NEW: Configurable reporting threshold (10-100, default 50) * ENHANCE: Confidence-based reporting. Patterns are now classified as definitive( known backdoor signatures — always reported) or suspicious (legitimate code uses them too — reported only when the combined score passes the threshold) * ENHANCE: Iframe patterns now only apply inside uploads/. They were matching every legitimate YouTube, Google Maps and payment-gateway embed in themes and plugins * ENHANCE: “PHP in uploads” no longer fires on empty “silence is golden” index. php stubs * ENHANCE: New “Needs Review” section for low-confidence matches — no email alert, never auto-quarantined * ENHANCE: Auto-quarantine now requires a definitive signature AND a score of 70 +, and refuses to touch the plugin’s own files * FIX: Quarantine and Delete now refuse any path inside the plugin directory (previously could fatal the site) * FIX: Scan progress now reports the infected count correctly — results no longer required a manual page reload * FIX: One-click “Enable Now” in the security scan modal reset every other setting to 0 * FIX: Saving one settings section no longer resets custom firewall rules and CSP builder data Database scanner (same false-positive rework): * FIX: iframes in posts, pages and comments are checked against an allowlist of ~60 known embed hosts (YouTube, Vimeo, Maps, Spotify, Calendly, Stripe, your own domain…). Ordinary embedded content is no longer reported as an injection * FIX: Patterns are now scoped to the column they make sense in — a post about php.ini no longer matches the auto_prepend_file rule * FIX: The wp_options sweep reported every row whose value merely contained “shell_exec”, which flagged the stored settings of security and code-snippet plugins, including this one. Values must now match an actual code pattern, and the plugin’s own options and transients are excluded * FIX: “Recently created administrator” compared a string user ID with an integer, so the logged-in admin was flagged on every scan. It is now an advisory review item, never an alert * FIX: Chunked post/comment scans had no ORDER BY, so paging could skip or repeat rows * FIX: The admin-user-creation pattern looked for add_user(), a function that does not exist in WordPress * NEW: “Mark as safe” on any database finding, bound to a hash of the content — editing the item re-opens the finding * ENHANCE: Findings show a confidence score and split into threats vs “needs review” #### 4.0.1 * FIX: Custom Login URL feature now correctly serves the login page at the custom slug * FIX: Direct wp-login.php access now properly returns 404 for non-authenticated visitors * FIX: Password reset, logout, and other core WordPress actions no longer blocked by custom login URL * FIX: Logged-in administrators can still access wp-login.php directly * FIX: Replaced PHP parse_url() with WordPress wp_parse_url() for coding standards compliance #### 4.0.0 * NEW: Multi-provider CAPTCHA (reCAPTCHA v3, hCaptcha, Cloudflare Turnstile) * NEW: Magic link / passwordless login * NEW: Progressive lockouts (escalating duration per IP) * NEW: Trusted device (30-day 2FA bypass cookie) * NEW: Geolocation login alerts with one-click account lock * NEW: Subnet auto-blocking * NEW: Remote WAF rule feed * NEW: Admin-defined custom firewall rules * NEW: Per-endpoint rate limiting * NEW: REST API security controls * NEW: Verified bot allowlist (Google, Bing, etc.) * NEW: Referrer blocking with spam presets * NEW: Vulnerability Scanner (WPScan API) * NEW: Database malware scanner * NEW: Plugin/theme checksum verification * NEW: wp-config.php and .htaccess integrity check * NEW: Heuristic risk scoring (0–100) for malware * NEW: Auto-quarantine on scan * NEW: Scan diff (new vs cleared threats) * NEW: HTML email templates for all alerts * NEW: Webhook/Slack notifications * NEW: Real-time dashboard stats * NEW: 7-day login attempt chart * NEW: Security score breakdown by category * NEW: Inactive user auto-lock * NEW: Admin action audit trail * NEW: Active session manager * NEW: GDPR IP anonymization * NEW: WP-CLI commands * NEW: Settings import/export (JSON) * NEW: Configurable log retention * NEW: CSP visual builder * NEW: CSP violation reporting endpoint * NEW: Permissions-Policy per-feature builder * NEW: Security header A–F grade * NEW: Vulnerabilities admin page * FIX: TOTP user_id detection on Edit User page * FIX: DISALLOW_FILE_MODS now properly wired * FIX: RSS toggle uses AJAX save (not fragile hidden form) * FIX: WooCommerce login honeypot and CAPTCHA support * FIX: Geo API fallback chain (ip-api.com ipapi.co skip) #### 3.0.0 * TOTP 2FA (Google Authenticator), email OTP fallback, backup codes * Core file repair (download from WordPress.org SVN with checksum verification) * Post-Hack recovery tools * Malware quarantine and permanent delete ## اطلاعات * نگارش **4.0.2** * آخرین به‌روزرسانی **21 ساعت پیش** * نصب‌های فعال **20+** * نگارش وردپرس ** 5.0 یا بالاتر ** * آزمایش‌شده تا **6.9.5** * نگارش PHP ** 7.4 یا بالاتر ** * زبان * [English (US)](https://wordpress.org/plugins/liveupx-security/) * برچسب * [2FA](https://fa.wordpress.org/plugins/tags/2fa/)[firewall](https://fa.wordpress.org/plugins/tags/firewall/) [login protection](https://fa.wordpress.org/plugins/tags/login-protection/)[malware scanner](https://fa.wordpress.org/plugins/tags/malware-scanner/) [security](https://fa.wordpress.org/plugins/tags/security/) * [نمایش پیشرفته](https://fa.wordpress.org/plugins/liveupx-security/advanced/) ## امتیازها هنوز هیچ نقدی ارسال نشده است. [Your review](https://wordpress.org/support/plugin/liveupx-security/reviews/#new-post) [مشاهده همه بررسی‌ها](https://wordpress.org/support/plugin/liveupx-security/reviews/) ## مشارکت کنندگان * [ Liveupx ](https://profiles.wordpress.org/liveupx/) ## پشتیبانی مشکلات حل شده در دو ماه گذشته: 0 از 1 [مشاهده انجمن پشتیبانی](https://wordpress.org/support/plugin/liveupx-security/)