{"id":271486,"date":"2026-02-16T20:43:27","date_gmt":"2026-02-16T20:43:27","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/smart-firewall-ai-shield\/"},"modified":"2026-10-26T13:30:30","modified_gmt":"2026-10-26T13:30:30","slug":"maroon-horizon-smart-firewall","status":"publish","type":"plugin","link":"https:\/\/fa.wordpress.org\/plugins\/maroon-horizon-smart-firewall\/","author":23427894,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.8.16","stable_tag":"1.8.16","tested":"7.1.3","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"Maroon Horizon Smart Firewall","header_author":"Maroon Horizon Ltd","header_description":"Security hardening toolkit for WordPress with firewall controls, patch toggles, file integrity checks, malware scanning, and IP protection.","assets_banners_color":"211938","last_updated":"2026-10-26 13:30:30","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/mh.ie\/maroon-horizon-smart-firewall\/","header_author_uri":"https:\/\/mh.ie","rating":5,"author_block_rating":0,"active_installs":0,"downloads":797,"num_ratings":1,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.8.16":{"tag":"1.8.16","author":"mhlabs","date":"2026-10-26 13:30:30","revision":3766524},"1.8.2":{"tag":"1.8.2","author":"mhlabs","date":"2026-04-19 19:08:08","revision":3510231}},"upgrade_notice":{"1.8.16":"<p>Safer quarantine (encoded files), automatic clean-up of the plugin&#039;s own data, full clean-up on delete, and a Recent activity list with the last 200 events.<\/p>","1.8.14":"<p>Important fixes for Force HTTPS (no more lockout on sites without working HTTPS) and Protect Uploads (blocked IPs could still download uploads). Live score updates and honest status texts. Update recommended for everyone.<\/p>","1.8.12":"<p>Automatic Cloudflare support: blocks, Login Guard and Threat Feed use the visitor&#039;s real address. Recommended for every site behind Cloudflare.<\/p>","1.8.11":"<p>Unblocking an IP also works while .htaccess is locked. Recommended update.<\/p>","1.8.10":"<p>Important fix for the IP Blocker together with the Force HTTPS or Protect wp-config.php patches, plus an automatic .htaccess safety check. Update recommended for everyone.<\/p>","1.8.8":"<p>The header score always matches the Dashboard. Recommended update.<\/p>","1.8.7":"<p>New, clearer design with light and dark looks. Recommended update.<\/p>","1.8.6":"<p>Clearer Security Patches and Malware Scanner screens, real Threat Feed facts. Recommended update.<\/p>","1.8.5":"<p>Fixes false &quot;missing&quot; files in the integrity check and the &quot;not allowed&quot; page behind Account buttons. Recommended update.<\/p>","1.8.4":"<p>Adds safe ways back in after a login lockout and fixes false &quot;missing&quot; files in the integrity check. Recommended update.<\/p>","1.8.2":"<p>Packaging\/compliance refinements and improved maintainability. Recommended update.<\/p>","1.7.8":"<p>Security compliance update. Recommended update for all users.<\/p>","1.7.7":"<p>Making sure that &quot;SFAIS_VERSION&quot; equals plugin release.<\/p>","1.7.3":"<p>Improved PRO upgrade guidance.<\/p>","1.7.2":"<p>Maintenance update.<\/p>","1.7.1":"<p>Initial release.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.gif":{"filename":"icon-128x128.gif","revision":3766592,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.gif":{"filename":"icon-256x256.gif","revision":3766592,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.jpg":{"filename":"banner-1544x500.jpg","revision":3766665,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.jpg":{"filename":"banner-772x250.jpg","revision":3766665,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{"blueprint.json":{"filename":"blueprint.json","revision":3767035,"resolution":false,"location":"assets","locale":"","contents":"{\"$schema\":\"https:\\\/\\\/playground.wordpress.net\\\/blueprint-schema.json\",\"meta\":{\"title\":\"Maroon Horizon Smart Firewall - live preview with demo data\",\"author\":\"mhlabs\"},\"landingPage\":\"\\\/wp-admin\\\/admin.php?page=sfais-dashboard\",\"preferredVersions\":{\"php\":\"8.4\",\"wp\":\"latest\"},\"features\":{\"networking\":true},\"steps\":[{\"step\":\"login\",\"username\":\"admin\"},{\"step\":\"installPlugin\",\"pluginData\":{\"resource\":\"wordpress.org\\\/plugins\",\"slug\":\"maroon-horizon-smart-firewall\"},\"options\":{\"activate\":true}},{\"step\":\"writeFile\",\"path\":\"\\\/tmp\\\/mhsf-demo.php\",\"data\":\"<?php\\n\\\/**\\n * WordPress.org Live Preview (WordPress Playground) - demo data for Maroon Horizon Smart Firewall FREE (26 Oct, Vlad).\\n * Runs once inside the visitor's own throw-away Playground (in their browser) after the plugin is installed + activated.\\n * Only the plugin's OWN functions - the same real actions an admin does on the screens (like tests\\\/screenshots.sh):\\n * the preview note first, then block addresses, scan, quarantine, ignore, switch patches on, a Login Guard lockout - every\\n * step protected so one failure never stops the rest (26 Oct: Vlad's first start broke halfway, the note came too late). Nothing is faked:\\n * no \\\"backup confirmed\\\" (a Playground has no backups), IPs = documentation ranges (RFC 5737), test files are inert.\\n *\\\/\\nrequire_once '\\\/wordpress\\\/wp-load.php';\\nwp_set_current_user( 1 );\\n$log = function ( $type, $res ) {\\n\\tif ( is_array( $res ) && ! empty( $res['message'] ) && ( ! isset( $res['status'] ) || $res['status'] ) ) {\\n\\t\\tmhsf_activity_add( $type, $res['message'] );\\n\\t}\\n};\\nupdate_user_meta( 1, 'mhsf_appearance', 'dark' );\\n\\n\\\/\\\/ 1 Preview-only note (Vlad 26 Oct, fix 1): Playground ships a size-compacted WordPress (comments + spaces removed), so the\\n\\\/\\\/   File Integrity Check really finds its core files changed. A must-use plugin of THIS throw-away site says so above the button.\\ntry {\\n$note = <<<'PHP'\\n<?php\\n\\\/\\\/ Live Preview only (WordPress Playground) - written by the Maroon Horizon Smart Firewall preview blueprint.\\nadd_action( 'admin_footer', function () {\\n\\t\\\/\\\/ every plugin screen: the tabs (Dashboard, IP Blocker, Patches, Scanner) live in ONE page and switch in place,\\n\\t\\\/\\\/ so a click on 'Malware Scanner' keeps page=sfais-dashboard (26 Oct: Vlad saw no note - bound to page=sfais-scanner only)\\n\\tif ( ! isset( $_GET['page'] ) || 0 !== strpos( sanitize_key( wp_unslash( $_GET['page'] ) ), 'sfais' ) ) {\\n\\t\\treturn;\\n\\t}\\n\\t$text = 'Live Preview note: WordPress Playground uses a shortened copy of WordPress (comments and spaces removed so it loads faster), '\\n\\t\\t. 'so this check shows its core files as changed here. On a real WordPress site it compares the original WordPress.org files '\\n\\t\\t. 'and shows only real changes.';\\n\\t?>\\n\\t<script>\\n\\t( function () {\\n\\t\\tvar b = document.getElementById( 'sfais-scan-core' );\\n\\t\\tif ( ! b ) { return; }\\n\\t\\tvar n = document.createElement( 'div' );\\n\\t\\tn.className = 'sfais-safety-note sfais-safety-note--info';\\n\\t\\tn.setAttribute( 'role', 'note' );\\n\\t\\tn.style.margin = '0 0 12px';\\n\\t\\tn.innerHTML = '<span class=\\\"dashicons dashicons-info\\\" aria-hidden=\\\"true\\\"><\\\/span><div class=\\\"sfais-safety-note__body\\\"><div class=\\\"sfais-safety-note__text\\\"><\\\/div><\\\/div>';\\n\\t\\tn.querySelector( '.sfais-safety-note__text' ).textContent = <?php echo wp_json_encode( $text ); ?>;\\n\\t\\tb.parentNode.insertBefore( n, b );\\n\\t} )();\\n\\t<\\\/script>\\n\\t<?php\\n} );\\nPHP;\\nwp_mkdir_p( WPMU_PLUGIN_DIR );\\nfile_put_contents( WPMU_PLUGIN_DIR . '\\\/mhsf-preview-note.php', $note );\\n} catch ( \\\\Throwable $e ) {   \\\/\\\/ one step failing must never stop the others (26 Oct)\\n\\terror_log( 'MHSF preview demo - step \\\"Preview-only note\\\" skipped: ' . $e->getMessage() );\\n}\\n\\n\\\/\\\/ 2 IP Blocker: six blocked addresses (server rule + WordPress list) - first, \\\"Fix File Permissions\\\" makes .htaccess read-only\\ntry {\\n\\t$ips = new SFAIS_IP_Manager();\\n\\tforeach ( array( '203.0.113.42', '198.51.100.17', '192.0.2.88', '203.0.113.196', '198.51.100.230', '192.0.2.14' ) as $ip ) {\\n\\t\\t$log( 'ip', $ips->block_ip( $ip ) );\\n\\t}\\n} catch ( \\\\Throwable $e ) {   \\\/\\\/ one step failing must never stop the others (26 Oct)\\n\\terror_log( 'MHSF preview demo - step \\\"IP Blocker\\\" skipped: ' . $e->getMessage() );\\n}\\n\\n\\\/\\\/ 3 Malware Scanner: inert sample files (exit first, the pattern only in a comment) for the scan to find\\ntry {\\n\\t$up = wp_upload_dir()['basedir'];\\n\\t$samples = array(\\n\\t\\t'2025\\\/11\\\/wp-cache-admin.php'        => 'eval(base64_decode($x))',\\n\\t\\t'2026\\\/03\\\/thumb-resize.php'          => 'shell_exec($cmd)',\\n\\t\\t'2026\\\/09\\\/class-wp-image-cache.php'  => 'gzinflate(base64_decode($x))',\\n\\t\\t'2026\\\/09\\\/sitemap-gen.php'           => 'system($cmd)',\\n\\t\\t'2026\\\/03\\\/index-old.php'             => 'passthru($cmd)',\\n\\t\\t'2026\\\/09\\\/widget-cache.php'          => 'exec($cmd)',\\n\\t);\\n\\tforeach ( $samples as $rel => $pattern ) {\\n\\t\\twp_mkdir_p( dirname( \\\"$up\\\/$rel\\\" ) );\\n\\t\\tfile_put_contents( \\\"$up\\\/$rel\\\", \\\"<?php exit; \\\/\\\/ Harmless demo file for the Smart Firewall preview - it only contains the text of a pattern: $pattern\\\\n\\\" );\\n\\t}\\n\\trequire_once SFAIS_PATH . 'includes\\\/class-sfais-scanner.php';\\n\\t$scanner = new SFAIS_Scanner();\\n\\t$res = $scanner->scan_paths( array_values( array_filter( array( $up, get_theme_root() ) ) ), false, true );\\n\\tif ( ! empty( $res['success'] ) ) {\\n\\t\\t$s = isset( $res['report']['summary'] ) ? (array) $res['report']['summary'] : (array) ( $res['summary'] ?? array() );\\n\\t\\t\\\/* translators: %d: files *\\\/\\n\\t\\tmhsf_activity_add( 'scan', sprintf( __( 'Uploads & themes scanned \\u00b7 %d suspicious', 'maroon-horizon-smart-firewall' ), (int) ( $s['suspicious'] ?? 0 ) ) );\\n\\t}\\n\\t$base = 'wp-content\\\/uploads\\\/';\\n\\tforeach ( array( '2025\\\/11\\\/wp-cache-admin.php', '2026\\\/03\\\/thumb-resize.php', '2026\\\/09\\\/class-wp-image-cache.php' ) as $rel ) {\\n\\t\\t$reason = $scanner->report_reason( $base . $rel );\\n\\t\\t$r      = $scanner->quarantine_move( $base . $rel, '' !== $reason ? $reason : 'Moved by an admin' );\\n\\t\\tif ( ! empty( $r['success'] ) ) {\\n\\t\\t\\tmhsf_activity_add( 'quarantine', 'Quarantined: ' . basename( $rel ) );\\n\\t\\t}\\n\\t}\\n\\t$r = $scanner->ignore_file( $base . '2026\\\/09\\\/widget-cache.php' );\\n\\tif ( ! empty( $r['success'] ) ) {\\n\\t\\tmhsf_activity_add( 'scan', 'Ignored in scans: widget-cache.php' );\\n\\t}\\n} catch ( \\\\Throwable $e ) {   \\\/\\\/ one step failing must never stop the others (26 Oct)\\n\\terror_log( 'MHSF preview demo - step \\\"Malware Scanner\\\" skipped: ' . $e->getMessage() );\\n}\\n\\n\\\/\\\/ 4 Security Patches: four of the five FREE patches on (one left to try) - after the demo files, so their new folders get\\n\\\/\\\/   the directory-listing index files and the right permissions\\ntry {\\n\\t$patches = new SFAIS_Patch_Manager();\\n\\tforeach ( array( 'versioninfo', 'dirlisting', 'xmlrpc', 'permissions' ) as $p ) {\\n\\t\\t$log( 'patch', $patches->toggle( $p, 'apply' ) );\\n\\t}\\n} catch ( \\\\Throwable $e ) {   \\\/\\\/ one step failing must never stop the others (26 Oct)\\n\\terror_log( 'MHSF preview demo - step \\\"Security Patches\\\" skipped: ' . $e->getMessage() );\\n}\\n\\n\\\/\\\/ 5 Login Guard: three addresses locked (the plugin's own lockout, as after too many failed logins)\\ntry {\\n\\t$guard = new SFAIS_Login_Guard();\\n\\t$lock  = new ReflectionMethod( $guard, 'lock_out_ip' );\\n\\t$lock->setAccessible( true );\\n\\tforeach ( array( '203.0.113.9', '198.51.100.44', '192.0.2.201' ) as $ip ) {\\n\\t\\t$lock->invoke( $guard, $ip );\\n\\t}\\n} catch ( \\\\Throwable $e ) {   \\\/\\\/ one step failing must never stop the others (26 Oct)\\n\\terror_log( 'MHSF preview demo - step \\\"Login Guard\\\" skipped: ' . $e->getMessage() );\\n}\\n\\n\\\/\\\/ 6 Security check: the score the Dashboard opens with\\ntry {\\n\\t( $GLOBALS['sfais_functions'] ?? new SFAIS_Functions() )->run_quick_check();\\n} catch ( \\\\Throwable $e ) {   \\\/\\\/ one step failing must never stop the others (26 Oct)\\n\\terror_log( 'MHSF preview demo - step \\\"Security check\\\" skipped: ' . $e->getMessage() );\\n}\\n\"},{\"step\":\"runPHP\",\"code\":\"<?php require '\\\/tmp\\\/mhsf-demo.php';\"}]}"}},"all_blocks":[],"tagged_versions":["1.8.16","1.8.2"],"block_files":[],"assets_screenshots":{"screenshot-1.jpg":{"filename":"screenshot-1.jpg","revision":3766530,"resolution":"1","location":"assets","locale":"","width":2560,"height":1848},"screenshot-2.jpg":{"filename":"screenshot-2.jpg","revision":3766530,"resolution":"2","location":"assets","locale":"","width":2560,"height":2066},"screenshot-3.jpg":{"filename":"screenshot-3.jpg","revision":3766530,"resolution":"3","location":"assets","locale":"","width":2560,"height":2112},"screenshot-4.jpg":{"filename":"screenshot-4.jpg","revision":3766530,"resolution":"4","location":"assets","locale":"","width":2560,"height":2134},"screenshot-5.jpg":{"filename":"screenshot-5.jpg","revision":3766530,"resolution":"5","location":"assets","locale":"","width":2560,"height":1972},"screenshot-6.jpg":{"filename":"screenshot-6.jpg","revision":3766530,"resolution":"6","location":"assets","locale":"","width":2560,"height":1658},"screenshot-7.jpg":{"filename":"screenshot-7.jpg","revision":3766530,"resolution":"7","location":"assets","locale":"","width":2560,"height":1632},"screenshot-8.jpg":{"filename":"screenshot-8.jpg","revision":3766530,"resolution":"8","location":"assets","locale":"","width":1600,"height":1542}},"screenshots":{"1":"Dashboard \u2013 Overall Security Rating, recommended fixes and the Recent activity log at a glance.","2":"All security checks \u2013 every check with a clear OK \/ Warning \/ Critical status and what to do.","3":"IP Blocker \u2013 blocked IPs stopped by the server rule (.htaccess) and the WordPress firewall.","4":"Security Patches \u2013 one-click hardening switches with the result shown right under each patch.","5":"Malware Scanner \u2013 quarantined files (stored encoded, so they can't run) and ignored files.","6":"Scans \u2013 the Quick File Integrity Check in progress and suspicious files found in uploads and themes.","7":"Threat Feed (PRO) \u2013 the daily, digitally signed feed of high-risk networks curated by Maroon Horizon AI.","8":"Settings \u2013 Login Guard lockouts with one-click unlock, Appearance and automatic Storage &amp; clean-up."}},"plugin_section":[],"plugin_tags":[2439,1174,31093,55021,600],"plugin_category":[54],"plugin_contributors":[255988],"plugin_business_model":[],"class_list":["post-271486","plugin","type-plugin","status-publish","hentry","plugin_tags-brute-force","plugin_tags-firewall","plugin_tags-hardening","plugin_tags-malware-scanner","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-mhlabs","plugin_committers-mhlabs"],"banners":{"banner":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/banner-772x250.jpg?rev=3766665","banner_2x":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/banner-1544x500.jpg?rev=3766665","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/icon-128x128.gif?rev=3766592","icon_2x":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/icon-256x256.gif?rev=3766592","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/screenshot-1.jpg?rev=3766530","caption":"Dashboard \u2013 Overall Security Rating, recommended fixes and the Recent activity log at a glance."},{"src":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/screenshot-2.jpg?rev=3766530","caption":"All security checks \u2013 every check with a clear OK \/ Warning \/ Critical status and what to do."},{"src":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/screenshot-3.jpg?rev=3766530","caption":"IP Blocker \u2013 blocked IPs stopped by the server rule (.htaccess) and the WordPress firewall."},{"src":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/screenshot-4.jpg?rev=3766530","caption":"Security Patches \u2013 one-click hardening switches with the result shown right under each patch."},{"src":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/screenshot-5.jpg?rev=3766530","caption":"Malware Scanner \u2013 quarantined files (stored encoded, so they can't run) and ignored files."},{"src":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/screenshot-6.jpg?rev=3766530","caption":"Scans \u2013 the Quick File Integrity Check in progress and suspicious files found in uploads and themes."},{"src":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/screenshot-7.jpg?rev=3766530","caption":"Threat Feed (PRO) \u2013 the daily, digitally signed feed of high-risk networks curated by Maroon Horizon AI."},{"src":"https:\/\/ps.w.org\/maroon-horizon-smart-firewall\/assets\/screenshot-8.jpg?rev=3766530","caption":"Settings \u2013 Login Guard lockouts with one-click unlock, Appearance and automatic Storage &amp; clean-up."}],"raw_content":"<!--section=description-->\n<p>Maroon Horizon Smart Firewall is built for practical WordPress protection: block bad traffic, scan for malware, quarantine suspicious files, and reduce attack surface \u2014 without sending your site files off-server.<\/p>\n\n<p>Advanced Security Check (Quick Scan) gives you an easy-to-understand Overall Security Rating, plus clear details and explanations for each check so you can quickly see what to improve and raise your security level. The free version can reach 100\/100 on its own.<\/p>\n\n<p>This WordPress.org (FREE) build is fully functional for the FREE feature set and is designed to run locally for those features. Advanced capabilities are provided by a separate commercial PRO plugin (not included in this WordPress.org build).<\/p>\n\n<p>Outbound network requests (if any) are disclosed under \"External Services\" and \"Privacy\".<\/p>\n\n<h4>What you get in the FREE plugin (local-only)<\/h4>\n\n<ul>\n<li>Advanced Security Check (Quick Scan) with an Overall Security Rating and easy-to-follow explanations so you can improve your security level step by step - the score updates the moment you change something.<\/li>\n<li>Manual IP blocking and IP management (server rule in .htaccess plus the WordPress firewall; automatic Cloudflare support).<\/li>\n<li>Login Guard: 5 failed logins lock that address out for 30 minutes, with a safe e-mail unlock link for administrators.<\/li>\n<li>Security patch toggles for common hardening actions (hide the WordPress version, prevent directory browsing, disable XML-RPC, protect uploads, fix file permissions).<\/li>\n<li>Malware scanning of uploads and theme directories using local pattern detection (no external signatures).<\/li>\n<li>Quarantine management (restore \/ delete quarantined files) - quarantined files are stored encoded, so they can't run.<\/li>\n<li>Quick file integrity check of WordPress core files against the official WordPress.org checksums.<\/li>\n<li>Recent activity log (the last 200 security events) and automatic clean-up, so the plugin never fills your hosting.<\/li>\n<\/ul>\n\n<h4>Local-first design (privacy &amp; control)<\/h4>\n\n<ul>\n<li>Malware scans run on your server.<\/li>\n<li>Scanned file contents are not uploaded by the plugin.<\/li>\n<li>External requests (if any) are limited and disclosed below.<\/li>\n<\/ul>\n\n<h4>Who it\u2019s for<\/h4>\n\n<ul>\n<li>Site owners who want simple, practical protection without complex configuration.<\/li>\n<li>Agencies and developers who need a clean hardening + scanning toolkit.<\/li>\n<li>Anyone who wants a transparent FREE build, with an optional PRO upgrade path.<\/li>\n<\/ul>\n\n<h4>PRO features (separate commercial plugin, optional)<\/h4>\n\n<ul>\n<li>Maroon Horizon Threat Feed: a digitally signed feed of high-risk IP networks, curated daily by Maroon Horizon AI, with automatic daily sync.<\/li>\n<li>Deep Scan with the daily Maroon Horizon malware signatures (reviewed by Maroon Horizon AI) and scheduled e-mail reports.<\/li>\n<li>PRO security patches: disable file editing, block PHP in wp-content, Force HTTPS, protect wp-config.php, hide author enumeration.<\/li>\n<\/ul>\n\n<h4>Commercial PRO plugin<\/h4>\n\n<p>The PRO edition is a separate commercial plugin (not included in this WordPress.org build).\nLearn more: <a href=\"https:\/\/mh.ie\/maroon-horizon-smart-firewall\/\">https:\/\/mh.ie\/maroon-horizon-smart-firewall\/<\/a><\/p>\n\n<h3>External Services<\/h3>\n\n<p>This plugin may perform outbound network requests in the following cases:<\/p>\n\n<p>1) WordPress.org Core Checksums API (FREE: Core Integrity Scan)\n* Service provider: WordPress.org\n* Endpoint: https:\/\/api.wordpress.org\/core\/checksums\/1.0\/\n* When: Only when you manually run the Core Integrity Scan from Maroon Horizon -&gt; Scanner.\n* Data sent: WordPress version and locale via URL query parameters. Your server IP address is inherently shared as part of the HTTPS request.\n* Data received: Official JSON containing WordPress core file checksums, used to verify your local core files. No site files or content are uploaded.\n* Privacy: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n<p>2) Freemius (checkout and licensing - only when you upgrade)\n* Service provider: Freemius (freemius.com)\n* When: Only when you open \"Upgrade to PRO\" (the secure Freemius checkout) or buy PRO. This free version has no opt-in and sends no usage or diagnostic data.\n* Data sent: What you enter in the checkout; after a purchase, the technical information needed for your license and PRO updates, as described by Freemius.\n* Data received: The checkout page, and after a purchase your license status and the PRO download.\n* Terms: https:\/\/freemius.com\/terms\/\n* Privacy: https:\/\/freemius.com\/privacy\/<\/p>\n\n<p>3) Maroon Horizon service (mh.ie) (PRO only: digitally signed Threat Feed and malware signatures)\n* Service provider: Maroon Horizon Ltd - <a href=\"https:\/\/mh.ie\">https:\/\/mh.ie<\/a>\n* When: Only in the separate PRO plugin, once a day and when you click \"Sync now\".\n* Data sent: Site URL, install ID, license ID and key, plugin version, plus standard HTTPS request metadata (including your server IP).\n* Data received: A short-lived access token, then the digitally signed Threat Feed and malware signature files used by the PRO plugin. No site files or content are uploaded.\n* Terms: https:\/\/mh.ie\/terms\n* Privacy: https:\/\/mh.ie\/privacy-policy<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>Maroon Horizon Smart Firewall is designed to minimize data sharing.<\/p>\n\n<ul>\n<li>Most FREE features run locally and do not transmit your site content.<\/li>\n<li>Malware scanning runs locally on your server; scanned file contents are not uploaded by the plugin.<\/li>\n<li>Any outbound requests (and the data exchanged) are disclosed in the \"External Services\" section above.<\/li>\n<li>PRO-only services are not included in this WordPress.org build.<\/li>\n<\/ul>\n\n<h3>Credits<\/h3>\n\n<ul>\n<li>Manrope font (admin screens): Copyright 2018 The Manrope Project Authors, licensed under the SIL Open Font License 1.1 - see admin\/fonts\/OFL.txt.<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Install the plugin from the WordPress Plugins screen, or upload the plugin folder to your WordPress plugins directory.<\/li>\n<li>Activate the plugin through the \"Plugins\" screen in WordPress.<\/li>\n<li>Open the plugin from the WordPress admin menu and configure firewall controls, patches, and scanning.<\/li>\n<li>Run a scan and review findings. Use quarantine actions if needed.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20the%20free%20version%20contact%20external%20servers%3F\"><h3>Does the FREE version contact external servers?<\/h3><\/dt>\n<dd><p>Most FREE features run locally and do not require third-party services.<\/p>\n\n<p>The only outbound requests made by this WordPress.org (FREE) build are disclosed in the \"External Services\" section above (the Core Integrity Scan checksums request you start, and the Freemius checkout if you open \"Upgrade to PRO\"). The free version has no opt-in and shares no usage or diagnostic data.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20upload%20my%20files%20to%20be%20scanned%3F\"><h3>Does the plugin upload my files to be scanned?<\/h3><\/dt>\n<dd><p>No. Malware scans run locally on your server. The plugin reports findings inside the WordPress admin.<\/p><\/dd>\n<dt id=\"will%20it%20slow%20down%20my%20site%3F\"><h3>Will it slow down my site?<\/h3><\/dt>\n<dd><p>The firewall settings and hardening toggles are lightweight. Malware scans do work on the server, so it\u2019s best to run scans during low-traffic periods on shared hosting.<\/p><\/dd>\n<dt id=\"what%20does%20the%20malware%20scanner%20scan%20in%20the%20free%20plugin%3F\"><h3>What does the malware scanner scan in the FREE plugin?<\/h3><\/dt>\n<dd><p>The FREE scanner targets uploads and theme directories using local pattern detection, and the Quick File Integrity Check compares WordPress core files with the official WordPress.org checksums. Findings are reported in the admin UI and can be quarantined.<\/p><\/dd>\n<dt id=\"what%20about%20false%20positives%3F\"><h3>What about false positives?<\/h3><\/dt>\n<dd><p>Security scanning is conservative by design. Review findings before taking action, and use restore from quarantine if needed. An ignored file stays ignored only while it is unchanged.<\/p><\/dd>\n<dt id=\"can%20the%20free%20version%20reach%20a%20100%2F100%20security%20score%3F\"><h3>Can the free version reach a 100\/100 security score?<\/h3><\/dt>\n<dd><p>Yes. The free version scores only what it can fix or what you can confirm yourself; PRO-only features never cost free users points.<\/p><\/dd>\n<dt id=\"how%20do%20i%20upgrade%20to%20pro%3F\"><h3>How do I upgrade to PRO?<\/h3><\/dt>\n<dd><p>PRO functionality is provided by a separate commercial plugin (not included in this WordPress.org build). Licensing and delivery are handled by Freemius.\nAfter buying PRO from the plugin's upgrade page, a short guide appears: download PRO, then upload and activate it. When PRO is activated it switches this free version off, takes over your license automatically and keeps all your settings.\nThe PRO plugin also downloads a daily, digitally signed threat feed and malware signatures from Maroon Horizon (mh.ie); this WordPress.org build does not.\nLearn more: <a href=\"https:\/\/mh.ie\/maroon-horizon-smart-firewall\/\">https:\/\/mh.ie\/maroon-horizon-smart-firewall\/<\/a><\/p><\/dd>\n<dt id=\"does%20it%20work%20behind%20cloudflare%3F\"><h3>Does it work behind Cloudflare?<\/h3><\/dt>\n<dd><p>Yes, automatically. When a visit really comes through Cloudflare, the plugin uses the visitor's real address that Cloudflare reports - for blocked IPs, the Login Guard and the PRO Threat Feed. It recognises Cloudflare by Cloudflare's published address list, which is included in the plugin (nothing is downloaded), and ignores the same header from anyone else. Other CDNs are not recognised yet.<\/p><\/dd>\n<dt id=\"i%20locked%20myself%20out%20of%20the%20login.%20what%20now%3F\"><h3>I locked myself out of the login. What now?<\/h3><\/dt>\n<dd><p>After five failed logins, the Login Guard locks that address out of the login page for 30 minutes. You do not have to wait:<\/p>\n\n<ul>\n<li>On the login page, click \"Administrator? Get an unlock link by e-mail\" and enter your administrator user name or e-mail address. The link works once, for 15 minutes.<\/li>\n<li>Another administrator can unlock you in Smart Firewall &gt; Settings &gt; Login Guard (Unlock \/ Unlock all).<\/li>\n<li>No e-mail access? Add <code>define( 'MHSF_LOGIN_GUARD_OFF', true );<\/code> to wp-config.php over FTP, log in, then remove the line again.<\/li>\n<\/ul><\/dd>\n<dt id=\"does%20the%20plugin%20store%20much%20data%3F\"><h3>Does the plugin store much data?<\/h3><\/dt>\n<dd><p>No. A daily clean-up deletes quarantined files after 30 days (max 50 MB), scan reports after 30 days (the newest 5 are kept) and old scan jobs after 24 hours.\nExpired login-failure records are removed every hour; Settings &gt; Storage &amp; clean-up shows the last clean-up.\nWhen you delete the plugin, its data folder, settings and .htaccess rules are removed.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.8.16<\/h4>\n\n<ul>\n<li>New: Recent activity on the Dashboard keeps the last 200 events (patches, IP blocks, quarantine, ignored files, scans, score changes, Login Guard lockouts, Threat Feed updates, clean-ups) in a scrollable list.<\/li>\n<li>New: quarantine is safer - a quarantined file is stored encoded under a random name, readable only by the owner, so it can't run, can't be opened from the web (also on Nginx) and host virus scanners don't see the original code. Restore checks it is unchanged and puts the file back exactly, with its permissions. Older quarantined files are converted automatically.<\/li>\n<li>New: automatic clean-up, so the plugin never fills your hosting - quarantined files are deleted after 30 days (max 50 MB), scan reports after 30 days (newest 5 kept), unfinished scan jobs after 24 hours, leftover temporary files after 1 hour, expired login records every hour. Settings &gt; Storage &amp; clean-up shows the last clean-up and has a \"Run clean-up now\" button.<\/li>\n<li>New: deleting the plugin removes everything it added - its data folder, settings, schedules and its own rules in .htaccess (patches are reverted, permissions restored).<\/li>\n<li>Improved: Malware Scanner cards sit side by side and use the full width only when they show results; result buttons are on one line; compact rows on phones.<\/li>\n<li>Improved: the quarantine list shows what the scan found (for example \"High-risk PHP: eval(), base64_decode()\").<\/li>\n<li>Limits: the IP Blocker holds up to 1,000 addresses; stored scan results keep up to 500 rows; old data from version 1.8.2 is removed once.<\/li>\n<\/ul>\n\n<h4>1.8.14<\/h4>\n\n<ul>\n<li>Fix: the security score, the Dashboard checks and \"x of N patches on\" now update right after you switch a Security Patch or confirm an item - no page reload needed.<\/li>\n<li>Important fix: Force HTTPS checks first that https:\/\/ really works on your site (valid certificate). Before, switching it on without working HTTPS sent every page, including the login, to a broken address. It now also keeps special characters in addresses, keeps www \/ non-www, and works on every permalink.<\/li>\n<li>Important fix: with Protect Uploads on, a blocked IP could still download files from the uploads folder. The uploads and wp-content rules no longer switch off the server block, and both are checked after writing (the previous file comes back if the site stops answering).<\/li>\n<li>Fix: Disable XML-RPC now really closes xmlrpc.php (pingbacks too) and removes the X-Pingback header and the RSD link.<\/li>\n<li>Fix: Hide WordPress Version Info also hides the version in script and style links. Hide Author Enumeration also hides the REST users list, the users sitemap and author data in embeds.<\/li>\n<li>Fix: Protect wp-config.php no longer blocks searches that contain \"wp-config.php\". Fix File Permissions never makes a stricter setting looser and keeps the first original permissions for the revert.<\/li>\n<li>Fix: a PRO patch can always be removed, also when the PRO licence has ended.<\/li>\n<li>Fix: IP Blocker - ranges or several addresses are refused with a clear message (before, only the first address was blocked). IPv6 addresses are stored in one standard form, so every way of writing them blocks. Each IP shows its true status (also \"server only\"). Requests that only pretended to be account actions no longer get past the firewall.<\/li>\n<li>Fix: Threat Feed and malware signatures show the real state: \"Healthy\" only after a recent successful update; a failed or old update, or a missing data file, is said plainly. All dates use your site's time zone. IPv6 feed checks are as fast as IPv4.<\/li>\n<li>Fix: Malware Scanner - ignored files stay ignored only while they are unchanged, and ignored core files no longer come back; new \"Ignored files\" list with Un-ignore. Results stay correct after Delete, Ignore or Quarantine. Quarantine lists every file, stores .htaccess \/ .user.ini \/ php.ini so they can't take effect, never overwrites a different file on restore, and says the truth when deleting.<\/li>\n<li>Fix: honest texts everywhere - no \"real-time\" claims (scans are manual or scheduled), \"Scan Uploads &amp; Themes\" for the free scan, risk shown as NN\/100, PHP status from the official support dates, WordPress status from WordPress's own update check, 2FA \/ strong passwords \/ backups say what was really found, HTTPS behind Cloudflare is recognised, Recent activity shows the right time.<\/li>\n<li>Improved: report options are no longer loaded on every page, the plugin's own data folder is never scanned, and an automatic Deep Scan is scheduled again after the plugin is reactivated.<\/li>\n<\/ul>\n\n<h4>1.8.12<\/h4>\n\n<ul>\n<li>New: automatic Cloudflare support. When a visit really comes through Cloudflare (checked against Cloudflare's published address list, which is included in the plugin - nothing is downloaded), the firewall, the Login Guard and the PRO Threat Feed use the visitor's real address that Cloudflare reports. The same header from anyone else is ignored.<\/li>\n<li>New: the server rule in .htaccess also matches the address Cloudflare reports, so blocking before WordPress loads works behind Cloudflare too. Existing rules get this line the next time you open the IP Blocker.<\/li>\n<li>New: Cloudflare's own addresses cannot be blocked by mistake (that would block every visitor coming through Cloudflare).<\/li>\n<li>Fix: behind Cloudflare, the Login Guard could lock out a Cloudflare address - and with it many real visitors at once.<\/li>\n<\/ul>\n\n<h4>1.8.11<\/h4>\n\n<ul>\n<li>Improved: \"Unblock\" now always really unblocks. When .htaccess is locked, the plugin unlocks it for a moment, removes the server rule and locks it again with the same permissions.<\/li>\n<\/ul>\n\n<h4>1.8.10<\/h4>\n\n<ul>\n<li>Important fix: blocking or unblocking an IP could damage the .htaccess blocks of the Force HTTPS or Protect wp-config.php patches and take the site offline (HTTP 500). The IP Blocker now only touches its own block, and removes a leftover line from that bug.<\/li>\n<li>New safety net: after every change to .htaccess the plugin checks that the site still answers. If the server rejects the change, the previous file is put back at once.<\/li>\n<li>New: your own IP address, the proxy or CDN address your visit arrives through and the server's own addresses cannot be blocked by mistake.<\/li>\n<li>Improved: IP Blocker results appear right under the button or row you used, in plain words (where the IP is blocked, why a server rule could not be added). A server error is reported as such instead of \"Network error\".<\/li>\n<li>Improved: every blocked IP shows one clear status - \"Blocked: server + WordPress\" or \"Blocked: WordPress only\" with the reason - and one plain sentence explains how blocking works on your server (Apache, LiteSpeed, Nginx).<\/li>\n<li>Improved: a clear \"Unblock\" button on every blocked IP.<\/li>\n<\/ul>\n\n<h4>1.8.8<\/h4>\n\n<ul>\n<li>Fix: the security score in the header now always matches the Dashboard (it showed the previous score until the next page load).<\/li>\n<li>Improved: the score label (for example \"Excellent\") is easier to read in the dark look.<\/li>\n<\/ul>\n\n<h4>1.8.7<\/h4>\n\n<ul>\n<li>New design: a clear overview on the Dashboard (security score, Threat Feed, malware signatures, the four protection areas, recommended fixes and recent activity).<\/li>\n<li>New: Appearance setting - Auto (follows your computer's light or dark mode), Light or Dark - per user, only for the Smart Firewall screens.<\/li>\n<li>Improved: Security Patches are simple on\/off switches with the result right below.<\/li>\n<li>Improved: the menu icon is redrawn from the official logo and uses exactly the colour of the WordPress admin icons in every colour scheme.<\/li>\n<li>Fix: the WordPress version check no longer shows an outdated \"6.9\" text on newer versions.<\/li>\n<li>Fix (PRO): the Threat Feed check in the Dashboard shows the real sync status instead of \"Never synced\".<\/li>\n<li>The Manrope font is included in the plugin (SIL Open Font License) - no external font requests.<\/li>\n<\/ul>\n\n<h4>1.8.6<\/h4>\n\n<ul>\n<li>Improved: Security Patches show the result right under the button you clicked.<\/li>\n<li>Improved: clearer, friendlier guidance in the Malware Scanner (you decide about every file; quarantine can be undone).<\/li>\n<li>Fix: the Threat Feed preview shows today's real coverage (100,000+ networks, daily updates) instead of outdated numbers.<\/li>\n<li>PRO: \"Disable Auto-Sync\" now really stops the daily sync, the next sync time is shown again, and the outdated slow\/fast mode choice is gone (the whole feed is always used).<\/li>\n<\/ul>\n\n<h4>1.8.5<\/h4>\n\n<ul>\n<li>Privacy: the free version has no opt-in any more and shares no data (the opt-in buttons led to a \"not allowed\" page).<\/li>\n<li>Fix: the Quick File Integrity Check no longer reports WordPress's documentation and sample files (readme.html, license.txt, wp-config-sample.php) as missing - deleting them is common hardening.<\/li>\n<li>Fix: \"Account details\" and \"Already purchased?\" in Settings no longer open a \"not allowed\" page on sites that are not connected; \"Already purchased? Download PRO\" opens your customer account.<\/li>\n<\/ul>\n\n<h4>1.8.4<\/h4>\n\n<ul>\n<li>New: locked out of the login? Get a one-time unlock link by e-mail (administrators only), or unlock addresses in Settings &gt; Login Guard.<\/li>\n<li>Improved: login tries during a lockout no longer extend it, and the message shows when the lock ends.<\/li>\n<li>Fix: the Quick File Integrity Check no longer reports optional bundled plugins (Akismet, Hello Dolly) in wp-content as missing core files.<\/li>\n<li>Improved: one clear first-run notice and one menu.<\/li>\n<li>Improved: after buying PRO, a short two-step guide (download, upload &amp; activate) replaces the generic notices; settings are kept when either edition is deleted while the other is still installed.<\/li>\n<\/ul>\n\n<h4>1.8.3<\/h4>\n\n<ul>\n<li>Security: the login limit can no longer be bypassed or misused with fake IP headers; the visitor address behind a proxy is read the safe way.<\/li>\n<li>Security: the plugin's data folder in uploads is now closed to the web.<\/li>\n<li>Tested with WordPress 7.1.<\/li>\n<li>Updated plugin information (author Maroon Horizon Ltd, plugin page on mh.ie).<\/li>\n<\/ul>\n\n<h4>1.8.2<\/h4>\n\n<ul>\n<li>WordPress.org packaging\/compliance refinements (FREE build contains only FREE functionality).<\/li>\n<li>Refined build separation between FREE and PRO for cleaner packaging and better maintainability.<\/li>\n<\/ul>\n\n<h4>1.8.1<\/h4>\n\n<ul>\n<li>Fixed scan bug in Automatic AI Scan &amp; Email Reports<\/li>\n<\/ul>\n\n<h4>1.8.0<\/h4>\n\n<ul>\n<li>Added defensive pruning for abandoned scan-job artifacts (stale\/overflow cleanup) to ensure scan-jobs cannot grow without bound due to interrupted scans.<\/li>\n<li>Added automatic scan-job cleanup, removes scan-job on scan completion or cancel<\/li>\n<\/ul>\n\n<h4>1.7.9<\/h4>\n\n<ul>\n<li>Improved: Saving AI scan settings now reschedules the cron job without running a full scan inside the AJAX request.<\/li>\n<\/ul>\n\n<h4>1.7.8<\/h4>\n\n<ul>\n<li>Security: Added nonce verification for admin actions and improved request validation.<\/li>\n<li>Compatibility: Minor internal refactoring and stability improvements.<\/li>\n<\/ul>\n\n<h4>1.7.7<\/h4>\n\n<ul>\n<li>Improved PRO upgrade UX in FREE build (Checking and updating minor cosmetic details in: code quality, privacy\/external calls, licensing, \u201cfreemium\u201d behavior, readme metadata, and submission requirements).<\/li>\n<\/ul>\n\n<h4>1.7.6<\/h4>\n\n<ul>\n<li>Improved PRO upgrade UX in PRO build (If Signatures is 0, the AI-Powered Deep Scan runs in local-only mode (patterns + heuristics) until user sync the AI model from our mh.ie servers.).<\/li>\n<\/ul>\n\n<h4>1.7.5<\/h4>\n\n<ul>\n<li>Improved PRO upgrade UX in FREE build (Removed the broken \u201cSwitch to PRO now\u201d button).<\/li>\n<\/ul>\n\n<h4>1.7.4<\/h4>\n\n<ul>\n<li>Improved PRO upgrade UX in FREE build (visually more impact).<\/li>\n<\/ul>\n\n<h4>1.7.3<\/h4>\n\n<ul>\n<li>Improved PRO upgrade UX in FREE build (switch button + clear manual steps).<\/li>\n<\/ul>\n\n<h4>1.7.2<\/h4>\n\n<ul>\n<li>WordPress.org compliance updates (privacy disclosure + i18n folder\/textdomain loading).<\/li>\n<\/ul>\n\n<h4>1.7.1<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"Firewall, malware scan &amp; IP blocking for WordPress, with Quick Scan Overall Security Rating, hardening, quarantine and integrity checks. PRO adds AI.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/271486","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=271486"}],"author":[{"embeddable":true,"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/mhlabs"}],"wp:attachment":[{"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=271486"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=271486"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=271486"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=271486"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=271486"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/fa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=271486"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}