描述
VaultShift hardens your WordPress site with a unified security dashboard, real-time threat monitoring, and tools that run locally on your server. Every core module is included and works out of the box after you activate your Free or Cloud key from myapps.wontonee.com.
Optional VaultShift Cloud services (signature sync, IP reputation, cloud spam scoring) stay off by default until you enable them under Settings.
Malware & file integrity scanner
- Full-site file scans in the background — no need to keep a browser tab open
- Daily or weekly scheduled scans, plus on-demand manual scans
- WordPress core checksum verification against the official release
- Database malware scan (options, posts, post meta, comments, users)
- Quarantine suspicious files instead of deleting immediately
- Security score and scan history on the dashboard
- Automatic scan triggers when attacks are detected
Web Application Firewall (WAF)
- Runs as a must-use plugin before WordPress loads, blocking threats early
- Learning, active, and paranoid modes
- Built-in rule sets plus optional cloud rule updates (when Cloud is enabled)
- Block and allow lists, rate limiting, and WAF event logging
- Geo-blocking by country and optional VPN/proxy blocking
Login protection
- Brute-force lockout after failed attempts
- Optional custom login URL to hide
wp-login.php - Google reCAPTCHA v3 when you add your own site keys
- Two-factor authentication (TOTP) for administrator accounts
WordPress hardening
- One-click checklist: disable file editor, limit REST user enumeration, security headers, and more
- Sensible defaults with per-toggle control
- WordPress Site Health tests for scan freshness, WAF status, and backup directory
Activity log
- Tamper-evident log of logins, file changes, plugin updates, and security events
- Filterable admin view and REST API access
- Helps with audits and incident response
Spam protection
- Honeypot, heuristics, and scoring for comments and registration
- Optional cloud spam check when VaultShift Cloud is enabled
- Integrations for common form plugins
Backup & restore
- Create compressed backups of your database and
wp-content - Scheduled or manual backups with retention controls
- Restore from backup history with progress tracking
VaultShift Cloud (optional)
Enable Cloud services under Settings when you want enhanced protection backed by VaultShift servers:
- Up-to-date malware signatures
- IP reputation and VPN/proxy detection
- Cloud-based spam scoring
Remote calls are opt-in only — nothing is sent until you turn Cloud on.
Free vs Cloud keys
VaultShift requires a cloud key to activate (Free or Cloud tier). Keys tie your site to myapps for plan validation. All local security features remain on your server; Cloud keys unlock optional remote services when you choose to enable them.
External services
This plugin may connect to external services when configured or when you opt in.
VaultShift Cloud
Optional malware signature updates, IP reputation checks, VPN/proxy detection, and cloud-based spam scoring when Cloud services is enabled under Settings.
Sends visitor IP addresses, comment metadata/content (when cloud spam check is enabled), and site identification data when those features run.
Service: VaultShift Cloud API at https://myapps.wontonee.com/v1
Terms of use: https://wontonee.com/terms/
Privacy policy: https://wontonee.com/privacy/
myapps cloud keys (VaultShift activation)
Used when you activate a Free or Cloud key during setup or under Settings.
Sends your cloud key and site domain to register and validate your plan.
Service: https://myapps.wontonee.com/api/vaultshift
Terms of use: https://wontonee.com/terms/
Privacy policy: https://wontonee.com/privacy/
Google reCAPTCHA
Used when you enter reCAPTCHA v3 site and secret keys under Login Protection.
Sends the visitor IP address and reCAPTCHA token to Google for verification when someone logs in or registers.
Terms of use: https://policies.google.com/terms
Privacy policy: https://policies.google.com/privacy
ipapi.co
Used for country-based geo-blocking when you configure blocked country codes under Firewall.
Sends the visitor IP address when determining country code.
Terms of use: https://ipapi.co/terms/
Privacy policy: https://ipapi.co/privacy/
WordPress.org API
Used during malware scans to verify WordPress core file checksums against the official release.
Sends WordPress version and locale.
Terms of use: https://wordpress.org/about/gpl/
Privacy policy: https://wordpress.org/about/privacy/
屏幕截图
安装
- Upload the plugin to
/wp-content/plugins/vaultshift/or install via Plugins Add New Upload Plugin. - Activate VaultShift through the Plugins menu.
- Enter your Free or Cloud key from myapps.wontonee.com when prompted.
- Open VaultShift Dashboard to review your security score and run your first scan.
- Optionally enable Cloud services under VaultShift Settings if you use a Cloud key and want remote features.
常见问题
-
Does VaultShift send data to external servers?
-
Most processing runs locally on your server. Remote requests are opt-in: enable Cloud services under VaultShift Settings only if you want optional VaultShift Cloud features. Geo-blocking uses ipapi.co when configured. reCAPTCHA uses Google when you add your own site keys. Cloud key activation sends your key and domain to myapps once during setup.
-
Where is the WAF loaded?
-
On activation, VaultShift installs a must-use plugin at
wp-content/mu-plugins/vaultshift-waf.php. It loads before WordPress core so malicious requests can be blocked early. -
Do I need a paid Cloud key?
-
No. A Free cloud key activates VaultShift and includes all local security modules. A Cloud key adds access to optional VaultShift Cloud services when you enable them in Settings.
-
Can I run scans on a schedule?
-
Yes. Choose daily, weekly, or manual-only under VaultShift Scanner. Scans run in the background via Action Scheduler.
评价
此插件暂无评价。
贡献者及开发者
更新日志
1.1.1
- Database malware scan: options, posts, post meta, comments, users, and usermeta.
- Detects injected scripts, malware markers, and critical option hijacks (siteurl/home/theme).
- Reduced database false positives (trusted embeds, skip WordPress transients).
- Scanner progress uses stage-weighted percentages; more reliable on large sites.
- Faster local scan batch fallback when Action Scheduler is unavailable.
1.1.0
- Cloud key activation: Free and Cloud plans require a myapps cloud key before using VaultShift admin.
- Onboarding modal with Free vs Cloud plan comparison, blurred background overlay, and one-click activation.
- Settings panel shows active cloud key status when registered.
- myapps API integration for register, validate, remove, and plan info.
1.0.3
- Plugin URI points to GitHub; cloud API and legal links use wontonee.com domains (removed vaultshift.io).
1.0.2
- WordPress.org review compliance: removed feature gating, cloud opt-in only, enqueue fixes, path constants, readme external services disclosure.
1.0.1
- Daily and weekly scheduled malware scans.
- WordPress Site Health tests for scan freshness, WAF, and backup directory.
- Backup restore from history, detailed restore progress, and improved queue handling.
- Plugin Check and PHPCS compliance fixes.
1.0.0
- Initial release: security modules and REST API.