Finds the problem. Changes nothing on its own.
Ensomedia Security checks your WordPress for malware, tampered files, known vulnerabilities and risky settings, and tells you in plain words what to fix. It locks out addresses that keep guessing passwords and adds two-factor login. Files, users and settings change only when you press a button or turn on a switch.
In your dashboard, go to Plugins, Add New and search for Ensomedia Security. The directory lists it as Ensomedia Security powered by shieldwave.io, and updates come from there.
Still on ShieldWave Security 3.x, downloaded from here before? It cannot update itself. Install Ensomedia Security from WordPress.org and keep it active, then deactivate and delete ShieldWave Security on the Plugins screen. Your settings, results and two-factor set-ups carry over.
- Price
- Free
- Account
- Not needed
- Dashboard
- Free for every connected site
- Languages
- English and 16 more
- Version
- 1.1.30
- Requires
- WordPress 6.2, PHP 7.4
- License
- GPLv2 or later
25 checks, in plain words
Every finding says what it means, why it matters and how to fix it. A file that matches the copy WordPress.org published is trusted outright; anything the scanner is unsure about is marked for a closer look instead of raising an alarm.
Malware and files
- Malware and web shells in files WordPress.org cannot vouch for
- WordPress core files against the official checksums
- Plugin files against the WordPress.org checksums
- Theme files against the WordPress.org release packages
- New and changed files against a recorded baseline
- PHP files and execution rules in uploads
Vulnerabilities and software
- Known vulnerabilities, premium plugins and themes included (opt-in)
- Plugins closed on WordPress.org, and abandoned ones
- Unused plugins and themes still installed
- WordPress updates
- Plugin and theme updates
- PHP version support and the php2shell fix
Content and exposure
- Scripts, hidden frames and spam links injected into content
- Backups, database dumps, logs, .env and .git left readable
- A public list of your user names
- Scheduled tasks that no plugin owns
- Your home page and checkout as visitors, Googlebot and search visitors see them
Accounts and configuration
- Administrator accounts
- Open user registration
- wp-config.php settings
- Debug output shown to visitors
- The built-in file editor
- XML-RPC
- HTTPS for the site and the dashboard
- A recent backup, from a backup plugin or your host
It also closes common ways in
Login protection is on for new installs, and each part of it can be switched off. Everything else here is off until you turn it on.
Login protection
- After 5 failed logins from one address (you choose 3 to 50), that address waits 20 minutes (you choose). The lock is always temporary. An address many visitors share, such as a proxy in front of the site, is not locked. The limit per user name still applies.
- Trusted addresses are never locked. The address that switches it on is added for you, so a mistyped password from there never locks you out.
- User names stay private: the login form stops confirming them, and the REST API, the sitemap and the ?author= trick stop giving them out to visitors who are not logged in.
Two-factor login
- A one-time code from an authenticator app after the password, for each administrator who turns it on.
- You confirm a working code before it is ever required, and get ten single-use recovery codes.
- Passkeys as the second step or, if you turn it on, to sign in without a password. Needs HTTPS.
- A shell rescue,
wp shieldwave two-factor disable, if a phone and its codes are both lost.
Hardening switches
- Turn off the plugin and theme file editor, so a stolen administrator password cannot plant code through it. Updates keep working.
- Turn off XML-RPC, which closes bulk password guessing and pingback floods through it. ShieldWave warns first when a plugin you use, such as Jetpack, needs it.
- One switch each also blocks PHP in the uploads folder, with Check now to test it, blocks PHP in wp-includes and in wp-content outside plugins, themes, mu-plugins and uploads (Apache and LiteSpeed), sends the security headers your server does not send yet and hides the WordPress version. All are off until you turn them on, and none edits wp-config.php.
Sign-in checks and spam traps
- All off until you turn them on. A bot check on login, registration and password reset, the WooCommerce forms included: a small puzzle the browser solves, or Cloudflare Turnstile with your own keys.
- New passwords found in data breaches are refused. Only the first 5 characters of the password’s SHA-1 hash leave the site.
- A hidden login address of your choice, with a way back through wp-config.php or
wp shieldwave login-url off. - A minimum length for new passwords (12 characters, or your choice from 8 to 64), sign-out of administrators after the idle time you set, and an email to the account owner when a sign-in comes from a browser that account has not used before.
- Spam traps: a hidden field and a signed time stamp catch forms filled in by a program in comments, registration, Contact Form 7 and WPForms.
Request firewall
- Off until you turn it on. Local rules for common injections and executable uploads, IP, range and country blocks, request and 404 limits, and narrow exceptions.
- It checks requests before other plugins load, and on CGI or FastCGI hosts before WordPress. It sends no request data anywhere.
- Start with Record only, read its history, then switch to Block. It runs on your server and is not a cloud WAF.
- Request limits also count the connection itself, so a forged forwarding header does not escape them. If the firewall turns itself off, you get a History entry and an email.
- A separate switch applies your own list of bad addresses. It is off by default, follows the firewall mode and never refuses trusted proxies, Cloudflare edges, verified search engine crawlers or logged-in users.
When a new flaw is published
- All off until you turn them on. Block critical virtual patches automatically: a patch for a critical flaw that ShieldWave reviewed as safe to block starts blocking at once, without waiting for your choice per patch. Virtual patches need the live threat feed.
- Security updates for every plugin with a known vulnerability, or only for the ones you choose. When WordPress does not list the fixed release yet, the plugin asks WordPress to check for updates now. WordPress 6.6 or newer.
- Edge rules (Cloudflare) for flaws no plugin can stop, such as flaws in PHP itself: kept in your Cloudflare zone with your API token, or shown to paste by hand, with a note for your host.
Full protection and Save all changes
- Full protection, the first panel of Settings, turns on in one step what protects the site and cannot lock you out. Its button first shows what changes and what leaves the site, and nothing changes until you confirm.
- It turns on login protection, security headers, alerts, scans of content and images, and decoys, turns the file editor and XML-RPC off, blocks PHP in uploads and hides the WordPress version. The request firewall goes to blocking mode with limits of 240 requests and 60 missing pages a minute per address (limits you already set stay), and loads before WordPress where the server allows it. The bot check and spam traps also go to blocking mode. It also turns on the breached password check, known-vulnerability lookups, the live threat feed and virtual patches, with critical patches that ShieldWave reviewed as safe to block set to block.
- The login address stays where it is. XML-RPC stays open while Jetpack is active, and HSTS stays off without HTTPS.
- It does not turn on security updates for every vulnerable plugin, edge rules for Cloudflare, required two-factor login or passkey sign-in without a password. The AI second opinion has its own box, unticked.
- Save all changes saves every Settings group you changed with one button, and each group keeps its own Save button. It stops at the first error and keeps the changes of the groups not saved yet. A password or code typed in its bar confirms the groups that lower protection.
Activity log
- Records sign-ins, accounts created and deleted, role changes, who edited a post or page (never its text) and plugin and theme changes. Filter by type and person, export as CSV.
- Each entry carries a keyed hash of the one before, so an entry edited or deleted outside ShieldWave shows.
Optional, and off until you turn it on
Seven outside services, each off until you turn it on. The first three come from shieldwave.io and keep ShieldWave current between releases. Each one says exactly what it sends before you switch it on. Connecting a shieldwave.io account is described below.
Known vulnerabilities
Opt-inChecks every installed plugin, theme and WordPress version against published vulnerabilities, premium ones included, and names the release that fixes each one for your version. The data comes from Wordfence Intelligence; each result links to its record. Sent: versions and folder names, never your site address.
Signed threat feed
Opt-inNew detection rules, file fingerprints, virtual patches and request firewall rules reach your site between plugin releases. The plugin downloads the feed once an hour and checks every 15 minutes whether an urgent update is out. It uses a feed only if its Ed25519 signature matches a key built into the plugin, the one in use or a second key kept offline in case the first is lost, and a feed can never switch off the plugin’s critical rules. A virtual patch enters the feed only after we read the advisory and the vendor’s fix and test it against ordinary requests. On your site it records matching requests until you let it block them. With automatic blocking turned on, a critical patch we marked safe to block blocks at once. On a plugin version with a known flaw, the feed can switch off named parts of this plugin until you update, and WordPress shows a notice while it does. The firewall, virtual patches, login limits, two-factor login and scanning are never among them. Sent: the plugin version only.
AI second opinion
Opt-inFor a file the rules cannot judge, a redacted excerpt goes to a language model for a verdict in plain words. Host names, email addresses and anything like a key or password are removed first, and wp-config.php is never sent. An AI verdict can settle an unclear file but never overrules one the rules confirm as malicious.
Breached password check
Opt-inWhen a password is set, and weekly at sign-in, the first 5 characters of its SHA-1 hash go to the Pwned Passwords service of Have I Been Pwned. The plugin compares the rest on your server. An account with such a password is asked to change it, never blocked. Sent: 5 hash characters, never the password or the user name.
Cloudflare Turnstile
Opt-inOne of two bot checks. The built-in one, a puzzle the browser solves, sends nothing anywhere. With Turnstile, the login forms load Cloudflare’s script, and your server sends each answer with your secret key to Cloudflare to check it. It needs the keys of your own Cloudflare account. If Cloudflare cannot be reached, the form goes through.
Edge rules (Cloudflare)
Opt-inFor flaws no plugin can stop, such as flaws in PHP itself. The plugin takes edge rules from the threat feed and keeps those that concern your PHP version and installed plugins. Without a token it shows each rule to paste in Cloudflare by hand. With an API token you create for one zone (Zone WAF Edit and Zone Read), it keeps them in your zone’s custom rules, changes only rules whose description starts with “ShieldWave:” and removes them when they stop applying or you turn the feature off. The token is stored encrypted and sent only to api.cloudflare.com. Sent to Cloudflare: your token, the host name and the rules. There is no edge rule for php2shell. Updating PHP is the fix.
Slack and webhook alerts
Opt-inEach alert also goes to a Slack incoming webhook or to a public https address of your own, with the same rules and daily limits as the emails. Off until you save an address. A webhook can carry an HMAC-SHA256 signature made with a secret you choose. The addresses and the secret are stored encrypted and never shown again. Sent to that address: the site address, the time and the alert text, which can name accounts, email addresses, visitor addresses and file paths.
Connect to shieldwave.io, if you want
The plugin reads your files. It cannot see your site the way a visitor or a bot does. Connecting adds that outside view, in three steps.
1. Connect
In WordPress, open ShieldWave, Settings, ShieldWave account and press Connect with shieldwave.io. Sign in or create a free account and confirm. You come back to WordPress connected, with no key to copy.
2. See inside and outside together
Your shieldwave.io dashboard shows the plugin’s score and open problems next to the outside scan: 20+ checks run from the outside, with no password and no access to your server. It shows, for example, whether someone can send mail as your domain, how HTTPS and the security headers are set, and which files anyone can download. The connection also confirms the domain is yours, which the full outside scan needs.
3. Get a report when you need one
The full outside scan costs $9 once, with no subscription: a report you can read and a brief your developer can price. A free account shows every connected site in one dashboard. Pro, $12 a month, adds the full outside scan of up to 25 sites, scheduled checks and reports. See the plans
The plugin stays free without it. All 25 checks, scheduled scans, email alerts, login protection and two-factor login stay free, with no limits. The dashboard cannot change anything on the site, and Disconnect removes the site and its results from shieldwave.io.
While connected, the home page carries an invisible tag that confirms the domain is yours. Sent: the site’s id, address and versions, the score, the problems found and the installed plugins and themes. Never sent: posts, pages, comments, user names, email addresses or passwords.
See what the internet sees of your site, free and without an account
Alerts that respect your attention
One email per scan, only for problems that are new or got worse, never twice for the same one, and at most four a day. A check that could not run is reported as not run, never counted as passed. With a Slack or webhook address saved, the same alerts go there too.
Do not take our word for it
The transparency page lists what runs on your site, what it never does and exactly what leaves your server. The threat feed can be verified with a short script that has the plugin’s public key pinned inside it.
curl -O https://shieldwave.io/verify/shieldwave-verify-feed.mjs node shieldwave-verify-feed.mjs
What is new
- 1.1.3012 November 2026
Full protection, the first panel of Settings, turns on in one step, after a review, what protects the site and cannot lock you out. The login address stays where it is. Save all changes saves every Settings group you changed with one button. Settings can be exported to a JSON file and imported on another site, with no secrets in the file. Alerts can also go to Slack or a webhook. New login options: a minimum password length, idle sign-out for administrators, an email on a sign-in from a new browser and the bot check on WooCommerce forms. New switches block PHP in wp-includes and the rest of wp-content and hide the WordPress version. The firewall counts the connection itself in its limits, can apply your own list of bad addresses and catches more injections. The scanner reads JavaScript modules, scripts in SVG files and shell scripts, and a reported rule can be cut out of .htaccess or .user.ini with a preview, a backup and undo. Virtual patches can cover numbered form fields, and the plugin pins a second feed signing key, kept offline. The new options are off until you turn them on.
- 1.1.2928 October 2026
Optional automatic blocking for virtual patches of critical flaws that ShieldWave reviewed as safe to block. The threat feed checks for an urgent update every 15 minutes, and Settings warn when it is more than 6 hours old. On a plugin version with a known flaw, the feed can switch off named parts of this plugin until you update. Security updates can cover every plugin with a known vulnerability. Optional edge rules for Cloudflare. When the site’s PHP is below the php2shell fix, administrators see a warning at once. It reads the version number only, so it asks you to check with your host. A notice says when the PHP process serving the page still runs a file replaced on disk, which usually means PHP was updated without a restart. It checks only that process and does not show whether the fix is installed. With WP_DEBUG on, WordPress 6.7 and later no longer show a notice about translations loading too early. The new options are off until you turn them on.
- 1.1.2822 October 2026
The WP-CLI rescue commands for the login address, the bot check and two-factor login work under the names the Settings screen gives. An account whose only second step is a passkey is told how to get back in if the device is lost. The custom login address notice says the address was emailed only when the email went out. Behind Cloudflare, country blocking works without typing in Cloudflare’s address ranges. Translations reviewed in all 16 languages.
- 1.1.2722 October 2026
Optional passwordless sign-in with a passkey, a bot check on login, registration and password reset, a check of new passwords against known breaches, a custom login address and spam traps for comments, registration, Contact Form 7 and WPForms. All start off. The activity log now records sign-ins, account and role changes, edits and plugin changes, and a new check says when there is no backup from the last 7 days.
- 1.1.2621 October 2026
An optional request firewall, off until you turn it on: rules for common injections and executable uploads, IP and country blocks, request limits and narrow exceptions. Start with Record only, check the history, then switch to blocking. It runs on your server and sends no request data.
- 1.1.2521 October 2026
After activation the plugin asks once whether to turn on vulnerability alerts, the threat feed and virtual patches, and says what leaves the site. The AI second opinion stays a separate choice. Code injected into a theme, your own plugins, uploads, posts or options can be removed: you see the exact change, a backup is kept and every cleanup can be undone.
- 1.1.2421 October 2026
The PHP version check compares your version with the fix for php2shell (CVE-2026-109618 and CVE-2026-109619), which PHP released on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. An older version is reported as high. Hosts often patch without changing the version number, so the finding asks you to check with your host.
- 1.1.2320 October 2026
Fewer false alarms. The virtual patches file the plugin writes itself, the cache files of your own caching plugin, the handler cPanel writes for PHP on LiteSpeed and settings that a caching or SSL plugin adds to wp-config.php are no longer reported as high, and uploading the plugin’s ZIP over the old version no longer shows a false high. Advice no longer says to delete what you cannot identify; it says to ask your developer or host and keep a copy. Unused themes can be deleted from their finding. Content checks of very large posts are fast on PHP 8.2 and older.
- 1.1.2119 October 2026
A changed core, plugin or theme file can be replaced with its WordPress.org original in one click; the changed file stays in quarantine. A new check reads the home page and checkout as a visitor, as Googlebot and as a visitor from search. Every site option, Code Snippets and account data are read for hidden code, administrators hidden from the user list are found, and turning protection off asks for your password. With a connected account, decoy hits appear in the shieldwave.io dashboard as a keyed hash of the address.
- 1.1.2016 October 2026
Two false reports fixed: PHP printing errors on pages when display_errors is off for the site’s folder, and a changed .htaccess after WordPress rewrote only its own block of it.
- 1.1.1916 October 2026
Decoys, off until you turn them on: login names no account has and a path in robots.txt that nothing links to; any use is refused, logged and emailed. Detection of fake CAPTCHA pages that ask to paste a command (ClickFix), fake browser updates, loaders that read their code from a blockchain contract (EtherHiding) and card skimmers, in files and in stored content.
- 1.1.1812 October 2026
Virtual patches and security updates, both off until you turn them on. With the live threat feed on, a small must-use file stops requests that exploit a known vulnerability of an installed plugin; each patch only records matching requests until you let it block them. Security updates install a release that fixes a known vulnerability through WordPress’s own automatic updates (WordPress 6.6 or newer). Unused plugins and unused themes are one finding each, so the Overview and shieldwave.io show the same count. No PHP warning on hosts with a strict open_basedir, and an update installed from a ZIP no longer makes every file look changed.
- 1.1.1712 October 2026
The score follows the same severity bands as shieldwave.io: an open critical finding keeps it at 39 or below, a high one between 40 and 59. File-dropper backdoors are detected.
- 1.1.1612 October 2026
One score everywhere: the Overview, the weekly email, WP-CLI and shieldwave.io show the score stored with the last scan. A known vulnerability is rated by the access it needs, and one cause gives one finding.
- 1.1.1512 October 2026
What the scanner could not see is a note outside the score. A file counts as downloadable only when your server returns the file’s own first bytes. One grade ladder with shieldwave.io: A from 90, B from 80, C from 60, D from 40.
- 1.1.1411 October 2026
Plugins their authors ship outside WordPress.org, such as Advanced Custom Fields from WP Engine, are compared with the author’s published source. Missing files are one finding per plugin or theme, and severities follow what someone could do on the site now.
- 1.1.139 October 2026
No false alarms right after an update. Six malware rules were narrowed after a sweep of 147,858 files from the 200 most popular WordPress.org plugins, and a security review of the whole plugin was fixed in this release.
- 1.1.128 October 2026
Quarantine with Restore, PHP blocking in uploads, security headers, two-factor login required for chosen roles, passkeys and a list of sessions. Each is off until you turn it on or press its button. On multisite the plugin is network activated.
- 1.1.108 October 2026
Login limits per user name and on password reset requests, trusted proxies, an activity log whose entries are chained by hashes and can be exported as CSV, and the WordPress privacy tools. The AI second opinion removes more before anything is sent.
- 1.1.98 October 2026
Delete unused plugins from their finding, and eight fewer false alarms.
- 1.1.87 October 2026
Fixes a scan error on hosting whose PHP has no tokenizer extension.
- 1.1.77 October 2026
Findings say which plugin, theme or folder a file is in and what to do there. An old ShieldWave copy is no longer reported as malware.
- 1.1.67 October 2026
Fixes the screens on a multisite network, and two old WordPress records are no longer reported as vulnerabilities.
- 1.1.57 October 2026
The site and shieldwave.io agree on a language: a connected account takes the site’s language for its emails, reports and dashboard.
- 1.1.46 October 2026
Known-vulnerability checks and the threat feed run every hour instead of every three.
- 1.1.36 October 2026
Plain images in uploads are no longer reported as PHP files.
- 1.1.25 October 2026
The screens keep the size of the WordPress admin on large monitors: a wider window gives the lists more room instead of bigger letters. The header, the status band and the lists share one edge, and the planet shows more bot traffic aimed at your site.
- 1.1.130 September 2026
The automatic scan stays on the hour you chose when the clocks change or you pick another time zone; it used to drift by an hour. Links to shieldwave.io carry campaign tags, and after a scan the Overview shows one plain line about the free outside check of your site.
- 1.1.029 September 2026
Connect the site to shieldwave.io in one click from the plugin's Settings, with no key to copy. A free account shows one site in the dashboard, and the connection confirms the domain is yours from an invisible tag on the home page. Disconnecting removes the site and its results from shieldwave.io. The old ShieldWave Security can be removed without losing its settings and results.
- 1.0.329 September 2026
A clearer Overview in the look of shieldwave.io, with screens that fit large monitors and phones.
- 1.0.229 September 2026
Alert emails display correctly in Outlook on Windows, in light and dark mode.
- 1.0.129 September 2026
The plugin speaks 16 languages besides English, including Arabic with a right-to-left layout.
- 1.0.028 September 2026
In the WordPress.org plugin directory as Ensomedia Security powered by shieldwave.io, with updates from there. The numbering starts again at 1.0.0; the versions below were downloads from shieldwave.io.
- 3.6.627 September 2026
The plugin no longer takes instructions from outside your site: the ShieldWave dashboard shows results but cannot start a scan or change a setting, and the signed wake-up route is gone. Every database query is prepared, table names included, so WordPress 6.2 or later is required.
- 3.6.527 September 2026
Listed on WordPress.org as Ensomedia Security powered by shieldwave.io. Screens and settings are unchanged.
- 3.6.427 September 2026
The number of things to do sits centred in the toolbar shield.
- 3.6.326 September 2026
Readme and comment wording only, for the WordPress.org review: API endpoints are named as plain paths, and comments say "script tag" in words. No behaviour change.
- 3.6.226 September 2026
Security fixes from our own review: multisite is now protected network-wide instead of only the main site; a remote dashboard change can only raise protection, never lower it; turning two-factor off or issuing new codes asks to confirm again; wrong codes now escalate and email the account owner; an AI verdict can only soften an unclear finding by one step; and two-factor secrets are encrypted in the database when the server’s PHP has libsodium.
- 3.6.126 September 2026
Security fix from our own review: some login forms, a request with an extra header and XML-RPC could sign in with the password alone although two-factor was on. Every sign-in now asks for the code, and a successful login no longer resets the failed-login count.
- 3.6.025 September 2026
Hardening switches: turn off the file editor and XML-RPC in one click, without editing wp-config.php. Findings open the switch that fixes them.
- 3.5.525 September 2026
Login protection now keeps user names out of the REST API, embeds and the sitemap for visitors who are not logged in, as it promised.
- 3.5.425 September 2026
A repeat scan checks flagged files again instead of marking them resolved; plugins a drop-in needs are never called unused; turning login protection on trusts your address.
- 3.5.325 September 2026
An AI opinion can never soften a finding the rules or the known-bad list confirm.
- 3.5.225 September 2026
An AI verdict can no longer lower a file the rules confirm as malicious.
- 3.5.125 September 2026
Requests to ShieldWave no longer carry your site address, which WordPress adds to outgoing requests by default.
- 3.5.025 September 2026
Two-factor login with authenticator-app codes and recovery codes.
- 3.4.025 September 2026
Login protection: temporary lockouts after repeated failed logins, and no more user-name enumeration.