Oxyshield

It runs security checks inside your own WordPress admin: file integrity monitoring, malware pattern scanning, a security score with a letter grade, login protection, a lightweight firewall, hardening settings, and recovery tools if something does go wrong. It works from inside your site, not as a hosted service you send data to.

No. Every setting has a plain-English description, the dashboard leads with one score and a Guided Cleanup checklist that tells you what to do first, and most protections (the firewall, core checks, security headers) are on by default.

The firewall and hardening checks that run on every page load are deliberately lightweight – pattern checks on the request, not full file scans. The heavier work (file integrity scans, vulnerability checks) runs on a schedule you control, not on every visitor’s page load.

Oxyshield is not a cloud firewall or network-level WAF, so it doesn’t compete with one. Most sites run it either on its own, or alongside a network-level service, for the file-integrity, recovery-tools and audit-logging side that a network firewall doesn’t cover.

By default, no. It flags file changes and suspicious code for an administrator to review, because automatic removal can break a site when a scanner produces a false positive. You can optionally turn on automatic quarantine for a narrow, curated set of high-confidence rules (things like eval+base64_decode chains) – even then, files are moved to a reversible vault, never deleted, and you get an immediate email either way.

No. All scanning happens locally, inside your own WordPress install. Nothing is uploaded to an external scanning service.

It keeps a hash baseline of your files and compares against it on each scan, and separately checks your WordPress core and plugin files against WordPress.org’s own official release checksums – so a modified file is caught even if your own baseline was captured after the tampering happened.

WordPress.org doesn’t publish official checksums for themes the way it does for plugins, so themes are covered by change tracking and signature scanning instead of a checksum comparison.

It’s the opposite of suspicious, if you know why: a malware scanner has to contain the literal patterns it searches for (like the text “eval” next to “base64_decode”), and antivirus/host-level scanners sometimes flag a security plugin as malware just because its own detection rules are written in plain text. The higher-risk built-in rules are stored base64-encoded and only ever decoded and passed to a pattern-match function – never executed. You can decode any rule yourself to see exactly what it checks for.

Common request-level probes: SQL-injection attempts, local file inclusion, PHP execution probes, known scanner and exploit-tool user agents, and author-enumeration scans (a common first step attackers use to find valid usernames to target).

They can, if someone repeatedly enters the wrong details from the same IP. You control the attempt limit and lockout length, or can turn lockouts off entirely.

Yes, it needs your site proxied through Cloudflare. Oxyshield reads the country code Cloudflare already attaches to each request – there’s no separate location database to keep updated, and no extra lookup per visitor.

An optional sync of your firewall rules to a Cloudflare Worker you deploy yourself, so malicious requests get blocked at Cloudflare’s network before they ever reach your hosting. It’s a one-time setup in your own Cloudflare account – Oxyshield doesn’t route your traffic through anyone else’s server.

No – it includes solid hardening and login protection, but it isn’t a cloud WAF or network firewall in the full sense of the term.

Yes – that’s what the Post-Hack Tools are for: force-logout every user, email password resets, rotate security keys, reinstall WordPress core, and bulk-quarantine suspicious files, all from one screen, plus one-click reinstall of any WordPress.org plugin or theme straight from the official source.

It’s moved to a protected vault folder, not deleted. You can review, restore, or permanently delete it from there once you’re sure.

Yes – downloadable HTML and JSON incident reports, plus a JSON evidence bundle, are built in for exactly that handoff.

Settings, file hash baselines, scan summaries, vulnerability and reputation results, security logs, quarantine metadata, and administrator two-factor secrets – all in your own WordPress database. Quarantined files sit in a protected folder under wp-content.

Only what your enabled features need: WordPress.org for checksums/updates, the public WPVulnerability API for CVE lookups (sent as component type/slug/version only – your site’s own address is deliberately left out), and a Spamhaus DNS lookup for your own domain’s reputation. Anything beyond that (a remote rules feed, a webhook, Cloudflare Turnstile CAPTCHA, Oxyshield Edge) only ever activates if you turn it on and configure it yourself.

Everything Oxyshield created is removed on uninstall: settings, scan baselines, stored results, the security log table, scheduled tasks, and the quarantine vault.