Setting up Demfilz Security

What this plugin does

Demfilz Security is a lightweight security plugin for WordPress with protections built specifically for WooCommerce stores: brute-force lockouts and email two-factor on the login, a firewall with IP block/allow lists and malicious request filtering, hardening switches, core file integrity scans against the official wordpress.org checksums, a filterable activity log, and WooCommerce defences against card testing and fake orders. The WordPress protections work on any site — the WooCommerce features switch on automatically when WooCommerce is active.

Step 1 — Install & activate

• Download the plugin .zip (v1.0.0).
• In WordPress admin, go to Plugins → Add New → Upload Plugin.
• Choose the .zip, click Install Now, then Activate.
• Find the settings under Security in the admin menu.

Step 2 — Review the defaults

Sensible protections are already on the moment you activate — you don't have to configure anything for the basics to work. Open Security and walk through each tab so you know what's running on your site.

Step 3 — Allowlist your own IP

On the Firewall tab, add your own IP address to the allowlist (CIDR ranges are supported). This is the recommended first move for peace of mind — it keeps you clear of lockouts and firewall rules while you experiment with the settings.

Step 4 — Tune each protection

Login protection

• Brute-force lockouts — limit failed login attempts per IP; repeat offenders are automatically escalated to a 24-hour block. Lockouts expire on their own (20 minutes by default).
• Email two-factor authentication — require a 6-digit emailed code for the roles you choose (administrators, shop managers…).
• Login honeypot — an invisible field that instantly rejects most bots.
• Generic login errors — stop telling attackers whether the username or the password was wrong.
• The protection covers wp-login.php, XML-RPC and the WooCommerce My Account login.

Firewall

• IP blocklist and allowlist with CIDR range support.
• Malicious request filtering — heuristic signatures for SQL injection, path traversal, cross-site scripting and code-execution probes in URLs, multi-decoded to catch obfuscation. It's a tripwire for opportunistic scanners, not a substitute for keeping plugins updated. Administrators are exempt, and you can disable this filter separately from the rest of the firewall.
• Attack-tool user agent blocking (sqlmap, nikto, wpscan and friends) — optional.
• User enumeration blocking — stops ?author=N probing and hides the REST users endpoint from visitors.
• Disable XML-RPC entirely with one switch — leave it on if you use Jetpack.

Behind Cloudflare or a reverse proxy?

Enable “Behind a trusted proxy” on the Firewall tab so the real client IP is used. For Cloudflare, set the header to CF-Connecting-IP (recommended) — it carries a single, proxy-set client IP that cannot be spoofed. True-Client-IP and X-Real-IP work the same way. Only turn this on when a proxy you control fronts all traffic.

If you must use X-Forwarded-For (which can contain several addresses), also fill in Trusted proxy IPs with your proxy or load-balancer ranges. The plugin then skips those and takes the nearest address your infrastructure did not add, so a client cannot forge their IP by prepending fake entries. Leaving it on X-Forwarded-For without listing your proxies can either let attackers evade per-IP blocking or collapse every visitor onto one IP — use CF-Connecting-IP instead whenever you can.

Hardening

• Hide the WordPress version.
• Disable the plugin/theme file editors.
• Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, optional HSTS.
• Disable pingbacks (XML-RPC DDoS amplification) and, optionally, application passwords.

File integrity scanning

• Compares every core file against the official wordpress.org checksums for your exact WordPress version and locale.
• Flags modified core files, missing core files, unexpected files inside wp-admin / wp-includes, and PHP files hiding in your uploads folder.
• Choose daily or weekly scans, run a one-click manual scan any time, and turn on email alerts if you want to be notified of findings.

Activity log

Logins, failed logins, lockouts, firewall blocks, user and role changes, plugin and theme changes, core updates, password resets and scans all land in a filterable log. Set the retention to suit how much history you want to keep.

WooCommerce protection

These settings appear when WooCommerce is active:

• Card-testing defence — automatically block IPs that rack up failed payments, and rate-limit checkout attempts per IP. Alerts can notify you when card testing is detected.
• Checkout & registration honeypots — reject bot orders and fake customer accounts.
• Disposable email blocking — refuse throwaway email addresses at registration and checkout (built-in list plus your own additions).
• Order blocklist — block checkout by email address, email domain, IP/CIDR or phone number.

Troubleshooting