Fully free release: authenticator-app 2FA, AI security summary, vulnerability alerts and many fixes. No settings are lost.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3413061,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.jpg":{"filename":"banner-1544x500.jpg","revision":3413061,"resolution":"1544x500","location":"assets","locale":"","width":1024,"height":329},"banner-772x250.jpg":{"filename":"banner-772x250.jpg","revision":3413075,"resolution":"772x250","location":"assets","locale":"","width":1024,"height":329}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.16","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","2.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3751141,"resolution":"1","location":"assets","locale":"","width":1280,"height":1492},"screenshot-10.png":{"filename":"screenshot-10.png","revision":3751141,"resolution":"10","location":"assets","locale":"","width":1280,"height":1095},"screenshot-11.png":{"filename":"screenshot-11.png","revision":3751141,"resolution":"11","location":"assets","locale":"","width":1280,"height":900},"screenshot-12.png":{"filename":"screenshot-12.png","revision":3751141,"resolution":"12","location":"assets","locale":"","width":1280,"height":900},"screenshot-13.png":{"filename":"screenshot-13.png","revision":3751141,"resolution":"13","location":"assets","locale":"","width":1280,"height":195},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3751141,"resolution":"2","location":"assets","locale":"","width":1280,"height":1095},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3751141,"resolution":"3","location":"assets","locale":"","width":1280,"height":1095},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3751141,"resolution":"4","location":"assets","locale":"","width":1280,"height":1095},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3751141,"resolution":"5","location":"assets","locale":"","width":1280,"height":1600},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3751141,"resolution":"6","location":"assets","locale":"","width":1280,"height":1600},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3751141,"resolution":"7","location":"assets","locale":"","width":1280,"height":1095},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3751141,"resolution":"8","location":"assets","locale":"","width":1280,"height":1600},"screenshot-9.png":{"filename":"screenshot-9.png","revision":3751141,"resolution":"9","location":"assets","locale":"","width":1280,"height":1095}},"screenshots":{"1":"Security dashboard with status, AI security summary, firewall, login and uptime overview.","2":"Malware scan results with quarantine and whitelist actions.","3":"File changes: integrity monitoring for core, theme and uploads.","4":"Vulnerability alerts for WordPress core, plugins and themes.","5":"Hardening: 30 rules in three tiers with self-test.","6":"Activity log of logins and admin actions.","7":"General settings.","8":"Scanning settings.","9":"Firewall settings: rate limiting, country blocking, honeypot and IP whitelist.","10":"Two-factor settings: choose which administrators must use 2FA.","11":"Authenticator app setup with QR code on the user profile.","12":"Two-factor code prompt on the login screen.","13":"Docs and Settings links on the Plugins screen."}},"plugin_section":[],"plugin_tags":[1174,1229,55021,600,1909],"plugin_category":[54],"plugin_contributors":[251786],"plugin_business_model":[],"class_list":["post-262454","plugin","type-plugin","status-publish","hentry","plugin_tags-firewall","plugin_tags-login-security","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor-authentication","plugin_category-security-and-spam-protection","plugin_contributors-andeirz","plugin_committers-andeirz"],"banners":{"banner":"https:\/\/ps.w.org\/bearmor-security\/assets\/banner-772x250.jpg?rev=3413075","banner_2x":"https:\/\/ps.w.org\/bearmor-security\/assets\/banner-1544x500.jpg?rev=3413061","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/bearmor-security\/assets\/icon-256x256.png?rev=3413061","icon_2x":"https:\/\/ps.w.org\/bearmor-security\/assets\/icon-256x256.png?rev=3413061","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-1.png?rev=3751141","caption":"Security dashboard with status, AI security summary, firewall, login and uptime overview."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-2.png?rev=3751141","caption":"Malware scan results with quarantine and whitelist actions."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-3.png?rev=3751141","caption":"File changes: integrity monitoring for core, theme and uploads."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-4.png?rev=3751141","caption":"Vulnerability alerts for WordPress core, plugins and themes."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-5.png?rev=3751141","caption":"Hardening: 30 rules in three tiers with self-test."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-6.png?rev=3751141","caption":"Activity log of logins and admin actions."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-7.png?rev=3751141","caption":"General settings."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-8.png?rev=3751141","caption":"Scanning settings."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-9.png?rev=3751141","caption":"Firewall settings: rate limiting, country blocking, honeypot and IP whitelist."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-10.png?rev=3751141","caption":"Two-factor settings: choose which administrators must use 2FA."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-11.png?rev=3751141","caption":"Authenticator app setup with QR code on the user profile."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-12.png?rev=3751141","caption":"Two-factor code prompt on the login screen."},{"src":"https:\/\/ps.w.org\/bearmor-security\/assets\/screenshot-13.png?rev=3751141","caption":"Docs and Settings links on the Plugins screen."}],"raw_content":"\n
Bearmor Security puts straightforward, professional WordPress security tools on small business and WooCommerce sites \u2014 without charging for essential features. The plugin is completely free: no PRO plan, no upsell tiers, no feature locks. Features other security plugins keep behind paid plans are free here: two-factor authentication with an authenticator app, daily vulnerability alerts, a plain-language AI security summary, a web application firewall and file integrity monitoring.<\/p>\n\n
You get one clear dashboard that tells you whether your site is Protected, needs a Review, or needs Action \u2014 and links directly to the setting to fix it. Setup is quick and reversible, and each hardening rule explains what it does and what could break.<\/p>\n\n
Documentation:<\/strong> step-by-step setup guides are at bearmor.eu\/docs<\/a>.<\/p>\n\n Prefer someone to look after it for you? Bearmor also offers WordPress maintenance<\/a> \u2013 updates, monitoring and cleanup by real people. The plugin remains fully free either way.<\/p>\n\n This plugin connects to these services over HTTPS:<\/p>\n\n Yes. Every feature is included. There is no PRO version, no license key and no locked features.<\/p><\/dd>\n Any app that supports standard TOTP codes, such as Google Authenticator, Microsoft Authenticator, Authy, 1Password or Bitwarden.<\/p><\/dd>\n Use one of your 8-character backup codes. If you have no codes left, add The Lockdown tier documents a wp-config.php line that disables the allowlist so you can get back in.<\/p><\/dd>\n The default rules are safe. \"REST API for logged-in users only\" keeps the WooCommerce Store API and Contact Form 7 open, and every rule lists what it might affect.<\/p><\/dd>\n Scans run in the background on WP-Cron. The firewall only does fast pattern checks per request.<\/p><\/dd>\n Plugin code is maintained by its authors and checked by the vulnerability scan instead; Bearmor scans the places attackers usually hide code: core, the active theme, mu-plugins, uploads and root files.<\/p><\/dd>\n Site URL, admin email for alerts, plugin version, uptime pings and, for the AI summary, a short security brief with counts and plugin names. No passwords or visitor data.<\/p><\/dd>\nFirewall<\/h4>\n\n
\n
Login protection<\/h4>\n\n
\n
Two-factor authentication (2FA)<\/h4>\n\n
\n
Malware scanner and file integrity<\/h4>\n\n
\n
Vulnerability alerts<\/h4>\n\n
\n
Hardening (30 rules)<\/h4>\n\n
\n
AI security summary<\/h4>\n\n
\n
Activity log and uptime<\/h4>\n\n
\n
Need a hand?<\/h4>\n\n
External services<\/h4>\n\n
\n
\n
\/wp-content\/plugins\/<\/code>.<\/li>\n\n
Is Bearmor Security really free?<\/h3><\/dt>\n
Which authenticator apps work?<\/h3><\/dt>\n
I lost my phone. How do I log in?<\/h3><\/dt>\n
define( 'BEARMOR_DISABLE_2FA', true );<\/code> to wp-config.php, log in, and set up 2FA again.<\/p><\/dd>\nI locked myself out with the login IP allowlist.<\/h3><\/dt>\n
Will it break WooCommerce or Contact Form 7?<\/h3><\/dt>\n
Does it slow down my site?<\/h3><\/dt>\n
Why are plugin folders not malware-scanned?<\/h3><\/dt>\n
What data is sent to bearmor.eu?<\/h3><\/dt>\n
Where is the documentation?<\/h3><\/dt>\n