Shakvaro Shield

Shakvaro Shield is a WordPress security plugin that combines a firewall, hardening checks, login protection, malware scanning, and a vulnerability feed in one package. It is described as a free, GPL-2.0+ plugin for WordPress 6.5+ and PHP 7.4+, with multisite support.

Its firewall uses a mu-plugin loader that runs before WordPress. The page says six built-in rules block SQL injection, cross-site scripting, directory traversal, file inclusion, PHP code injection, and user enumeration. The hardening audit rolls 15 checks into an A–F grade and offers one-click fixes for items such as file edit lockdown, salt rotation, REST user exposure, XML-RPC, and security headers. Login security includes progressive lockouts, TOTP two-factor authentication with backup codes, a custom login URL, Turnstile and reCAPTCHA, HIBP password gating, email OTP, magic links, and WebAuthn passkeys.

Shakvaro Shield also includes malware scanning with a signature database and heuristic analysis, plus optional Google Safe Browsing URL reputation checks. Detected threats are quarantined to uploads, and file integrity checks compare WordPress core and plugin files against the official WordPress.org checksum API, with tampering shown in the Threats tab. The vulnerability feed pulls advisories from WPScan, Patchstack, and NVD when enabled, and matched CVEs appear next to each plugin. It also provides activity and request logs, a live-stream tab over SSE, CSV export, and PCI and GDPR compliance reports generated on demand. Notifications can go by email, SMS through Twilio, PagerDuty, Datadog, or generic webhook. The page says all of these channels are opt-in and configurable.

Delivery is through a downloadable plugin for WordPress, with installation by upload or from WordPress.org. The product says it stores logs, scan results, and settings on the user’s WordPress install, and that the network-intel feature is off by default unless explicitly enabled. The page also states that the plugin is ~1 MB compressed, uses a PSR-4, container-driven, namespaced architecture, and is free forever under GPL-2.0+.