Visitor Sentinel

Visitor Sentinel is a security and traffic analysis plugin designed for WordPress sites, offering real-time detection of attacks alongside an active deception layer. Its approach not only identifies malicious activity but also seeks to lure attackers into revealing themselves, enhancing the site's defense mechanisms beyond basic monitoring.

The plugin records detailed information about each site visit, including the visitor's IP address, the specific page accessed, user-agent string, device or browser details, and account type. Visitor Sentinel analyzes every incoming request using multiple heuristics, such as monitoring for unusual request rates, identifying user-agents linked to scanning or attack tools, and detecting attempts to access sensitive resources like wp-config.php, .env, or .git files. It also looks for repeated failed login attempts, patterns consistent with credential stuffing, abuse of XML-RPC, and interactions with invisible honeypot fields embedded in login and comment forms. Additional checks include analyzing the timing of form submissions and monitoring for scanning activity targeting non-existent pages, which typically result in 404 errors.

For each IP address interacting with the site, Visitor Sentinel calculates a risk score based on observed behaviors. When a risk score exceeds a configurable threshold, the plugin automatically enforces a temporary block on that IP address, aiming to prevent further malicious activity. This combination of real-time analysis and automated response provides WordPress administrators with tools to both detect and disrupt potential threats as they occur.

Delivered as a WordPress plugin, Visitor Sentinel is intended for site owners and administrators seeking to strengthen their site's security posture through active monitoring and deception strategies.