Description

Rapid Security Manager is a local-first WordPress security plugin with a source-aware Web Application Firewall, encrypted TOTP two-factor authentication, structured Content Security Policy, security headers, WordPress hardening, local WAF and CSP logs, optional local GeoIP enrichment, and diagnostics.

No Rapid Security Manager account or online security service is required. Security events and uploaded GeoIP data remain on the WordPress installation. Rapid Security Manager does not include telemetry, does not send logs to the developer, does not bundle a GeoIP database, and does not use an online GeoIP lookup API.

The Free plugin owns the shared request engine and WAF event handling used by compatible add-ons. Optional hourly CSP Log email notifications use a shared Free/Core mail service and one Rapid Security Manager WordPress Cron task. The Diagnostics page performs no external HTTP self-tests and does not automatically change security settings.

Current Free features include:

Optional per-user TOTP two-factor authentication using standard authenticator apps.
Pre-authentication login challenge: after a correct password, WordPress authentication cookies are issued only after the required TOTP/recovery verification succeeds.
Authenticated encryption for stored TOTP secrets using AES-256-GCM or Sodium Secretbox; Rapid Security Manager intentionally has no plaintext/Base64 secret-storage fallback.
Ten one-time recovery codes by default, stored only as password hashes and shown in plaintext only once through a short-lived display token.
Optional 30-day trusted devices with random browser tokens stored only as keyed hashes, User-Agent binding, per-user management, rename/removal, and automatic revocation after password changes.
TOTP replay protection using the last successfully consumed time step, plus per-user/per-client-IP failed-attempt throttling.
Account-owner setup and management from the WordPress user profile; administrators may reset another user’s 2FA for recovery but cannot view or provision that user’s secret.
Basic Web Application Firewall with Log Only and Enforce modes.
Source-aware SQL injection, XSS, LFI/directory traversal, sensitive request-path and malicious scanner User-Agent rules.
Editable one-pattern-per-line User-Agent and suspicious-request lists with current-default restoration and non-destructive migration of earlier additional patterns.
Manual IPv4/IPv6 IP/CIDR allow and block rules using the centralized Client IP resolver.
Narrow WordPress classic editor, block editor, comment and WordPress 7.1 media field exemptions that do not create a broad authenticated/admin/REST bypass.
Grouped local WAF Log with 30-day default retention, a 10,000-row hard cap, search, pagination and configurable display columns.
WAF Log stores rule metadata, short evidence labels and redacted request targets including query strings; DB-IP country enrichment is added when a local database is installed.
Optional, off-by-default redacted samples of the original field that triggered a detection, up to 16 KiB, with a configurable Payload display column and display-only Default Settings restoration.
Configurable observation-only logging for excessive request rates, failed authentication, password-reset requests and unique-path 404 reconnaissance. These Free monitors never block requests or IP addresses, even in Enforce mode.
Short-lived keyed-hash counters in a separate Free/Core table, with bounded grouped WAF Log updates at every completed threshold batch and per-feature handoff only while a compatible add-on actively replaces that monitor. The settings page shows only monitors still owned by Free/Core.
Uninstall setting to keep the Free/Core WAF Log as a Unix-timestamp-suffixed database archive instead of deleting it; complete deletion remains the default.
Extensible Free/Core WAF rule registry for later Pro rules without a duplicate WAF engine.
Central Client IP resolver shared by security modules.
REMOTE_ADDR trust anchor with opt-in trusted proxy detection.
Verified Cloudflare CF-Connecting-IP handling and right-to-left X-Forwarded-For trust-chain evaluation.
IPv4/IPv6 address and CIDR support with additional administrator-defined trusted proxy ranges.
Background Cloudflare IPv4/IPv6 range refresh with bundled fallback ranges and no remote lookup during normal requests.
Dedicated Network admin page for client-IP detection and trusted proxy configuration.
GeoIP admin page with secure DB-IP Lite Country .mmdb upload, replacement and removal.
Staged DB-IP validation before replacement, including MMDB type and country lookup self-tests.
Local DB-IP Lite Country lookup is the only built-in provider; compatible add-ons can register another local provider through the shared fallback-aware GeoIP engine.
Request-local GeoIP cache plus external persistent object-cache support without creating per-IP WordPress transients.
Security Headers with Runtime and Apache/LiteSpeed Cache Compatibility delivery.
X-Content-Type-Options, optional X-Frame-Options, Referrer-Policy, optional HSTS and Permissions-Policy.
Structured front-end Content Security Policy.
Report Only and Enforce CSP modes.
WordPress 7.1 compatible worker-src support that retains blob: for client-side media processing.
Local same-site CSP report endpoint with exact site-host validation.
CSP report request-size and batch limits.
Atomic database-backed CSP report rate limiting.
Grouped local CSP Log with retention and a maximum of 200 grouped entries.
Security-focused CSP logging stores the client IP address and User-Agent locally while discarding URL query strings, fragments and credentials.
Guided CSP source review from clickable Blocked URI values, with a nonce-protected modal and global allowances for network origins and other valid CSP source expressions.
Frame-ancestors violations use best-effort short-lived iframe request correlation: the protected site origin is shown as Blocked URI, the observed embedding origin is shown as Source, and a correlated HTTP(S) origin can be manually added to frame-ancestors after an explicit security warning.
Optional CSP Log email notifications checked hourly through one shared Rapid Security Manager WordPress Cron event; existing log history is baselined when notifications are enabled, so only later new or updated browser reports are summarized.
CSP notification emails use the Free/Core plain-text mail service, default to the WordPress administrator email address, and intentionally omit client IP addresses, User-Agent values and raw CSP report payloads.
The Free CSP Log displays the latest reporting client IP stored for each grouped entry. No Pro add-on or license is required, and add-on display preferences cannot hide this Core column.
WordPress Hardening with opt-in XML-RPC, REST user enumeration, author-query enumeration, generator output and file-editor protections.
Grouped Basic Diagnostics with OK, Warning, Issue and Info states, system summary, navigation links and a sanitized support report.
Public add-on API used by the separate Rapid Security Manager Pro plugin.

Rapid Security Manager does not replace or modify WordPress 7.1 Document-Isolation-Policy headers on editor screens.

Privacy and local data

Rapid Security Manager is designed to process security data on the WordPress installation:

WAF and CSP logs are stored locally with bounded retention and storage limits.
WAF logging stores normalized security metadata, short evidence labels and pre-redacted request targets. Optional triggered-field payload samples are disabled by default, limited to 16 KiB and stored only after known credential redaction. No complete request, uploaded file content or opaque raw body is recorded.
Free observation-only WAF thresholds use automatically expiring keyed-hash counters for client, account and path grouping. The counter table does not store plaintext IP addresses, account names or request paths; threshold events written to the normal WAF Log follow its existing retention and local-data rules.
CSP logging discards URL credentials, query strings and fragments before storage.
CSP notification emails omit client IP addresses, User-Agent values and raw report payloads.
TOTP secrets are stored using authenticated encryption. Recovery codes and trusted-device tokens are stored only in hashed form.
GeoIP lookups use an administrator-uploaded local database. Rapid Security Manager does not submit visitor IP addresses to an online GeoIP service.
Rapid Security Manager contains no telemetry or tracking code.

Site administrators remain responsible for selecting appropriate log retention, access controls, privacy notices and legal bases for their jurisdiction.

External services

Rapid Security Manager can download Cloudflare’s published IPv4 and IPv6 proxy ranges from https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6. This is used only to verify whether a direct peer is a genuine Cloudflare proxy before trusting the CF-Connecting-IP header.

The scheduled download is enabled only when trusted proxy detection and Cloudflare support are both enabled. The request exposes the site’s outbound connection IP address and sends a Rapid Security Manager/WordPress User-Agent containing the plugin version. It does not send visitor IP addresses, site content, credentials, cookies or Rapid Security Manager logs. If the service is unavailable or returns invalid data, Rapid Security Manager keeps using its bundled fallback ranges.

Cloudflare provides this service under its Website Terms and Privacy Policy.

Third-party resources

Rapid Security Manager includes a namespace-prefixed source snapshot of the MaxMind DB Reader PHP 1.14.0 library under the Apache License 2.0. It does not include a MaxMind or DB-IP GeoIP database. The complete component, source, modification and image-asset notices are documented in licenses/THIRD-PARTY-NOTICES.txt; the full MaxMind license is included in licenses/maxmind-db-reader-LICENSE.txt.

Screenshots

Installation

Upload the rapid-security-manager folder to /wp-content/plugins/, or install Rapid Security Manager through the WordPress Plugins screen.
Activate Rapid Security Manager from the Plugins screen. On multisite, use Network Activate only when the same Free/Core protection should be available across the network.
Open Rapid Security Manager > Diagnostics and review the detected environment and registered modules.
Configure Network & GeoIP before trusting proxy-provided client IP headers. Leave trusted proxy detection disabled unless the site is actually behind a supported proxy or explicitly configured proxy range.
Start the WAF in Log Only mode, review legitimate traffic, and switch to Enforce only after the enabled rules have been tested on the site.
Build the CSP gradually in Report Only mode before enabling enforcement.
Users can enable TOTP two-factor authentication from their WordPress profile and should store their one-time recovery codes safely.
Optionally upload a current DB-IP Lite Country MMDB file on Network & GeoIP for local country enrichment.

FAQ

Does Rapid Security Manager require an account or license key?

No. Rapid Security Manager Free works without registration, a Rapid Security Manager account, or a license key.

Does Rapid Security Manager send telemetry, logs, visitor data, or site content to the developer?

No. Rapid Security Manager does not include telemetry and does not send WAF logs, CSP logs, visitor IP addresses, site content, credentials, cookies, or two-factor secrets to the developer.

When does Rapid Security Manager contact Cloudflare?

Only when both trusted proxy detection and Cloudflare support are enabled. A scheduled request then refreshes Cloudflare’s published proxy IP ranges. Normal security requests never perform an online Cloudflare lookup. See the External services section for the exact endpoints and transmitted data.

Is a GeoIP database bundled with the plugin?

No. An administrator may separately obtain and upload a DB-IP Lite Country MMDB database. Lookups are performed locally, and the uploaded database remains subject to DB-IP’s license and attribution terms.

Where are WAF and CSP logs stored?

They are stored in bounded custom tables in the site’s WordPress database. Depending on the log, records can include an IP address, a bounded User-Agent, request or document metadata, rule information and short evidence labels. Observation-only WAF thresholds use a separate table of automatically expiring keyed-hash counters; account names and raw request paths are not stored in that counter table. WAF targets retain the path and query after pre-storage redaction, up to 16 KiB. Optional payload recording is disabled by default and records only the original triggered field, not an entire HTTP request. Known password fields, tokens, authorization values and session/cookie data are masked regardless of whether the user exists or authentication succeeds; opaque raw bodies are omitted. CSP URL query strings and fragments remain excluded.

Payload recording and the Payload display column are separate settings. Turning recording off does not delete already retained samples. Every grouped row represents the latest event/sample in that group, not a per-request history. Historical query strings and payloads that were not recorded cannot be reconstructed. Samples may still contain personal data or unrecognized custom secrets: enable recording only when needed, review your test inputs and privacy notices, and keep an appropriate retention period. Truncated and unavailable samples are explicitly labelled.

Is Rapid Security Manager Pro required?

No. All features described as Free work independently. Rapid Security Manager Pro is a separately installed add-on that extends the shared Free/Core services with additional controls and analysis.

Can Rapid Security Manager Free download or install Rapid Security Manager Pro?

No. The Free plugin contains only an informational Upgrade to Pro page. It does not download, install, activate, update, or execute Pro packages. Those operations belong to the separately installed Pro add-on.

Does Rapid Security Manager automatically import data from a plugin with a different slug?

No. Rapid Security Manager uses only its own final identifiers and starts as an independent installation. It does not read, rename, delete or import settings, logs, two-factor metadata, uploaded GeoIP files or other data owned by a differently named plugin.

What happens when Rapid Security Manager Free is uninstalled?

By default, the uninstall routine removes Free/Core settings, scheduled tasks, transients, custom WAF and CSP tables, uploaded DB-IP files, Rapid Security Manager-managed Apache/LiteSpeed marker blocks, and Free/Core two-factor user metadata. An administrator with plugin-deletion permission can instead archive the Free/Core WAF Log table with a UTC Unix timestamp suffix. Archived tables are not restored or managed automatically by a later installation. Data owned by a separately installed compatible add-on is not removed by the Free plugin.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Rapid Security Manager” is open source software. The following people have contributed to this plugin.

rapidplugins

Translate “Rapid Security Manager” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.2.2

Update the namespace-prefixed MaxMind DB Reader from 1.13.1 to 1.14.0 so malformed MMDB lookups are bounded by upstream value-count, nesting-depth and copied-payload limits.
Raise the declared minimum versions to WordPress 7.1.2 and PHP 8.3 while retaining Tested up to: 7.1 in the WordPress.org readme format.
Preserve existing DB-IP and Pro GeoLite2 files, providers, settings, logs and public integration APIs without a database schema or data migration.

1.2.1

Replace the passive-monitor settings labels with concise brute-force and suspected DoS activity terminology without changing detection behavior.
Clarify that Free logs threshold-reaching suspicious activity without blocking and that monitoring requires both the WAF and WAF logging.
Preserve existing settings, counters, logs and per-monitor Pro ownership without a database schema or data migration.

1.2.0

Add a nonce- and capability-protected Uninstall Settings page for choosing whether the Free/Core WAF Log is deleted or archived during permanent plugin removal.
Keep complete deletion as the default; selected archives use collision-resistant UTC Unix timestamp suffixes within the database identifier limit.
Leave the original WAF Log table intact if an archive rename fails, while continuing to remove temporary counters and unrelated Free/Core data.
Preserve the shortened WordPress.org changelog, screenshot list and root GPL license.txt supplied after the previous SVN upload.

1.1.9

Hide each Free threshold-logging setting while an active compatible add-on owns the matching protection, and hide the complete settings box when all four monitors are replaced.
Keep unrelated Free monitor settings visible and editable when only some matching add-on protections are active.
Preserve every omitted Free threshold setting server-side during WAF saves so disabling an add-on protection restores the previously saved Free configuration.
Retain existing WAF logs, counters and settings without a database schema migration or any change to runtime protection ownership.

1.1.8

Refresh each passive monitor’s grouped WAF Log counter and Last Seen time at every completed threshold batch, such as 3, 6 and 9 failed logins within one fixed window.
Group request-rate and 404 reconnaissance observations independently of changing request paths while retaining the latest redacted target sample.
Continue counting unique 404 paths after the first threshold with the existing keyed fingerprints and global cardinality cap, without logging or writing on every request.
Raise the declared minimum WordPress version from 7.0 to 7.1 while retaining PHP 8.1 as the minimum.
Preserve existing WAF logs, settings and counters without a database schema migration; Free observations remain non-blocking in every WAF mode.

1.1.7

Add independently configurable Free observation-only thresholds for request activity, failed authentication, password-reset requests and unique-path 404 reconnaissance below the existing WAF logging settings.
Write at most one grouped WAF Log observation per threshold window and never block a request or IP address because of these Free detections, including in Enforce mode.
Store temporary keyed-hash counters in a separate bounded Free/Core table, expire them automatically, and remove them on uninstall without changing existing logs or settings.
Let compatible add-ons replace only the matching active monitor while retaining the saved Free configuration and allowing unrelated Free monitors to continue.
Preserve schema-1 WAF settings imports by supplying the new defaults, update Hungarian catalogs, and require no destructive migration.

1.1.6

Display stored IPv4/IPv6 client addresses in the Free CSP Log as safely escaped text, independently of Pro and earlier add-on column preferences.
Require shared-file authorization for Security Headers and CSP marker writes and removals, including multisite activation, deactivation and legacy cache-policy upgrade paths.
Protect global CSP source allowance with multisite Cache Compatibility authorization, verify successful source insertion before deleting resolved logs, and report cache rollback failures.
Remove Tested up to from the main PHP header while retaining the readme field, and align Contributors with the submitting WordPress.org account.
Refresh Hungarian PO/POT/MO files without changing database schemas, existing settings, logs, two-factor data or GeoIP files.

1.1.5

Retain redacted full WAF targets including query strings and show them as escaped text, with the encoded target available separately.
Add opt-in, bounded, pre-redacted original triggered-field payload samples and an independently configurable Payload display column.
Mask known passwords for every account, tokens, authorization values and cookie/session fields before storage; omit opaque raw bodies and label truncation or unavailable data.
Preserve grouped fingerprints and existing logs, updating each row with its latest target/sample without creating per-request log rows.
Add nonce- and capability-protected Default Settings restoration for WAF Log display columns only, including persistence-failure feedback.
Verify additive request-sample columns before using schema v2; retain legacy metadata logging during partial upgrades and retry non-destructively.
Update Hungarian translations and local-data documentation.

1.1.4

Rename the plugin to Rapid Security Manager and adopt the rapid-security-manager WordPress.org slug, package root, main plugin basename and text domain.
Rename PHP namespaces, public API functions, constants, hooks, options, user metadata, transients, cron events, database tables, REST routes, admin slugs and asset identifiers consistently.
Start with a clean Rapid Security Manager data namespace without reading, migrating or deleting data belonging to an earlier plugin identity.
Coordinate the renamed public extension API and internal integration points with Rapid Security Manager Pro 0.6.0.

1.1.3

Complete the preceding product-identity transition across the plugin-owned data namespace and public extension API.
Keep the transition clean by leaving data belonging to differently named plugins untouched.
Coordinate the Free/Core integration boundary with its matching Pro release.

1.1.2

Prevent stale GeoIP lock cleanup and lock release from deleting a replacement operation lock.
Serialize security-sensitive 2FA state changes, reserve verification attempts atomically, and fail closed when rate-limit state cannot be stored safely.
Commit two-factor enrollment only after every secret, recovery-code, replay-step and trusted-device write succeeds, with rollback on partial failure.
Persist and update trusted-device records before accepting their browser cookies, without losing concurrent mutations or reviving records after password-change revocation; use a revocation epoch to invalidate in-flight writers.
Normalize WordPress request arrays exactly once while preserving raw, JSON-decoded and server-provided WAF input.
Require POST for every non-FIM Free/Core administrative action and affected AJAX operation before nonce or request-data processing.

1.1.1

Avoid repeated per-request database table checks by caching a versioned schema-health result and rechecking it at a bounded interval.
Keep forced, non-destructive schema verification on activation and retry failed setup safely without registering the security runtime.
Clear Free/Core scheduled events and cache-compatibility state for every site during network-wide multisite deactivation.

1.1.0

Finalize the clean-start data model for the then-current plugin identity: the plugin reads and writes only its own identifiers.
Remove automatic migration of settings, logs, two-factor metadata, GeoIP files, scheduled events and Apache/LiteSpeed marker blocks from differently named plugins.
Remove legacy two-factor cryptographic and trusted-device cookie compatibility; new enrollments use only the current plugin security contexts.
Leave data belonging to differently named plugins untouched so administrators can archive or import selected records independently.

1.0.9

Complete the previous product-identity transition and adopt its then-current WordPress.org slug and text domain.
Rename the PHP namespace, public API, constants, hooks, options, database tables, REST namespace, admin slugs, assets and other plugin-owned identifiers consistently for that transition.
Prepare the Free/Core add-on API for the separately installed Pro add-on.

1.0.8

Rewrite the readme introduction around Rapid Security Manager’s local-first security model and remove the stale version-specific preview sentence.
Add installation guidance, privacy and local-data documentation, and answers covering accounts, external communication, GeoIP data, logs, Pro separation and uninstall cleanup.
Add a consolidated third-party notice for the MaxMind DB Reader source, optional DB-IP data, local QR encoder and bundled Pro screenshots.
Clarify that Rapid Security Manager Free does not download or install Pro packages and that protected activation and updates belong to the separately installed Pro add-on.
Add an explicit GPL source header to the readable local two-factor QR encoder.

1.0.7

Refine and simplify Hungarian admin descriptions across Diagnostics, Registered Modules, Network & GeoIP, and Security Headers.
Remove redundant explanatory text from Diagnostics while keeping sanitized report generation unchanged.
Clarify DB-IP attribution, cache-compatible header delivery, MIME sniffing, framing, HSTS, Permissions-Policy, WebUSB, and Payment Request API descriptions.

1.0.6

Add keyboard-accessible, vertically scrollable Upgrade to Pro image frames that preserve each screenshot’s original aspect ratio.
Allow feature cards to reuse one screenshot with an initial vertical position specified in source-image pixels and scaled responsively at runtime.

1.0.5

Keep the CSP Dashboard widget table inside its container and truncate long Blocked URI / Source values to one line with an ellipsis while retaining the full value as a hover tooltip.

1.0.4

Fix the malformed GeoIP cleanup block in uninstall.php so complete removal can run without a PHP syntax error.
Use the WordPress metadata API for network-global 2FA user-meta cleanup and keep uninstall variables consistently prefixed.
Remove the discouraged manual load_plugin_textdomain() call and rely on WordPress just-in-time translation loading.
Sanitize and bound request-header values used for CSP frame-context correlation.
Make Cloudflare proxy-range refresh explicitly opt-in by default on new installations while preserving existing saved settings and bundled fallback ranges.
Document intentional nonce-free WAF inspection, read-only administrator routing, atomic custom-table operations, the core wp_login hook and exception chaining for Plugin Check.

1.0.3

Move the Registered modules box below System Status on the Diagnostics page and hide the retired Modules submenu.
Merge the complete GeoIP administration into Network, rename the shared page to Network & GeoIP and hide the retired GeoIP submenu.
Preserve the old Modules and GeoIP admin URLs as hidden compatibility aliases for their new destinations.
Rename only the WordPress Hardening submenu to WP Security while keeping its page, form and save transaction unchanged.
Shorten only the Content Security Policy submenu label to CSP while keeping its page title and behavior unchanged.

1.0.2

Keep the Free versus Pro comparison as a compact three-column table on mobile screens.
Reduce the mobile Free and Pro columns to icon-only availability indicators while preserving accessible labels.

1.0.1

Add a responsive Upgrade to Pro page with an accurate overview of the current premium feature set.
Add a mobile-friendly Free versus Pro comparison table and accessible links to the official Rapid Security Manager information page.
Bundle all ten promotional images locally instead of loading marketing assets from an external server.
Load the dedicated presentation stylesheet only on the Upgrade to Pro page.

1.0.0

Add the Rapid Security Manager - WAF Log WordPress Dashboard widget for administrators when stored grouped WAF entries exist.
Show grouped-entry, total-event, blocked-event and latest-event summaries plus non-empty attack-type categories.
Read only aggregate attack-type counts; do not expose individual IP addresses, request targets, evidence or User-Agent values in the widget.
Keep the existing shared Free/Core WAF Log table, retention, row cap and Pro event integration unchanged.