Title: Vardalion Security Author: vincewebdesign Published: sentýabr 11, 2026 Last modified: sentýabr 11, 2026 --- Search plugins ![](https://ps.w.org/vardalion-security/assets/banner-772x250.png?rev=3691341) ![](https://ps.w.org/vardalion-security/assets/icon-256x256.png?rev=3691341) # Vardalion Security By [vincewebdesign](https://profiles.wordpress.org/vincewebdesign/) [Download](https://downloads.wordpress.org/plugin/vardalion-security.2.2.7.zip) * [Details](https://tuk.wordpress.org/plugins/vardalion-security/#description) * [Reviews](https://tuk.wordpress.org/plugins/vardalion-security/#reviews) * [Installation](https://tuk.wordpress.org/plugins/vardalion-security/#installation) * [Development](https://tuk.wordpress.org/plugins/vardalion-security/#developers) [Support](https://wordpress.org/support/plugin/vardalion-security/) ## Description Vardalion Security is a security plugin for WordPress that monitors suspicious behaviour, assigns threat scores and can automatically block hostile IP addresses. The free Core plugin includes: * Request inspection for common exploit and malicious-request patterns. * Brute-force and authentication protection. * User-enumeration and REST user-endpoint protection. * Login request rate limiting. * Bot and security-scanner detection. * Threat scoring with configurable automatic IP blocking. * Repeat-offender escalation and optional permanent blocking. * Manual IP and CIDR network blocking with lockout-safety checks. * Subnet intelligence and administrator-reviewed network recommendations. * Security event logging, filtering and CSV export. * High-severity email alerts. * Emergency Mode for recovering from an enforcement configuration problem. * WordPress core-file checksum verification for protected wp-admin PHP paths. * Trusted-proxy and Cloudflare-origin handling controls. Vardalion Security Core is permanently free. It does not expire, require a licence key, or unlock included functionality after payment. An optional separately distributed Vardalion Security Pro companion plugin can extend Core with additional commercial functionality. Pro code, licensing and update delivery are not included in the WordPress.org Core plugin. ### Privacy Vardalion Security is a security plugin and may process information that can be personal data, including IP addresses and user-agent strings. Core security data is stored locally in the WordPress database. Administrators control the configured log-retention period and can manually remove blocks. Vardalion Security Core does not send security logs or visitor telemetry to Vince Web Design. Vardalion Security also supplies suggested privacy-policy text to WordPress under** Settings > Privacy > Policy Guide** so site administrators can adapt the disclosure to their own site. For core-file integrity verification, Vardalion Security periodically requests the official checksum list from WordPress.org using the site’s installed WordPress version and locale. See the external service disclosure in the FAQ above. ## Installation 1. Upload the `wp-aegis` folder to `/wp-content/plugins/`, or install Vardalion Security through the WordPress Plugins screen. 2. Activate Vardalion Security. 3. Open **Vardalion Security > Security Settings**. 4. Review the default threat threshold, authentication protection, trusted proxy configuration and alert email. 5. If the site is behind a reverse proxy or CDN, configure trusted proxy ranges before relying on forwarded client-IP headers. 6. Review **Vardalion Security > Security Log** and **IP Intelligence** after the plugin has observed normal site traffic. ## FAQ ### Does Vardalion Security Core require a licence or paid account? No. Vardalion Security Core is permanently free and its included functionality does not expire. ### Does Vardalion Security send my security logs to Vince Web Design? No. Core security logs and blocking data are stored in your WordPress database. Vardalion Security Core does not send those logs to Vince Web Design. ### Does Vardalion Security contact any external service? Vardalion Security retrieves official WordPress core checksums from the WordPress. org checksum API when its core-file integrity cache needs to be refreshed. The request includes the installed WordPress version and locale so the correct official checksum set can be returned. Service: WordPress.org Core Checksums API Service URL: https://api.wordpress.org/ core/checksums/1.0/ WordPress.org privacy policy: https://wordpress.org/about/privacy/ The documentation button opens the Vardalion Security documentation website only when an administrator clicks it. Core does not transmit security telemetry to that site. Documentation: https://vinceweb.co.uk/wp-aegis/documentation/ ### What information does Vardalion Security store? Vardalion Security can store security event details such as IP address, request path, HTTP method, user agent, rule identifier, threat points and event context. It also stores active and historical block information needed for enforcement and repeat-offender escalation. Administrators can configure security-log retention. Data should be handled according to the site’s own privacy and retention obligations. ### Can Vardalion Security lock me out of wp-admin? Security software can cause access problems if network or proxy settings are configured incorrectly. Vardalion Security includes Emergency Mode. If wp-admin is inaccessible, an administrator with file access can define `WPAEGIS_EMERGENCY_DISABLE` as `true` in `wp-config.php` to bypass active enforcement while retaining logging. ### Does Vardalion Security block whole networks automatically? Core provides subnet intelligence and recommendations, but network-range blocks require administrator approval. Automatic subnet blocking is not part of Core. ### What is Vardalion Security Pro? Vardalion Security Pro is an optional companion plugin distributed separately by Vince Web Design. It extends Core with commercial modules. Vardalion Security Core remains fully functional without Pro. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Vardalion Security” is open source software. The following people have contributed to this plugin. Contributors * [ vincewebdesign ](https://profiles.wordpress.org/vincewebdesign/) [Translate “Vardalion Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/vardalion-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/vardalion-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/vardalion-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/vardalion-security/) by [RSS](https://plugins.trac.wordpress.org/log/vardalion-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.2.7 * Replaced the final dynamic cursor comparison expression in event-log export queries with fixed prepared SQL branches. * Resolves the remaining Plugin Check PreparedSQL errors without suppressing them. #### 2.2.6 * Corrected event-log prepared-query placeholder handling identified by the full WordPress Plugin Check. * Prepared each dynamic filter value while building the validated WHERE fragment. * Replaced dynamic ORDER BY interpolation with fixed ASC/DESC query branches. * Passed pagination and export limits as individual prepared-query replacement arguments. #### 2.2.5 * Refactored filtered event-log queries so prepared SQL is passed directly to WordPress database methods. * Removed intermediate `$sql` and `$prepared` variables flagged by Plugin Check. * Kept validated filter grammar and prepared external values while preserving real- time uncached security-log reads. #### 2.2.4 * Converted the final threat-score and expired-block table identifiers to WordPress`% i` placeholders. * Documented the remaining intentional uncached audit-log reads for Plugin Check. * Completed the final full Plugin Check warning-remediation pass. #### 2.2.3 * Reworked dynamic security-table queries to use WordPress `%i` identifier placeholders. * Documented intentional uncached direct database access used for real-time security enforcement and audit logging. * Documented uninstall-only schema removal for plugin-owned tables. * Further reduced full Plugin Check warnings without changing existing security behaviour. #### 2.2.2 * Hardened Plugin Check compliance for translation placeholders, request sanitization and database-query validation. * Removed the explicit close of the streamed CSV output handle. * Prepared dynamic database identifiers using WordPress `%i` identifier placeholders where applicable. * Documented intentional read-only GET handling and security-table database access for code-quality analysis. #### 2.2.1 * Renamed the public plugin identity to Vardalion Security and requested the WordPress. org slug `vardalion-security`. * Updated the Vardalion Security logo and visible branding. * Moved standalone firewall response CSS to an enqueued stylesheet. * Removed the unnecessary `load_plugin_textdomain()` call for WordPress.org distribution. * Preserved existing `wpaegis_*` hooks, settings, database tables and extension APIs for legacy migration compatibility. #### 2.2.0 * Split Vardalion Security into a permanently free Core plugin with a stable extension API for optional companion plugins. * Removed commercial licence, trial and external executable updater code from Core. * Kept firewall inspection, threat scoring, brute-force protection, bot detection, IP blocking, repeat-offender escalation, logging and recovery in Core. * Kept manual CIDR network blocking and subnet intelligence in Core while leaving automatic subnet enforcement to companion extensions. * Added WordPress.org-focused documentation, privacy and external-service disclosures. * Corrected Core maintenance health checks so they no longer expect Pro-only scheduled tasks. * Removed stale licensing and updater-development references from the Core administration UI. * Added a restrained Core-to-Pro comparison screen and dashboard link that disappear automatically when Pro is active. * Added a prominent Upgrade to Pro button to the main Vardalion Security dashboard when Pro is not installed. * Improved compatibility with standard WordPress/third-party admin notices so notice text remains readable on Vardalion Security screens. * Corrected the Pro comparison page layout so the comparison table displays vertically at full admin-page width. * Removed a false maintenance warning for an obsolete wpaegis_reputation_sweep schedule. ## Meta * Version **2.2.7** * Last updated **sagat ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.1** * PHP version ** 8.0 or higher ** * Language * [English (US)](https://wordpress.org/plugins/vardalion-security/) * Tags * [Activity Log](https://tuk.wordpress.org/plugins/tags/activity-log/)[Brute Force](https://tuk.wordpress.org/plugins/tags/brute-force/) [firewall](https://tuk.wordpress.org/plugins/tags/firewall/)[malware](https://tuk.wordpress.org/plugins/tags/malware/) [security](https://tuk.wordpress.org/plugins/tags/security/) * [Advanced View](https://tuk.wordpress.org/plugins/vardalion-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/vardalion-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/vardalion-security/reviews/) ## Contributors * [ vincewebdesign ](https://profiles.wordpress.org/vincewebdesign/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/vardalion-security/)