Title: GemSecurity – Firewall, Malware Scanner, 2FA, Social Login & reCAPTCHA
Author: Kodezen LLC
Published: <strong>2026-يىلى 7-نويابىر</strong>
Last modified: 2026-يىلى 7-نويابىر

---

قىستۇرما ئىزدە

![](https://ps.w.org/gemsecurity/assets/banner-772x250.png?rev=3790569)

![](https://ps.w.org/gemsecurity/assets/icon-256x256.png?rev=3790569)

# GemSecurity – Firewall, Malware Scanner, 2FA, Social Login & reCAPTCHA

 يازغۇچى [Kodezen LLC](https://profiles.wordpress.org/kodezen/)

[چۈشۈر](https://downloads.wordpress.org/plugin/gemsecurity.1.2.2.zip)

 * [تەپسىلاتلار](https://ug.wordpress.org/plugins/gemsecurity/#description)
 * [باھالاشلار](https://ug.wordpress.org/plugins/gemsecurity/#reviews)
 *  [ئورنىتىش](https://ug.wordpress.org/plugins/gemsecurity/#installation)
 * [ئىجادىيەت](https://ug.wordpress.org/plugins/gemsecurity/#developers)

 [قوللاش](https://wordpress.org/support/plugin/gemsecurity/)

## چۈشەندۈرۈش

**GemSecurity** is an all-in-one WordPress security plugin: a web application firewall,
login protection, two-factor authentication, social login, reCAPTCHA / hCaptcha /
Cloudflare Turnstile, a malware and vulnerability scanner, and a full activity log,
all in one fast single-page dashboard.

Every feature lives in a module you can switch on or off. A module that is off loads
no code, so you only pay for what you use. A live security score tells you what 
still needs attention, and every page has a built-in «?» guide.

#### Why GemSecurity?

 * One plugin instead of five: security, firewall, 2FA, social login and CAPTCHA
   together
 * Lightweight and modular: disabled modules load nothing
 * Safe by default: administrators are never locked out by the firewall, risky options
   start off
 * Setup wizard and in-plugin help for every page
 * Light and dark admin theme

#### Firewall & WAF (Web Application Firewall)

 * Blocks SQL injection (SQLi), cross-site scripting (XSS), local file inclusion(
   LFI) and remote code execution (RCE) requests
 * IP blocklist with CIDR range support, plus an IP safelist that is never blocked
   or rate-limited
 * Request rate limiting and 404-flood throttling
 * Bad-bot and AI-crawler blocking, with search-engine bot verification
 * Site-wide file upload switch (Media, REST, sideload and XML-RPC)
 * Your own IP is refused in the blocklist so you cannot lock yourself out

#### Hardening

 * Disable XML-RPC and the theme/plugin file editor
 * Stop author and REST API user enumeration
 * Hide the WordPress version
 * Application password governance and max-age
 * Generic login error messages
 * Optional protection of wp-config.php, debug.log and wp-admin/includes via .htaccess

#### Security headers

 * X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
 * HSTS (Strict-Transport-Security) and Content-Security-Policy (CSP)
 * Headers are added to REST API responses too

#### Login security & brute-force protection

 * Limit login attempts with configurable brute-force lockouts
 * Custom login URL (hide / rename wp-login.php) with a public page picker and wp-
   config.php kill switch
 * Session limits, idle timeout and absolute admin session timeout
 * Admin-login email alerts
 * Login lockdown mode
 * Force logout and forced password resets by role, on demand or on a schedule

#### reCAPTCHA, hCaptcha & Cloudflare Turnstile

 * Google reCAPTCHA v2 and v3, hCaptcha and Cloudflare Turnstile
 * Protects login, registration and lost-password forms
 * «Verify keys» test with the real widget before you save
 * A wrong secret key never locks everyone out; the problem is logged instead

#### Two-Factor Authentication (2FA)

 * Authenticator app (TOTP) with QR code: Google Authenticator, Authy, Microsoft
   Authenticator and others
 * Email one-time codes (OTP)
 * One-time backup codes
 * Enforce 2FA per role, or for all roles
 * Works with front-end login forms, not only wp-login.php
 * 2FA secrets encrypted with AES-256-GCM

#### Social login

 * One-click sign in with Google, Facebook, GitHub and X (Twitter)
 * Choose the role for new social accounts
 * Buttons appear only after a provider’s keys are verified; broken providers switch
   off and alert you
 * Social sign-ins go through Admin Guard

#### Magic login (passwordless)

 * Users can request a one-time sign-in link by email from the login form
 * Rate-limited, and the link only works in the browser that requested it

#### Password policy

 * Minimum strength and length rules
 * Breached-password check with Have I Been Pwned (only a partial hash is sent)
 * Password rotation: force resets for passwords older than a set number of days

#### Admin Guard

 * Administrator whitelist with automatic removal of rogue / unapproved admins
 * Hidden-admin detection
 * Preview who would be removed before anything happens

#### Temporary access

 * Give an existing user a higher role for a limited time; their old role comes 
   back automatically

#### Plugin Guard & supply-chain protection

 * Verifies every plugin against official WordPress.org checksums
 * Trust list for premium, custom, theme and must-use plugins
 * Optional enforcement stops untrusted plugins before they load
 * Install Lock: block zip uploads, all installs or every file change, with a logged
   15-minute timed unlock
 * Plugin lock: a separate unlock password plus emailed code guards deactivating
   GemSecurity

#### Upload Shield

 * Refuses PHP and other executable files on every upload path
 * Detects PHP hidden in images and scripted SVG
 * Writes no-execute rules to uploads/.htaccess, with a live PHP-execution test 
   and an nginx snippet
 * Bans the IP behind a refused executable upload

#### Malware & vulnerability scanner

 * WordPress core file integrity check against official checksums
 * Compare a flagged core file line by line with the WordPress.org original
 * Uploads malware / PHP pattern scan
 * Suspicious .htaccess rule detection with one-click quarantine
 * Known-vulnerability scanner for WordPress core, plugins and themes
 * File-change detection and link scanner
 * Mark reviewed files as safe; they are reported again if they change
 * Code & database finder to search the whole install and database

#### Anti-spam

 * Frictionless bot checks on comments and registration (no CAPTCHA needed)
 * Comment honeypot and heuristic spam filtering

#### API security

 * REST API rate limiting
 * Application password controls

#### Activity log (audit log)

 * Logs logins, user changes, role changes, plugin/theme changes, settings and content
   edits
 * Field-level diff for edits to live posts, with a link to the revision
 * SEO meta, template and featured image changes
 * Records how each event arrived (admin, REST, XML-RPC, AJAX, WP-CLI, cron), user
   agent and session
 * Filter by user or post, retention settings and CSV export

#### Alerts & notifications

 * Email, Slack, Telegram and generic webhook alerts
 * Alerts include the IP’s city, region, country and network
 * Daily report of administrators and active plugins, highlighting changes
 * Alert when GemSecurity is deactivated
 * Test buttons for every channel

#### Compliance & SIEM

 * Send security events to your own SIEM collector or webhook

#### Security dashboard

 * Live security score with grade and trends
 * «What needs your attention» list linking straight to each fix
 * Module manager to turn features on and off without reloading
 * First-run setup wizard with protection levels

#### Works with GemBackup (optional)

GemSecurity does not create backups itself. If the separate GemBackup plugin is 
active, GemSecurity can ask it for a backup before plugin/theme/core updates and
can start a restore of its latest backup from the Incident Response page.

#### GemSecurity Pro

GemSecurity Pro is a separate add-on plugin for sites that need active threat defense
and malware cleanup. None of its code is in this free plugin; everything listed 
above stays free.

 * **Threat Defense** – escalating auto-bans for repeat attackers, a full ban ledger
   and a curated bad-bot blocklist
 * **Virtual patching** – CVE-targeted firewall rules that block known exploits 
   for your installed plugin and theme versions, even before a fix is released
 * **Country blocking (geolocation)** – allow or block countries for the whole site
   or just the login page
 * **Signature malware scanner** – deep malware detection with one-click quarantine
   and restore
 * **Database injection scan** – finds spam links, hidden scripts and backdoors 
   stored in posts, options and other tables
 * **Plugin & theme integrity** – compares every file with the original from WordPress.
   org
 * **Core repair** – reinstalls WordPress core and removes files that core does 
   not ship, so implants do not survive a reinstall
 * **File-change baseline** – records a known-good snapshot and alerts on any added,
   changed or deleted file
 * **Post-hack recovery toolkit & Incident Response** – step-by-step cleanup, reset
   salts, sessions and passwords, restore quarantined files
 * **Payment page integrity (PCI DSS 4.0)** – watches the scripts loaded on checkout
   pages and flags card-skimmer injections
 * **Uptime & domain monitoring** – site uptime, SSL/TLS certificate expiry, DNS
   changes and SPF/DKIM/DMARC email health
 * **New-device login alerts** – emails users when an unrecognised device signs 
   in, plus emergency one-time login links
 * **Hardening pack** – extra one-click hardening rules
 * **Auto-update enforcement** – keep chosen plugins, themes and core updated automatically
 * **Settings import / export** – copy your security setup between sites

### External services

GemSecurity connects to the services below only for the feature named, and only 
after you turn that feature on. On a default install the only requests made are 
to WordPress.org (official checksums and plugin information, used to verify core,
plugin and theme files). Every other service below is contacted only after you switch
that feature on, including the vulnerability scan, which is off by default.

#### CAPTCHA (Login & Access  CAPTCHA)

When CAPTCHA is enabled, the provider’s script loads on the login, registration 
and lost-password forms, and the CAPTCHA response token plus the visitor’s IP address
are sent to the provider to verify each submission.

 * Google reCAPTCHA — [Terms](https://policies.google.com/terms), [Privacy](https://policies.google.com/privacy)
 * hCaptcha — [Terms](https://www.hcaptcha.com/terms), [Privacy](https://www.hcaptcha.com/privacy)
 * Cloudflare Turnstile — [Terms](https://www.cloudflare.com/website-terms/), [Privacy](https://www.cloudflare.com/privacypolicy/)

#### Social login (Login & Access  Social Login)

When a visitor signs in with a provider, the OAuth authorization code is sent to
that provider and the user’s name, email and avatar are returned to your site.

 * Google — [Terms](https://policies.google.com/terms), [Privacy](https://policies.google.com/privacy)
 * Facebook (Meta) — [Terms](https://www.facebook.com/terms.php), [Privacy](https://www.facebook.com/privacy/policy/)
 * GitHub — [Terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service),
   [Privacy](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement)
 * X (Twitter) — [Terms](https://x.com/en/tos), [Privacy](https://x.com/en/privacy)

#### Vulnerability scanner

The slug and version of each installed plugin and theme, and your WordPress version,
are sent to the WPVulnerability API (www.wpvulnerability.net) to look up known vulnerabilities.
[License](https://www.wpvulnerability.com/license/), [Privacy](https://www.wpvulnerability.com/privacy/)

#### Plugin and file integrity checks

Plugin/theme slugs and versions are sent to WordPress.org to fetch official checksums,
package details and original files for comparison. When you open a flagged core 
file in the Scanner, that file is downloaded from core.svn.wordpress.org (your WordPress
version and the file path are sent) and accepted only if it matches the official
checksum. [Terms](https://wordpress.org/about/domains/), [Privacy](https://wordpress.org/about/privacy/)

#### Breached-password check (Password Policy)

When enabled, the first 5 characters of the SHA-1 hash of a new password are sent
to Have I Been Pwned (api.pwnedpasswords.com), also when you press «Test connection».
The password itself never leaves your site. [Terms and privacy](https://haveibeenpwned.com/Privacy)

#### IP location lookup (Plugin Guard alerts)

When Plugin Guard blocks an executable upload or an untrusted plugin, the IP address
of the visitor involved is sent over HTTPS to ipapi.co to add a country and city
to the security alert. The GemSecurity Pro add-on uses the same lookup for its country
access control. No lookup is made when your CDN already supplies the country. [Terms](https://ipapi.co/terms/),
[Privacy](https://ipapi.co/privacy/)

#### Alerts (Notifications)

When you add a Slack webhook or Telegram bot, security alert text (event, user, 
IP address and time) is sent to that channel.

 * Slack — [Terms](https://slack.com/terms-of-service), [Privacy](https://slack.com/trust/privacy/privacy-policy)
 * Telegram — [Terms](https://telegram.org/tos), [Privacy](https://telegram.org/privacy)

#### Generic webhook and SIEM collector (Notifications, Settings  Compliance & SIEM)

Only if you enter your own webhook or collector URL, security events (event name,
severity, message, user, IP address and time) are sent to that URL. The destination
is chosen and operated by you, so its terms and privacy policy are your own.

#### Site monitoring (Monitoring module)

Uptime, TLS-certificate, DNS, SPF and DMARC checks are made against your own site
and domain. DNS lookups use your server’s resolver; no data about your site is sent
to GemSecurity or Kodezen.

#### Usage insights (opt-in)

Only if you accept the opt-in notice, GemSecurity sends usage data to Kodezen at
store.kodezen.com. This includes your site URL and name, the admin’s name and email,
the server IP, WordPress, PHP, database and server versions, the site language, 
active theme, and active and inactive plugins. If you choose to give feedback when
deactivating, that feedback is sent too. Nothing is sent if you decline. [Terms](https://kodezen.com/terms-and-conditions/),
[Privacy](https://kodezen.com/privacy-policy/)

### Source code and libraries

The malware and firewall signatures in the PHP code are stored hex-encoded and decoded
with `GemSecurity\Helper::sig()`. They are detection patterns (data), not code, 
and are encoded only so that antivirus tools do not flag the plugin itself for containing
the same strings as the malware it looks for.

The admin JavaScript in `assets/build/` is compiled. Its human-readable source is
included in the `dev_gemsecurity/` folder and is also public on GitHub: [github.com/imrantushar/gemsecurity](https://github.com/imrantushar/gemsecurity).

To rebuild it, run `npm install` and then `npm run build`. To build the full release
zip, run `npm run dist`. It installs missing packages and then builds the JS, translation
template and zip.

GemSecurity bundles these open-source libraries:

 * [Redux Toolkit](https://github.com/reduxjs/redux-toolkit), [Redux](https://github.com/reduxjs/redux)
   and [React Redux](https://github.com/reduxjs/react-redux) — MIT
 * [React Router](https://github.com/remix-run/react-router) — MIT
 * [React Select](https://github.com/JedWatson/react-select) and [Emotion](https://github.com/emotion-js/emotion)—
   MIT
 * [Axios](https://github.com/axios/axios) — MIT
 * [qrcode.react](https://github.com/zpao/qrcode.react) — ISC
 * [StoreEngine WordPress SDK](https://store.kodezen.com/) — GPL-3.0-or-later

React and WordPress packages are loaded from WordPress core, not bundled.

## ئورنىتىش

 1. Upload the `gemsecurity` folder to `/wp-content/plugins/`, or install through Plugins
    Add New.
 2. Activate the plugin through the Plugins menu in WordPress.
 3. Open the GemSecurity menu and review the dashboard; enable the protections you 
    want.

## FAQ

### Where do I start?

Open GemSecurity  Modules and turn on the areas your site needs, then work through
Firewall, Login Security and Scanner — they cover the most common attacks. Every
page has a «?» button in the top bar that explains what that page does, how to set
it up, and what to watch out for.

### There are a lot of settings. Is there documentation inside the plugin?

Yes. The «?» button in the top bar opens a guide for the page you are on: a short
summary, what the feature actually does once enabled, numbered setup steps, and 
the caveats worth knowing before you switch something on.

### What does turning a module off actually do?

A module that is off loads none of its code, registers no REST routes and shows 
no menu entry — so features you do not use cost nothing. Its settings are kept, 
so switching it back on restores your configuration exactly as it was. Menu entries
appear and disappear as you toggle, without reloading the page.

### Which files does GemSecurity change?

Only when you switch the matching feature on, and only through WordPress’s own helpers:
Upload Shield adds deny rules to `wp-content/uploads/.htaccess`, and «Protect wp-
config.php and error logs» (off by default) adds a marked block to the site’s root`.
htaccess` that blocks web access to `wp-config.php`, `debug.log` and `wp-admin/includes`.
Turning either off removes only its own block. Nothing is written to WordPress core,
plugin, theme or must-use folders, and quarantined files are kept in the database
and can only be restored, as non-executable files, to the uploads folder.

### Will the firewall lock me out?

No. Logged-in administrators are never blocked by the IP blocklist or auto-bans,
and aggressive options default to off so you can opt in deliberately.

### Which settings could break my site if I enable them carelessly?

The ones the in-plugin guides call out: a custom login URL (save the new address
first), an admin IP allowlist on a dynamic home connection, an enforced Content-
Security-Policy, HSTS preload, and country blocking applied to the whole site rather
than just the login. Each of those is explained in the help drawer on its own page.

### Does it work without GemSecurity Pro?

Yes. Everything described above works in the free plugin. Pro adds active threat
protection, malware remediation and scale features.

## باھالاشلار

بۇ قىستۇرمىغا تېخى باھا يېزىلمىدى.

## تۆھپىكار ۋە ئىجادكار

«GemSecurity – Firewall, Malware Scanner, 2FA, Social Login & reCAPTCHA» كودى ئوچۇق
يۇمشاق دېتال. تۆۋەندىكى كىشىلەر بۇ قىستۇرمىغا تۆھپە قوشقان.

تۆھپىكار

 *   [ Kodezen LLC ](https://profiles.wordpress.org/kodezen/)
 *   [ Tushar Imran ](https://profiles.wordpress.org/tusharimran/)

[«GemSecurity – Firewall, Malware Scanner, 2FA, Social Login & reCAPTCHA» نى تىلىڭىزغا تەرجىمە قىلىڭ](https://translate.wordpress.org/projects/wp-plugins/gemsecurity)

### ئىجادىيەتكە قىزىقامسىز؟

[كودقا كۆز يۈگۈرتۈپ](https://plugins.trac.wordpress.org/browser/gemsecurity/)، [SVN خەزىنە](https://plugins.svn.wordpress.org/gemsecurity/)
تەكشۈرۈپ ياكى [RSS](https://plugins.trac.wordpress.org/log/gemsecurity/?limit=100&mode=stop_on_copy&format=rss)
ئارقىلىق [ئىجادىيەت خاتىرىسى](https://plugins.trac.wordpress.org/log/gemsecurity/)
گە مۇشتەرى بولغىلى بولىدۇ.

## ئۆزگىرىش خاتىرىسى

#### 1.2.2 – 05/11/2026

 * Fixed – The admin-bar styles are now added through WordPress’s style functions
   instead of a `<style>` tag printed in the page head.
 * Changed – Updated the bundled StoreEngine SDK to 1.6.3. Its notices and license
   page now add their CSS and JS through WordPress’s style and script functions.

#### 1.2.1 – 03/11/2026

 * Fixed – Two-factor code checks are now handled one at a time per user, so several
   codes sent in parallel can no longer get extra guesses. A code is only accepted
   from the sign-in form itself, not from the address bar.
 * Fixed – IP lists no longer treat a malformed range such as `1.2.3.4/abc` as «
   every address». Ranges are checked when you save and when they are matched.
 * Fixed – Alert webhooks (Slack and generic) must be http(s) addresses that are
   not on your own network or loopback, and are sent with WordPress’s safe request
   function. The text of alert emails is now escaped, and the Telegram bot token
   is checked for the right format.
 * Changed – Quarantine restore only puts back non-executable files in the uploads
   folder. PHP and other scripts, `.htaccess`, `.user.ini`, `web.config` and `php.
   ini` stay quarantined and must be reinstalled from their original source.
 * Changed – Paths to WordPress core folders no longer rely on the `WPINC` and `
   WP_LANG_DIR` constants.
 * Changed – Search terms in the Code & database finder are limited to 500 characters.
 * Changed – Every Temporary Access route now declares its own capability check.
 * Added – The FAQ lists which files the plugin changes and when.

#### 1.2.0 – 01/11/2026

 * Changed – Temporary Access now gives an existing user a role for a limited time
   and puts their previous role back when it ends. It no longer creates accounts
   or sign-in links.
 * Changed – GemSecurity no longer writes to WordPress core, plugin, theme or must-
   use folders. Quarantine restores only to the uploads folder, and the core-file
   restore and chmod «Fix» buttons are gone; the core-file popup and permission 
   audit remain read-only.
 * Added – Magic Login: users can ask for a one-time sign-in link by email from 
   the login form.
 * Added – Plugin lock: a separate unlock password plus an emailed one-time code,
   not tied to any user account. It guards deactivating or deleting GemSecurity,
   turning the lock off and switching modules off, and while locked it blocks installing,
   uploading and editing code.
 * Added – IP safelist: safelisted addresses are never blocked, banned or rate-limited,
   and your own IP is refused in the blocklist so you cannot lock yourself out.
 * Added – A site-wide file upload switch on the Firewall page and in the admin 
   bar. It blocks Media, REST, sideload and XML-RPC uploads.
 * Added – Scanner: open a flagged WordPress core file to compare it line by line
   with the official WordPress.org copy (checksum-verified) and restore the original
   in one click. The replaced file is kept in quarantine.
 * Added – Upload Shield bans the IP behind a refused executable upload (administrators
   and exempt IPs are spared), with a configurable ban length.
 * Added – Security alerts and the ban list show where an IP is (city, region, country
   and network).
 * Added – Alert emails include a «Request origin» table.
 * Added – Two-Factor: an «All roles» option for enforced roles.
 * Added – Social login buttons appear only after a provider’s keys pass a check,
   either «Test credentials» or a new «Verify with a sign-in» round trip. Changing
   a key un-verifies it. A provider whose keys are rejected twice in a row is switched
   off and you are alerted. The Social Login page shows Verified, Not verified or
   Switched off for each provider.
 * Added – A «Plugin lock» check in the security score.
 * Fixed – The plugin lock did not stop GemSecurity Pro from being deleted while
   inactive (WordPress never checks the per-plugin delete capability).
 * Changed – Magic links and social login now go through Admin Guard.
 * Changed – The confirm step of magic links only works in the browser that opened
   the link, so another site cannot sign a visitor in to someone else’s account.
 * Changed – Quarantined files are now stored in the database and removed from disk,
   instead of being moved into the uploads folder. Files quarantined by earlier 
   versions can still be restored.
 * Changed – The 2FA encryption key is now kept in the database (or in `GEMSECURITY_SECRET_KEY`
   in wp-config.php, which is still preferred) instead of a key file. Key files 
   created by earlier versions keep working.
 * Changed – Plugin, must-use plugin, content and upload folders are always looked
   up through WordPress, so sites that move them are scanned correctly.
 * Changed – IP location lookups use HTTPS only (ipapi.co).
 * Changed – Rate limits (including magic link limits), lockouts, alert throttling
   and unlock codes are stored in the database, so they keep working on hosts with
   a broken object cache.
 * Changed – Long scans are limited to 5 minutes instead of running without a time
   limit.
 * Changed – Updated the bundled StoreEngine SDK to 1.6.2. Declining usage tracking
   now sends nothing, and no promotional notices are loaded.
 * Changed – Every compiled JavaScript and CSS file names its source file and how
   to rebuild it.
 * Fixed – «Throttle 404 floods» only logged the flood and never blocked it.
 * Fixed – Unbanning an IP did not clear its strike count.
 * Fixed – Permanent bans expired immediately.
 * Fixed – The 2FA challenge signed out other sessions in the same browser. The 
   challenge now runs before WordPress sets the login cookie.
 * Fixed – Deleting an unapproved administrator caused PHP warnings from WordPress’s
   new-user email.
 * Fixed – The Cloudflare Turnstile «Verify keys» test never showed the widget.
 * Fixed – The core-file REST route now checks capabilities on each method, and 
   restoring needs the `update_core` capability.

#### 1.1.0 – 19/10/2026

 * Added – Plugin Guard verifies every plugin against WordPress.org checksums with
   a trust list for premium, custom, theme and must-use plugins. With enforcement
   on, untrusted plugins are stopped before they load and deactivated, activation
   and non-.org installs are refused, unknown mu-plugins are quarantined, and a 
   danger alert is sent. Runs from an early mu-plugin loader.
 * Added – Install Lock blocks zip uploads, all installs, or every file modification
   for every account, with a logged 15-minute timed unlock.
 * Added – Upload Shield (on by default) refuses executable files on every upload
   path, PHP hidden in images and scripted SVG, and writes uploads/.htaccess deny
   rules with a live PHP-execution probe and an nginx snippet.
 * Added – A first-run setup wizard (welcome, protection level, features, alerts,
   summary) opens once after a fresh activation and is reachable again from the 
   topbar; pre-wizard installs are marked legacy.
 * Added – The admin menu is grouped into Dashboard, Firewall, Login & Access, Scanning,
   Logs & Monitoring and Settings. The WordPress sidebar shows one entry per group;
   existing module URLs keep working.
 * Added – The audit log records how every event arrived (admin, REST, REST via 
   application password, XML-RPC, AJAX, WP-CLI, cron), the user agent, and a short
   login session id, via a new `gemsecurity/log_args` filter.
 * Added – Edits to live posts log a field-level diff (title, slug, content snippet,
   excerpt, author, date, parent, password, comments) and link the revision to compare
   or restore. New outbound links are listed and raise the event to warning.
 * Added – SEO meta (title and description, canonical, robots, redirect, focus keyword),
   page template and featured image changes are logged. User creation, role changes(
   admin promotions at warning) and email or password changes are logged.
 * Added – The Logs page lets you click a user to see everything they did, see the
   full history of a post, and expand a details row.
 * Added – A public page picker for the custom login URL. Logged-out login, lost-
   password and register links on public pages point at the chosen public page (
   default: homepage) and the logout link at the homepage, so the secret address
   is no longer printed to visitors and bots. New filter `gemsecurity/custom_login_public_url`.
 * Added – Front-end login forms outside wp-login.php are redirected to the 2FA 
   challenge instead of skipping it. REST endpoints that run their own challenge(
   such as Academy’s `/academy/v1/login`) can opt out via `gemsecurity/2fa_challenge_routes`
   and `gemsecurity/2fa_external_challenge`.
 * Changed – 2FA seeds are sealed with AES-256-GCM. The key lives in `GEMSECURITY_SECRET_KEY`
   or a wp-content key file, not the database and not the WordPress salts, so salt
   rotation can no longer lock users out. Existing seeds are migrated on admin load.
 * Changed – Password logins that cannot show the 2FA challenge (XML-RPC, HTTP basic
   auth, REST, AJAX popups) are refused for 2FA users; application passwords still
   work.
 * Changed – Security headers are now added to REST responses, served before `send_headers`
   ever fires; endpoint-set headers are kept.
 * Changed – Upload Shield’s no-exec `.htaccess` now also covers wp-includes (core’s
   wp-tinymce.php and ms-files.php stay allowed), languages and upgrade; removing
   it leaves other tools‹ rules byte-for-byte intact.
 * Changed – Backups move back to the standalone GemBackup plugin. The Backup module,
   page, REST routes and tables are gone from GemSecurity. When GemBackup is active,
   the pre-update backup option, Incident Response roll back and the security score’s
   recent-backup check are kept and link to GemBackup. Uninstall no longer drops
   backup tables, archives or GemBackup’s cron events.
 * Changed – Backup notification settings are removed from the Notifications page;
   they live in GemBackup’s own settings.
 * Changed – Finder (database and site scan) now searches the whole install (web
   root, core directories, every theme and stray folders) and more database tables.
 * Changed – Admin UI adopts the GemCRM color system in light and dark, with border-
   only surfaces, 8px card radius and 4px buttons and inputs. Hard-coded semantic
   tints (alerts, badges, breach rows, danger buttons, threat items) use `color-
   mix()` on tokens so they follow both themes; brand gradients are replaced with
   solid brand blue.
 * Fixed – A self-posting front-end login form has no referer, so the 2FA challenge
   used to send users to the dashboard; it now returns them to the requested URL.
 * Fixed – `/logs` never returned the user display name, so the log never showed
   who did anything (a by-reference loop over an `(array)` cast wrote to a copy).

#### 1.0.0 – 28/09/2026

 * Added – CAPTCHA is its own module, with its own page, instead of a card under
   Login Security. Sites that already use CAPTCHA keep it after the update.
 * Added – A Notifications page for alert recipients, Slack, Telegram and webhook
   delivery, and scheduled reports. These used to be on the Settings page.
 * Added – A daily report email, off by default. It lists every administrator and
   active plugin, and calls out any that were added or removed since the last report.
 * Added – An alert when GemSecurity is deactivated, by email and through Slack,
   Telegram or the webhook when alerts are on. With extended protection on, the 
   mu-plugin also sends a warning when the plugin is switched off without being 
   deactivated normally, for example by editing the database.
 * Added – Admin Guard removes administrators who are not on the whitelist every
   hour, and again whenever the whitelist changes. The «Check for unapproved admins»
   button lists who would be removed before anything happens.
 * Added – Forced password resets, by role. A reset ends every session for those
   users and emails each of them a WordPress reset link. It can run on demand, or
   on a schedule for passwords older than a set number of days.
 * Added – Test buttons for third-party settings, run before you save: CAPTCHA keys(
   with the real widget), social login app keys, Slack, Telegram, webhook, SIEM,
   alert email addresses, and the outside services the scanner and geolocation rely
   on.
 * Added – The Scanner checks .htaccess files for rules that allow PHP to run or
   redirect visitors. A malicious file can be quarantined in one click and restored
   from Incident Response. The site’s root .htaccess is reported for hand-editing
   instead, because it holds the permalink rules.
 * Added – A file you have reviewed can be marked safe in the Scanner. If the file
   changes later, it is reported again. Empty «Silence is golden» index.php files
   are no longer reported.
 * Added – Every item under «What needs your attention» on the dashboard links to
   the page where it is fixed.
 * Added – A guide for every module in a help drawer, and setup guides beside the
   fields that need keys from another service.
 * Added – Social login buttons can ask for a role for new accounts, and the `gemsecurity/
   social_login/role_registered` action fires after such an account is created.
 * Changed – Each setting now lives on one page. The WAF rules, rate limiting, 404
   throttling and bad-bot switches moved to the Firewall page (they were on the 
   Pro-only Threat Defense page), the audit log switches to the Logs page, and the
   backup settings to the Backup page. Features that existed twice, such as the 
   comment honeypot, the application password switch, quarantine and force logout,
   are now one. Your settings are carried over on update.
 * Changed – All emails use one HTML template, and each subject names the site and
   its domain.
 * Changed – With a custom login URL, a logged-out visit to wp-admin goes to the
   home page. If you are locked out, adding `define( 'GEMSECURITY_DISABLE_CUSTOM_LOGIN',
   true );` to wp-config.php turns the custom login URL off.
 * Changed – A wrong CAPTCHA secret key no longer locks everyone out of the login
   form. Verification is skipped and the problem is logged as critical until the
   key is fixed.
 * Changed – The Virtual Patch list is titled «Shields currently active» and no 
   longer shows red severity badges, so it does not read as a list of problems.
 * Changed – The StoreEngine license SDK is updated to 1.5.6. It now ships only 
   in GemSecurity, and GemSecurity Pro uses this copy.
 * Fixed – With a custom login URL, visiting wp-admin while logged out redirected
   to the secret login address.
 * Fixed – A custom login URL with spaces or capitals was previewed as one address
   and served at another. A URL that became empty after cleaning left the switch
   on while wp-login.php stayed open.
 * Fixed – A custom login URL broke two-factor and social login sign-ins.
 * Fixed – A correct two-factor code could send the user back to the login form,
   and a correct emailed code could be reported as invalid, on hosts whose object
   cache is not shared between requests. Emailed codes are now limited to five attempts.
 * Fixed – A failed social login always said «Sign-in could not be verified». It
   now gives the real reason, including the provider’s own error.
 * Fixed – Twitter/X sign-in stopped working after X retired its twitter.com sign-
   in addresses, and the credential test reported correct Twitter/X keys as wrong.
 * Fixed – The CAPTCHA key test could fail with reCAPTCHA because the widget was
   drawn before Google’s script was ready.
 * Fixed – Alerts were never emailed, only sent to Slack, Telegram and the webhook.
 * Fixed – An administrator who was not on the Admin Guard whitelist could still
   sign in if the account was created outside WordPress’s normal user screens.
 * Fixed – The Scanner reported WordPress core files as malware. After a core update,
   it showed every core file as modified until the next scan, and it did not scan
   again after the update when the daily scan was off.
 * Fixed – Warnings alone could drop the security score to F.
 * Fixed – Opening the Scanner page froze the admin, so no other menu item could
   be opened.
 * Fixed – On a new site, the backup settings showed switches that are on by default
   as off, and saving that screen would have turned off the snapshot taken before
   a restore.
 * Fixed – Switching a module on or off needed a page reload before the menu changed.
 * Fixed – Virtual Patch, Payment Integrity, Incident Response and Monitoring appeared
   unlocked without GemSecurity Pro.
 * Fixed – WordPress 6.7 and later logged a notice on every request because translations
   were loaded too early.

#### 1.0-beta1 – 13/08/2026

First public beta. GemSecurity is an all-in-one, registry-driven security suite 
with a single-page React dashboard, live security score and a toggleable module 
manager.

 * Added – Firewall & WAF: SQLi/XSS/LFI/RCE request inspection, IP blocklist (CIDR),
   request rate limiting, 404-flood throttling, bad-bot and AI-crawler blocking,
   search-bot verification.
 * Added – Hardening: disable XML-RPC / file editor / author & REST user enumeration,
   hide WP version, application-password governance, and security headers (X-Frame-
   Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, CSP).
 * Added – Login Security: brute-force lockouts, session limits & idle timeout, 
   password policy, custom login URL, admin-login email alerts, magic-link and lockdown.
 * Added – Two-Factor Authentication: app-based TOTP, email OTP and one-time backup
   codes with per-role enforcement; login CAPTCHA (reCAPTCHA v2/v3, hCaptcha, Cloudflare
   Turnstile).
 * Added – Social Login: OAuth sign-in with Google, Facebook, GitHub and Twitter/
   X.
 * Added – Admin Guard: rogue-admin auto-remediation, administrator whitelist and
   hidden-admin detection.
 * Added – API & Access hardening: REST API rate limiting, application-password 
   max-age, username-enumeration and generic-login-error protection.
 * Added – Anti-Spam: frictionless bot checks on comments and registration with 
   heuristic filtering.
 * Added – Scanner: WordPress core file-integrity checks against official checksums,
   uploads malware/PHP-pattern scan, file-change detection, link scanning, and known-
   vulnerability scanning for core/plugins/themes.
 * Added – Activity Logs & real-time Alerts with retention and CSV export.
 * Added – Backups (these moved to the standalone GemBackup plugin in 1.1.0 and 
   are no longer part of GemSecurity).
 * Added – Module manager with a live security score and one-page dashboard.

Active threat defense, virtual patching, geolocation access control, payment-integrity
monitoring, incident response, uptime/TLS monitoring, signature malware remediation&
quarantine, database-injection scan, file integrity vs WordPress.org, recovery toolkit,
and cloud backup storage with encryption & migration are available in GemSecurity
Pro.

## Meta

 *  Version **1.2.2**
 *  ئاخىرقى يېڭىلانغان ۋاقىت **1 كۈن بۇرۇن**
 *  ئاكتىپ ئورنىتىش سانى **10 دىن ئاز**
 *  WordPress نەشرى ** 6.4 ياكى يۇقىرى **
 *  **7.1.4** دا سىنالغان
 *  PHP نەشرى ** 7.4 ياكى يۇقىرى **
 *  تىل
 * [English (US)](https://wordpress.org/plugins/gemsecurity/)
 * بەلگە
 * [firewall](https://ug.wordpress.org/plugins/tags/firewall/)[recaptcha](https://ug.wordpress.org/plugins/tags/recaptcha/)
   [security](https://ug.wordpress.org/plugins/tags/security/)[social login](https://ug.wordpress.org/plugins/tags/social-login/)
   [two factor authentication](https://ug.wordpress.org/plugins/tags/two-factor-authentication/)
 *  [ئالىي كۆرۈنۈش](https://ug.wordpress.org/plugins/gemsecurity/advanced/)

## دەرىجە

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/gemsecurity/reviews/#new-post)

[بارلىق ئىنكاسنى كۆرسەت](https://wordpress.org/support/plugin/gemsecurity/reviews/)

## تۆھپىكار

 *   [ Kodezen LLC ](https://profiles.wordpress.org/kodezen/)
 *   [ Tushar Imran ](https://profiles.wordpress.org/tusharimran/)

## قوللاش

يېقىنقى ئىككى ئايدا ھەل قىلىنغان مەسىلە:

     0 / 1

 [قوللاش مۇنبىرىنى كۆرسەت](https://wordpress.org/support/plugin/gemsecurity/)