SEOSiri Shield Starter — WordPress Firewall & Malware Scanner
by Momenul Ahmad | SEO Architect & AI Developer @SEOSiri
$19
🛡 ESSENTIAL WORDPRESS SECURITY — PLUG IN AND PROTECT IN 5 MINUTES
Built by Momenul Ahmad, founder of SEOSiri and a decade-long SEO, WordPress and digital security professional, SEOSiri Shield Starter gives your WordPress site production-grade protection without the subscription tax.
─────────────────────────────────
🔥 WEB APPLICATION FIREWALL (WAF)
─────────────────────────────────
Stops attacks before they reach WordPress:
• SQL Injection — 20+ pattern rules (UNION SELECT, DROP TABLE, EXEC, CHAR injection, hex encoding, INFORMATION_SCHEMA, OUTFILE, and more)
• Cross-Site Scripting (XSS) — 15 patterns including script tags, event handlers, javascript: URIs, SVG-based XSS, expression(), data:text/html
• Local File Inclusion (LFI) — path traversal, etc/passwd, proc/self/environ, php://filter, phar://, zip://
• Remote File Inclusion (RFI) — external URL injection in parameters
• Shell Upload Detection — blocks executable files in wp-content/uploads
• Directory Traversal — URL-encoded traversal sequences
• XXE Injection — XML external entity attacks
• Rate Limiting — configurable max requests per minute per IP
• Bad Bot Blocker — 30 known attack tools including SQLMap, Nikto, Nessus, Burp Suite, Acunetix, Metasploit, Nmap, Nuclei, OWASP ZAP
─────────────────────────────────
🔍 MALWARE SCANNER
─────────────────────────────────
• WordPress core file integrity check (vs. WordPress.org checksums API)
• Plugin and theme file scanning with 30+ malware signatures
• Shell detection: c99, r57, WSO, FilesMan, b374k, IndoXploit
• Crypto miner detection: Coinhive, CryptoLoot, CryptoNight
• PHP backdoor patterns: eval(base64_decode), eval($_POST), assert(), shell_exec
• High-entropy code detection (obfuscated/encoded malware)
• Uploads directory scan for PHP and executable files
• SSL certificate validity and expiry monitoring
• HTTP security headers audit
• WordPress hardening checklist
─────────────────────────────────
🔑 LOGIN PROTECTION
─────────────────────────────────
• Configurable max login attempts (default: 5)
• Configurable lockout duration (default: 30 minutes)
• Blocks XML-RPC brute force attacks
• Blocks user enumeration via ?author= and REST API
• Optional: custom login URL (hide /wp-login.php)
─────────────────────────────────
🔒 HARDENING & HEADERS
─────────────────────────────────
• Strict-Transport-Security (HSTS)
• Content-Security-Policy (CSP)
• X-Frame-Options: SAMEORIGIN
• X-Content-Type-Options: nosniff
• Referrer-Policy
• Permissions-Policy
• Remove WordPress version from HTML and script/style URLs
• Disable file editor in admin
• Force HTTPS redirect
• Upload directory PHP execution block
─────────────────────────────────
📊 LOGGING & ALERTS
─────────────────────────────────
• 30-day security event log (database-backed)
• Email alerts with configurable severity threshold
• IP blocking directly from the log table
• Event types: WAF blocks, login failures, lockouts, bad bots, file changes
─────────────────────────────────
✅ WHAT'S INCLUDED
─────────────────────────────────
• seosiri-shield.zip — WordPress plugin (activate in one click)
• ACTIVATION.txt — Quick-start card with license key steps
• README.md — Full installation and configuration guide
• Gumroad license key — activates plugin, domain-locked to 1 live site
Read guide : WordPress Security Plugin Guide.
─────────────────────────────────
🚀 NEED MORE? SEOSIRI SERVICES
─────────────────────────────────
Starter covers the security layer. For a full-stack digital presence, Momenul Ahmad and the SEOSiri team offer:
→ Custom WordPress Design & Development
→ Technical SEO (schema, Core Web Vitals, local UAE/BD SEO)
→ AEO — Answer Engine Optimization (ChatGPT, Perplexity, AI Overview)
→ GEO — Generative Engine Optimization (LLM citation building)
→ AI Agent Building (custom assistants, automations, chatbots)
→ Google Ads, LinkedIn, WhatsApp marketing
Website: https://www.seosiri.com/
Store: https://store.seosiri.com/
Email: info@seosiri.com