Security checks and active controls

Security Ninja Pro extends the Security Ninja dashboard with cloud firewall controls, malware scanning and cleanup, login protection, hardening options, expanded event logging, and scheduled scans and reports. The base extension includes an 8G-based firewall for common malicious requests, more than 50 security tests, vulnerability and core integrity scanners, and a basic events logger. The firewall blocks common requests; Pro includes controls such as failed-login limits and two-factor authentication.

On WordPress 7, the base plugin also includes an AI Security Advisor that summarizes scan findings using an LLM provider you connect through WordPress AI Connectors. You choose the provider; Security Ninja does not supply API keys. Security checks and firewall rules help administrators review and manage common risks, but they cannot establish that a website is free of every threat.

Control traffic with the cloud firewall

Pro adds a cloud firewall and advanced Web Application Firewall controls that can block known bad IP addresses from a database described as containing more than 600 million addresses. Country blocking and IP management provide additional ways to restrict traffic. The Cloud Firewall also whitelists known third-party service IPs, while administrators can add IP addresses and CIDR ranges manually.

The free plugin already includes the 8G-based firewall for common malicious requests and bot noise. Review country and IP rules against the users and services your site needs before applying them.

Scan for malware and vulnerabilities

The Advanced Malware Scanner can detect and clean malicious code and suspicious documents, including malicious scripts, backdoors, and suspicious PHP or JavaScript entries. Its tools include one-click quarantine and deletion for infected files, so review flagged items before removing them.

The Vulnerability Scanner identifies known issues in extensions and themes. The Core Scanner checks WordPress core folders for modified or unexpected files and includes a file viewer; administrators can restore altered core files or remove suspicious unknown files. These scanners are available in the base plugin. Pro adds scheduled scans and reporting for recurring reviews.

Protect logins and harden settings

Pro login protection can limit failed login attempts, rename the login URL, and add two-factor authentication. The base plugin records successful and failed login attempts, but it does not block repeated failed logins on its own.

One-click fixes on the Fixes page include disabling XML-RPC, restricting file editing, and hiding PHP error messages. Review each setting before enabling it, especially if a site depends on a particular WordPress process or integration.

Follow security activity over time

The base Events Logger records firewall activity and login attempts. Pro expands logging with security log exports, scheduled email reports, webhooks such as Slack or Discord notifications, and deeper alerting. This gives administrators more ways to review firewall events, login activity, and other security information.

Scheduled scans can run daily, weekly, or monthly, with reports sent by email. The reports cover vulnerability and malware findings.

Install and configure the plugin

1. Install and activate Security Ninja Pro on the WordPress site.
2. Open the Security Ninja dashboard and review the security tests, scanner results, and current events.
3. Configure the cloud firewall, IP or country controls, login protection, and two-factor authentication as needed.
4. Review one-click fixes before applying them, then configure scheduled scans, reports, exports, or webhooks.