Wonder Secure user guide

Requirements

Installation

1. Upload the pluginIn WordPress, go to Plugins > Add New > Upload Plugin and choose wonder-secure.zip. You can also copy the wonder-secure folder into wp-content/plugins/.
2. Activate itClick Activate on the Plugins screen. Activation creates four database tables and schedules a daily maintenance task. The firewall, brute force protection and automatic IP blocking are switched on straight away.
3. Open Wonder SecureA new Wonder Secure item appears in the admin menu. It opens on the Dashboard.

Your first 10 minutes

Do these five things in order right after installing. They prevent the most common setup mistakes and close the biggest gaps.

1. Check how visitor IPs reach your siteGo to Firewall > Visitor IP address source. If your site is behind Cloudflare, Sucuri or a load balancer, choose the matching header. The screen shows your own IP address so you can check it is right.
2. Run your first scanOpen Malware Scanner and click Start scan. It runs in short batches. You can leave the page; the scan continues in the background.
3. Turn on two-factor for yourselfGo to your WordPress profile (Users > Profile), find Two-Factor Authentication, scan the QR code with your authenticator app and enter the 6-digit code. Save the backup codes somewhere safe.
4. Add your alert emailOpen Notifications, enter the recipients and click Send test email to check alerts arrive and don't land in spam.
5. Work through the recommendationsBack on the Dashboard, use the Fix buttons and review links on each recommendation. Each one you resolve raises your score.

Your security score

The score, out of 100, is built from 21 weighted checks across firewall, login, scan results, hardening and server setup. It sorts your site into one of three states.

Some of the checks it runs:

Dashboard

Wonder Secure Dashboard

Your overview of the site's security. It loads its panels live, so the numbers are always current.

• Security overview: your score and status, whether the firewall is active, how many IPs are blocked, and a Run a scan button.
• Threat analytics: blocked attacks, failed logins, lockouts and open scan issues, with a graph you can switch between 24 hours, 7 days and 30 days.
• Developer recommendations: everything that is lowering your score, most important first. Items a setting can solve have a Fix button; the rest have Review, which opens the right screen.
• Recent activity and top IPs: the latest events and the addresses causing the most trouble.

Malware Scanner

Wonder Secure Malware Scanner

Checks your files against the official WordPress.org releases, searches for malware and looks up known vulnerabilities.

Running a scan

Click Start scan. The scan works in batches (8 seconds of work each by default) so it never times out. When it finishes, the Findings table lists every issue with its severity.

Acting on a finding

Scan settings

Firewall

Wonder Secure Firewall

The web application firewall inspects every request before WordPress, plugins and themes load, and returns a 403 page when a request matches a rule.

IP allowlist and blocklist

Add a single IP or a CIDR range such as 203.0.113.0/24, choose Block or Allow (never blocked), and set a duration in minutes (0 means permanent). Click Allowlist my current IP to make sure you can never block yourself.

Login Security

Wonder Secure Login Security

Brute force protection

On by default: 5 failed attempts within 15 minutes locks the IP out for 30 minutes. Two extra options help further:

• Lock out immediately when a non-existent username is tried (off by default). Bots guess names like "admin"; real users rarely mistype theirs.
• Show a generic error on failed login (on by default). Hides whether the username or the password was wrong.

Current lockouts are listed under Active lockouts, where you can unlock an IP early.

Two-factor authentication

1. Install an authenticator appGoogle Authenticator, Microsoft Authenticator, 1Password, Authy or any app that supports TOTP codes.
2. Open your profileUsers > Profile, or click Set up for my account on the Login Security screen.
3. Scan the QR codeOr type the key into the app by hand.
4. Enter the 6-digit code and click Update ProfileTwo-factor is now on for your account.
5. Save your backup codesThey are shown once. Each one works a single time if you lose your phone.

Once you have it working, tick roles under Require two-factor for these roles. Users in those roles are sent to their profile to enrol before they can use the dashboard. Administrators can reset another user's two-factor from that user's profile.

CAPTCHA

Choose Google reCAPTCHA v2 (checkbox) or hCaptcha, paste the site key and secret key from the provider, and pick the forms to protect: login, registration and lost password.

Hide login URL

Turn on Move the login page to a custom address and choose an address (the default suggestion is secure-login). Visitors who are not logged in get a "not found" page, or the homepage, at wp-login.php and /wp-admin/.

Asset Protection

Wonder Secure Asset Protection

Turn on Enable asset protection (off by default), then pick a protection scope.

Block hotlinking stops other websites embedding your images, while search engines and direct visits still work. Add trusted domains, such as your CDN, under "Other domains allowed to embed images", one per line.

Hardening

Wonder Secure Hardening

Each switch closes a common attack path. All are off by default and safe for most sites.

Notifications

Wonder Secure Notifications

Email configuration

Set a sender name and an address on your own domain so alerts are not marked as spam. Add recipients separated by commas; by default alerts go to the site admin email. Click Send test email to check delivery.

Real-time alerts

On by default for administrator logins, new administrators, file changes and malware, attacks and vulnerabilities. Lockout alerts are off by default because they can be frequent. An attack alert is sent after 25 blocks in 10 minutes, and each alert type is sent at most once every 15 minutes.

Templates

Edit the subject and message. These placeholders are filled in for you:

{site_name} {site_url} {event_title} {event_details} {ip} {time} {dashboard_url}

Summary reports

A weekly report is sent by default; choose Never, Daily, Weekly or Monthly. It includes the threat graph, events by type, top offending IPs, your security score and the latest scan. Agencies can add their own company name, logo and footer under Report branding.

Activity Log

Wonder Secure Activity Log

Every blocked request, login, lockout, scan and settings change in one table. Filter by type or severity, search by IP or message, and click Export CSV to share it. Clear log deletes all entries after asking you to confirm.

Settings

Wonder Secure Settings

• Firewall rule & malware signature updates: pull new rules daily from an HTTPS feed URL without updating the plugin. Every rule is checked before it is used. No feed is set by default.
• Keep activity log for: 90 days by default.
• Delete all Wonder Secure data when the plugin is deleted: off by default.
• Export settings (JSON): download your configuration to copy it to another site.
• Emergency access: a reminder of the wp-config.php lines below.

Locked out?

Open wp-config.php with your host's file manager or FTP, add the line you need above the /* That's all, stop editing! */ comment, log in, fix the setting and then remove the line.

// Turn off the firewall, IP lists, country blocking and rate limiting.
define( 'WONDERSECURE_DISABLE_FIREWALL', true );

// Make wp-login.php work again if you forgot your custom login address.
define( 'WONDERSECURE_DISABLE_HIDE_LOGIN', true );

• Lost your two-factor device? Enter one of your backup codes instead of the 6-digit code, or ask another administrator to reset your two-factor setup from your user profile.
• Last resort: rename the wp-content/plugins/wonder-secure folder to switch the plugin off completely.

Nginx and other servers

On Apache and LiteSpeed, Wonder Secure writes its rules to .htaccess files between # BEGIN Wonder Secure markers and removes them when you deactivate the plugin.

Nginx ignores .htaccess. The Asset Protection screen shows the equivalent configuration for your server block; add it and reload Nginx (your host can help). The firewall, login security, scanner and everything else run in PHP and work on every server.

Privacy and external services

Wonder Secure sends nothing to Wonderfolks Interactive. Security events (IP address, country, user ID, request details) are stored in your own database and deleted after your retention period. Two-factor secrets are encrypted and backup codes are hashed. The plugin also adds suggested text to Settings > Privacy for your privacy policy.

Deactivate and uninstall

• Deactivating removes scheduled tasks and the plugin's server rules. Your settings and logs stay.
• Deleting keeps your data unless Delete all Wonder Secure data when the plugin is deleted is on under Settings. Then its tables, settings, quarantine and two-factor secrets are removed.

For developers

Filters and actions

REST API

Namespace wondersecure/v1. Every route needs the manage_options capability and a wp_rest nonce.

Rule and signature feed

Set the feed under Settings, or with a constant in wp-config.php. It is fetched daily, and entries whose pattern does not compile are skipped.

define( 'WONDERSECURE_SIGNATURES_URL', 'https://example.com/wonder-secure/feed.json' );

{
  "version": "2026.10.16",
  "waf_rules": [
    { "id": "custom-001", "category": "sqli", "severity": "high",
      "targets": ["get", "post", "cookie", "uri"],
      "pattern": "/\\bunion\\s+select\\b/i",
      "description": "UNION-based SQL injection" }
  ],
  "malware_signatures": [
    { "id": "mw-custom-001", "severity": "critical", "types": ["php"],
      "pattern": "/eval\\s*\\(\\s*base64_decode/i",
      "description": "Obfuscated eval" }
  ],
  "malware_hashes": { "d41d8cd98f00b204e9800998ecf8427e": "Known web shell" }
}

Rule targets: get, post, cookie, uri, ua, referer. Severities: low, medium, high, critical. Categories match the switches on the Firewall screen.