Title: NeverLast Security Lite Author: neverlast Published: 16 oktober 2026 Last modified: 24 oktober 2026 --- Sök tillägg ![](https://ps.w.org/neverlast-security-lite/assets/icon-256x256.png?rev=3751026) # NeverLast Security Lite Av [neverlast](https://profiles.wordpress.org/neverlast/) [Ladda ner](https://downloads.wordpress.org/plugin/neverlast-security-lite.1.2.8.zip) * [Detaljer](https://sv.wordpress.org/plugins/neverlast-security-lite/#description) * [Recensioner](https://sv.wordpress.org/plugins/neverlast-security-lite/#reviews) * [Installation](https://sv.wordpress.org/plugins/neverlast-security-lite/#installation) * [Utveckling](https://sv.wordpress.org/plugins/neverlast-security-lite/#developers) [Support](https://wordpress.org/support/plugin/neverlast-security-lite/) ## Beskrivning NeverLast Security Lite is a complete, standalone security plugin. It runs inside your site: no account, no licence key, no telemetry, and no feature locked behind an upgrade. #### What it does * **Firewall** – inspects requests for common SQL injection, XSS, path traversal, file inclusion, command injection, Log4Shell and Shellshock shapes, in Monitor, Balanced or Strict mode. * **Scanner trap** – optional exact-path probes for missing configuration and plugin decoys. Monitor logs locally, Deceive serves inert text, and Block returns 404. No files are placed on disk. * **Upload protection** – rejects executable uploads, smuggled server-control files and images that carry code, and holds uploads it cannot fully inspect. * **Login security** – attempt limits and lockouts, generic login errors, author- enumeration and REST user protection, XML-RPC and Application Password controls. * **Two-factor authentication** – optional TOTP for administrators with encrypted secrets and one-use recovery codes. * **Emergency controls** – end every session or freeze logins, with an optional secret-protected emergency link in login alerts. * **Health check** – a prioritized score with plain-language recommendations. * **Integrity monitoring** – an approved local baseline of your files, resumable comparison for large sites, uploads review, and optional verification against WordPress.org checksums. * **Quarantine you decide** – a suspicious upload is held as an authenticated encrypted, non-executable copy until you download it as evidence or delete it. Nothing is deleted automatically. * **Activity log** – bounded retention, masked IP addresses, CSV and JSON export, and throttled email alerts. * **Security headers** – baseline browser headers and optional CSP Report-Only diagnostics. #### What it does not do Lite runs inside WordPress, so it cannot protect anything served before WordPress loads and it does not replace web-server, hosting, CDN or backup controls. It does not scan database content, it logs but does not block the creation of administrator accounts, and it never repairs files automatically. An integrity baseline shows what changed since you approved it; it does not prove the approved state was clean. Single-site installations only. The optional scanner trap is off by default. It covers five exact, missing probe paths only after the request reaches WordPress. Existing files are never replaced, and authenticated or administrative requests are excluded. In Firewall Monitor mode, the trap also observes only. The ordinary firewall can still act on a suspicious request independently. #### Lite and PRO Lite is a standalone plugin; PRO is a separate product, not required to use any Lite feature. Both include a local firewall, login protection, administrator two- factor authentication, file-integrity monitoring, activity logs and an optional scanner trap. The scope differs: * **Lite** uses five exact, missing scanner-probe paths. Its local trap can observe, serve inert text or return 404; it does not score visitors or lock out an IP because of a trap hit. * **PRO request protection** adds custom WAF rules, virtual patches, request behavior contracts and broader scanner-trap correlation. * **PRO investigation** adds malware scanning, vulnerability intelligence, Safe Fuzzer diagnostics and Compatibility Autopilot. * **PRO identity and recovery** adds Identity Risk, Browser Integrity, Extreme Security Features and the independent Guardian integrity layer. PRO feature availability and enforcement mode depend on the installed PRO release and its configuration. This comparison does not change Lite’s independent operation. No security product can guarantee a site is free of vulnerabilities. Keep WordPress, PHP, plugins and themes updated, use least privilege, and keep tested off-site backups. Support and security contact: nss@neverlast.ro ### External services NeverLast Security Lite never sends site content, credentials, visitor records or telemetry, and never contacts NeverLast. Every connection to another service is off until you turn it on: #### Official crawler IP lists – off by default Only when you enable a provider under Protection, WP-Cron downloads its public IP list once a day so that provider’s genuine crawler is not counted against the optional anonymous rate limit. The request carries your server’s IP address and a plugin user agent that does not include your site’s address; nothing else is sent. * DuckDuckGo: https://duckduckgo.com/duckduckbot.json – privacy https://duckduckgo. com/privacy/ * Ahrefs: https://api.ahrefs.com/v3/public/crawler-ip-ranges – terms https://ahrefs. com/legal/terms, privacy https://ahrefs.com/legal/privacy-policy * UptimeRobot: https://cdn.uptimerobot.com/api/IPv4andIPv6.txt – terms https:// uptimerobot.com/terms/, privacy https://uptimerobot.com/privacy/ #### WordPress.org checksums – off by default Only when you enable ”Verify changed core and plugin files with WordPress.org checksums” under Protection, a comparison that finds changed, added or missing WordPress core or plugin files downloads the official checksums for that release, to tell a genuine update apart from tampering. Core checksums come from https://api.wordpress.org/ core/checksums/1.0/ with the WordPress version and locale; plugin checksums come from https://downloads.wordpress.org/plugin-checksums/ with the plugin slug and version. Requests carry your server’s IP address and a plugin user agent without your site’s address, and results are cached for six hours. While this is off, files are compared with your approved baseline only. WordPress.org privacy policy: https:// wordpress.org/about/privacy/ #### Your own site The Directory listing health check requests your own uploads address to see whether the server returns a file index. Optional crawler verification uses your server’s DNS resolver; no verification API is contacted. ### Privacy Security events are stored in your WordPress database with a masked IP address, a salted one-way IP hash, the request method and path, and bounded redacted context. Passwords, cookies, authorization headers, nonces, secrets and recovery codes are never logged. The activity log keeps seven days by default. Email alerts use your site’s own mail configuration and go to the WordPress administration email unless you set another address. Throttled critical alerts are on by default; administrator- login alerts and the weekly summary are sent only when enabled. A quarantined file is held under an access-restricted neverlast-security-lite/quarantine directory in your configured uploads folder with authenticated AES-256-GCM encryption and its original SHA-256. Apache/IIS access-control files are included; nginx and other web servers should still explicitly deny direct HTTP access. Decryption uses the WordPress authentication salts, so export retained evidence before rotating or replacing those salts. On upgrade, previous Base64 evidence is checked and re- encrypted when migrated from wp-content/.nlssl-quarantine; originals are kept if migration fails. Direct restoration of executable evidence is disabled; download it for offline analysis or permanently delete it. Evidence survives ordinary uninstall; enabling ”Delete Lite data on uninstall” removes held data along with settings and tables. ## Skärmdumpar [[ [[ [[ [[ [[ [[ [[ ## Installation 1. Install through Plugins > Add New, or upload the ZIP, then activate. Protective defaults apply at once: the firewall in Balanced mode, XML-RPC and Application Passwords disabled, public REST user endpoints hidden, author enumeration blocked and the dashboard code editor disabled. 2. Open NeverLast Security > Protection. If Jetpack, the WordPress mobile apps or another service needs XML-RPC or an Application Password, untick the matching control. Start in Monitor if you are unsure about compatibility, then move to Balanced. 3. Run the Health Check and work through the prioritized items. 4. Review your installed files, then create the first integrity baseline. 5. Enroll each administrator in TOTP and store the recovery codes offline. #### Using the optional Scanner Trap 1. Open NeverLast Security > Protection. Keep ”Enable local firewall” on. Choose Balanced or Strict firewall mode if you intend to use Deceive or Block; Firewall Monitor forces the trap to Monitor. 2. In Scanner trap > Probe handling, select Monitor and save. The effective mode is shown directly below the control. Off disables the trap. 3. Review `scanner_trap_probe` entries under NeverLast Security > Activity. The log records the probe type and effective mode with a masked IP address; it does not send the event to another service. 4. After checking legitimate traffic, choose Deceive to return inert plain text with HTTP 200, or Block to return HTTP 404. You can return to Monitor or Off at any time. The regular firewall can still block a request independently while the trap is in Monitor. The trap handles only GET and HEAD requests for five missing paths: `/.env`, `/. git/config`, `/wp-config.php.bak`, `/xmlrpc.php.bak` and `/wp-content/plugins/fake- vulnerable-plugin/readme.txt`. It does not intercept existing files, logged-in users, administration requests, or requests with query or body data. The web server or CDN may answer a request before WordPress loads; such requests are outside Lite’s view. Test changes on a staging site before using Deceive or Block on production. ## Vanliga frågor ### Is Lite a restricted version of a paid product? No. Lite is complete on its own, with its own code, settings and database tables. Nothing is locked, trial-limited or downloaded at runtime. ### Which firewall mode should I use? Monitor records matching requests without blocking. Balanced blocks high-confidence matches and suits most sites after a period of observation. Strict blocks at a lower threshold; test forms, checkout and custom APIs before enabling it. ### Why does a comparison report differences after I update a plugin? Your baseline describes the versions you approved. After an update, review the reported package changes and, if they are what you installed, create a new baseline. ### Does a clean comparison prove there is no malware? No. It shows that the monitored files match the baseline you approved. It cannot see logic flaws, database content or files outside its scope. ### What happens to a quarantined file? It is removed from uploads and held as an encrypted copy until you choose to download it as evidence or delete it permanently. Direct restoration of suspicious files has been disabled to prevent executable files being reintroduced. If something outside NeverLast Security removes the held copy, for example host antivirus, the entry is reported as missing rather than silently disappearing. ### How do I recover if my authenticator is unavailable? Use an unused recovery code, or ask another administrator to reset your TOTP. Store recovery codes offline before rotating AUTH_KEY or AUTH_SALT, because existing TOTP secrets cannot be decrypted afterwards. ### How do I lift an Emergency Login Freeze? Reset an administrator password through the normal WordPress flow, wait for the freeze to expire, or define NLSSL_DISABLE_LOGIN_FREEZE as true in wp-config.php as an offline override, and remove it afterwards. ### Does uninstall remove my data? Only if ”Delete Lite data on uninstall” was enabled first. Deactivation never deletes security data. ## Recensioner Detta tillägg har inga recensioner. ## Bidragsgivare och utvecklare ”NeverLast Security Lite” är programvara med öppen källkod. Följande personer har bidragit till detta tillägg. Bidragande personer * [ neverlast ](https://profiles.wordpress.org/neverlast/) * [ lajea87 ](https://profiles.wordpress.org/lajea87/) [Översätt ”NeverLast Security Lite” till ditt språk.](https://translate.wordpress.org/projects/wp-plugins/neverlast-security-lite) ### Intresserad av programutveckling? [Läs programkoden](https://plugins.trac.wordpress.org/browser/neverlast-security-lite/), kika på [SVN-filförvaret](https://plugins.svn.wordpress.org/neverlast-security-lite/) eller prenumerera på [utvecklarloggen](https://plugins.trac.wordpress.org/log/neverlast-security-lite/) via [RSS](https://plugins.trac.wordpress.org/log/neverlast-security-lite/?limit=100&mode=stop_on_copy&format=rss). ## Ändringslogg #### 1.2.8 * Added an opt-in, local-only scanner trap for five exact missing probe paths, with Monitor, Deceive and Block modes. It never writes decoy files, and reports the effective mode on Protection. * Baseline build and confirmation feedback now appears in the Integrity work area, and the page returns there after submission. A resumable build is labeled In progress rather than Failed. #### 1.2.7 * Uses WordPress filesystem abstractions for evidence permissions, writable-folder checks, and nonrecursive uninstall cleanup. Retains bounded encrypted streaming for safety with an explicitly documented PHP_CodeSniffer exception. Operations fail closed when private permissions cannot be enforced. #### 1.2.6 * WordPress.org prereview remediation: configured uploads quarantine storage with legacy evidence encryption and migration, portable findings paths, no direct executable restoration, restricted dashboard notices, and corrected privacy URL. #### 1.2.5 * Fixed: a request body sent with GET, or under a Content-Type the firewall did not list (WordPress still reads ”application/json,” as JSON), was not inspected. Every body is now inspected; binary files are left to the upload guard. * Fixed: data deletion on uninstall left the quarantine .htaccess and failed storage probes behind. #### 1.2.4 * Fixed: a baseline or comparison that runs in several steps could check a folder twice or skip a file when files were added or removed meanwhile, for example the .maintenance file WordPress writes during an update. The comparison then stopped with a storage error or reported an existing file as deleted. Each folder now resumes after the last file name it checked. #### 1.2.3 * Fixed: on WordPress 6.6, quarantine removed a file from uploads but discarded the held copy and reported that nothing was quarantined. Deletions are now confirmed on disk. * The emergency response page loads its styles through the WordPress style API. The complete history is in changelog.txt inside the plugin folder. ## Meta * Version **1.2.8** * Senast uppdaterat **4 dagar sedan** * Aktiva installationer **Färre än 10** * WordPress-version ** 6.6 eller senare ** * Testat upp till **7.1.4** * PHP-version ** 8.1 eller senare ** * Språk * [English (US)](https://wordpress.org/plugins/neverlast-security-lite/) * Etiketter * [File Integrity](https://sv.wordpress.org/plugins/tags/file-integrity/)[firewall](https://sv.wordpress.org/plugins/tags/firewall/) [login security](https://sv.wordpress.org/plugins/tags/login-security/)[security](https://sv.wordpress.org/plugins/tags/security/) [two factor authentication](https://sv.wordpress.org/plugins/tags/two-factor-authentication/) * [Avancerad vy](https://sv.wordpress.org/plugins/neverlast-security-lite/advanced/) ## Betyg Än så länge har inga recensioner skickats in. [Your review](https://wordpress.org/support/plugin/neverlast-security-lite/reviews/#new-post) [Visa alla recensioner](https://wordpress.org/support/plugin/neverlast-security-lite/reviews/) ## Bidragande personer * [ neverlast ](https://profiles.wordpress.org/neverlast/) * [ lajea87 ](https://profiles.wordpress.org/lajea87/) ## Support Har du något att säga? Behöver du hjälp? [Visa supportforum](https://wordpress.org/support/plugin/neverlast-security-lite/)