Apaxon Security Pro
Available now£59/yearScanning, enforcement, and the evidence afterwards.
The free plugin hardens the site. Pro tells you when something changed that should not have, makes two-factor non-optional for the accounts that matter, and exports the audit trail an insurer or a client will ask for.
- Extends free Security
- One year of updates
- No lockout risk
What it does.
Malware and integrity scanning
Core, plugin and theme files compared against their known-good checksums, plus heuristics for the injected-PHP patterns that make up most real WordPress compromises.
Enforced two-factor
Required by role, with a grace period and recovery codes issued before enforcement begins. Optional 2FA on an administrator account is 2FA that is usually off.
Login anomaly alerts
A successful login from a new country or an unusual hour, flagged. Most compromises are a valid password used by the wrong person, which no amount of hardening catches.
Audit export
The activity log exported as a signed CSV or PDF for a client report, an insurance claim or a due-diligence questionnaire.
Still not a firewall
The same honest limit as the free plugin.
Pro scans, enforces and reports. It still cannot block traffic before PHP runs, because no plugin can, and paying for it does not change that. Put Cloudflare or your host in front of the site; this is what happens behind it.
- Scanning runs on a schedule, not on every request
- Enforcement has a grace period, so nobody is locked out by an upgrade
- Every finding names the file and the line, not a severity score
Requirements
- Requires
- Apaxon Security (free), Apaxon Core
- Price
- £59 per year, one site
- Scanning
- Scheduled, checksum and heuristic
- Licence
- GPLv2 or later
Questions
Will scanning slow the site down?
It runs on a schedule in the background and is throttled to stay inside your host’s limits. Nothing is scanned during a page request.
What if the scanner finds a false positive?
Findings are shown with the file and the matching line so you can judge them, and anything can be acknowledged. A scanner you cannot argue with is one you learn to ignore.
Does enforced 2FA lock out my client?
Recovery codes are issued during the grace period, before enforcement starts. Nobody is required to enrol without first being given a way back in.
Ready to power your WordPress website the smart way?
Start with Apaxon Core — free, GPL, and with nothing to cancel. Add the plugins you need when you need them.