Application firewall
Inspects requests before WordPress: SQL injection, file inclusion, code execution, XSS, attack tools. Observe mode lets you start without risk.
Next-generation WordPress security
Attacks stop before WordPress.
SentrixWP inspects every request, protects logins with two-factor authentication, scans your files and database, and keeps a log nobody can tamper with. Nothing leaves your server unless you decide so.
- Free local protection
- No outside call without your consent
- WordPress 6.9+ · PHP 8.1+
SentrixWP firewall
Live12,480 requests inspected WAF
- attack families recognized
- 8
- outside calls without your consent
- 0
- escalating bans for repeat attackers
- 1 h → 7 d
- of local protection is free
- 100%
Features
Everything it takes to keep a WordPress site clean
One plugin, written to be understood by site owners, not only by experts.
IP reputation
An address that attacks repeatedly is banned from the whole site: one hour, then one day, then seven days if it returns. Computed locally.
Protected logins
Locks addresses after repeated failures, and refuses password logins over XML-RPC for protected accounts.
Two-factor authentication
TOTP codes with Google Authenticator, 1Password or Bitwarden, 10 recovery codes, and per-role enforcement for your administrators.
File scanner
Compares WordPress with the official files, finds malicious code and PHP hidden in uploads. Runs daily in the background.
Database scanner
Finds scripts injected into posts and options, and unknown administrators. Cleaning with a before and after preview.
Reversible quarantine
A suspicious file is encrypted and set aside. If the site stops responding without it, it comes back on its own. One-click restore.
Tamper-evident log
Logins, roles, plugins, themes: each entry is signed and chained to the previous one, so any change can be detected.
Alerts
Important events are grouped and sent by email or to an HTTPS webhook, so you miss nothing without being flooded.
Cloud
AI analysis
Ambiguous files are explained by an AI: verdict, confidence, evidence and recommended action. Only if you turn it on.
Getting started
Protected in four steps, without breaking anything
Every protection starts carefully, so you stay in control.
- 1
Install the plugin
Upload SentrixWP to WordPress and activate it. The dashboard tells you what is left to do.
- 2
Observe
The firewall records attacks without blocking anything, so you can check that no real visitor is affected.
- 3
Block
Switch to blocking, turn on two-factor authentication and run a first full scan.
- 4
Add the cloud
Optional: connect the site for AI analysis and log anchoring. You can disconnect at any time.
Dashboard
Your security status, in one sentence
The overview tells you whether all is well, what is left to do, and why. Every problem comes with an explanation and the possible actions.
- Attacks blocked and observed over 14 days
- Most triggered rules and most active addresses
- Active protections at a glance
Two-factor authentication
A stolen password is no longer enough
After the password, no session is opened until the 6-digit code is entered. The QR code is generated by the plugin itself: your secret never goes through an outside service.
- Works with every TOTP app
- 10 single-use recovery codes
- Required per role, with reset by an administrator
- Replayed codes refused, attempts limited
AI analysis
When a file looks wrong, you get a clear answer
Local rules settle most cases. For ambiguous files, and only if you allowed it, an AI analysis explains what the code does and what to do about it.
- Verdict, confidence and evidence
- Only the file concerned is sent, never your content
- Known verdicts are found by hash, without sending the file again
Security and privacy
A security plugin must be safe first
We designed it starting from what could go wrong.
Nothing leaves without consent
No cloud connection until you tick “Allow cloud analysis”. Local protection does not need it.
Encrypted secrets
2FA secrets encrypted, recovery codes and license keys hashed, log IP addresses pseudonymized.
Data, never code
Whatever the cloud sends is signed (Ed25519) and handled as data: never run.
Fails safe
A quarantine that breaks the site is undone, and a recovery link restores access if you get locked out.
Pricing
Free to protect. Paid to go further.
The firewall, 2FA, scanner and log are free, with no time limit. Paid plans add AI analysis and more sites.
Free
All the local protection, forever.
Free
- 1 site
- No AI analysis
- Application firewall and IP reputation
- Login protection and two-factor authentication
- File and database scanner
- Quarantine, tamper-evident log, alerts
- Signed rules and log anchoring (cloud, optional)
Essential
For a site that matters.
$99/year
- 1 site
- 30 AI analyses per site per month
- Everything in Free
- AI analysis of suspicious files
- Explanation, evidence and recommended action
Most popular
Pro
For freelancers and their clients.
$249/year
- Up to 5 sites
- 20 AI analyses per site per month
- Everything in Essential
- One license for all your sites
- AI analysis quota on every site
Agency
For managing a fleet of sites.
$599/year
- Up to 25 sites
- 10 AI analyses per site per month
- Everything in Pro
- Up to 25 sites on one license
- Enterprise plan available beyond
Prices in US dollars, before tax. The exact amount with local tax is shown before payment.
Payment is handled by Paddle, our official reseller, who issues your invoice.
More than 25 sites?
Let’s talk about an Enterprise plan with a suitable analysis quota.
FAQ
Your questions, answered
Yes. Every protection that runs on your server is free and stays free: firewall, IP reputation, login protection, two-factor authentication, scanner, quarantine, log and alerts.