Description
NeverLast Security Lite is a complete, standalone security plugin. It runs inside your site: no account, no licence key, no telemetry, and no feature locked behind an upgrade.
What it does
- Firewall – inspects requests for common SQL injection, XSS, path traversal, file inclusion, command injection, Log4Shell and Shellshock shapes, in Monitor, Balanced or Strict mode.
- Upload protection – rejects executable uploads, smuggled server-control files and images that carry code, and holds uploads it cannot fully inspect.
- Login security – attempt limits and lockouts, generic login errors, author-enumeration and REST user protection, XML-RPC and Application Password controls.
- Two-factor authentication – optional TOTP for administrators with encrypted secrets and one-use recovery codes.
- Emergency controls – end every session or freeze logins, with an optional secret-protected emergency link in login alerts.
- Health check – a prioritized score with plain-language recommendations.
- Integrity monitoring – an approved local baseline of your files, resumable comparison for large sites, uploads review, and optional verification against WordPress.org checksums.
- Quarantine you decide – a suspicious upload is held as an authenticated encrypted, non-executable copy until you download it as evidence or delete it. Nothing is deleted automatically.
- Activity log – bounded retention, masked IP addresses, CSV and JSON export, and throttled email alerts.
- Security headers – baseline browser headers and optional CSP Report-Only diagnostics.
What it does not do
Lite runs inside WordPress, so it cannot protect anything served before WordPress loads and it does not replace web-server, hosting, CDN or backup controls. It does not scan database content, it logs but does not block the creation of administrator accounts, and it never repairs files automatically. An integrity baseline shows what changed since you approved it; it does not prove the approved state was clean. Single-site installations only.
No security product can guarantee a site is free of vulnerabilities. Keep WordPress, PHP, plugins and themes updated, use least privilege, and keep tested off-site backups.
Support and security contact: nss@neverlast.ro