CodeSeven Security Pro

Modern Security Platform for WordPress

CodeSeven Security Pro is a protection platform for WordPress sites, built with the philosophy of modern SaaS security tools — not as yet another "antivirus plugin" with alarming red banners, but as a Security Operations Console in the style of Linear / Vercel / Datadog. A calm, operational interface that a professional administrator can rely on every day.

It is built from 6 integrated modules — Firewall, Login Security, Activity Monitor, Health, Operations Dashboard and Notifications — that work as a unified security ecosystem with a shared telemetry pipeline, normalized event schema and dynamic risk scoring.

The first WordPress security plugin whose firewall cannot lock its own administrator out of the site (Trusted Admin Protection, v1.0.4).

🛡️ Firewall — Modern Rule Engine

This is not a primitive IP blocker. The plugin uses pipeline-based request processing with a rule engine and threat scoring — every request passes through configurable rules before it reaches WordPress.

• IP Blocklist Management — automatic blocking with a configurable TTL (default 60 minutes)
• Stable TTL (v1.0.4) — a "1-hour block" really means 1 hour, even during a continuous attack — repeat hits increase the attempts counter but do not refresh blocked_until
• Static IP Whitelist (v1.0.4) — bypasses all firewall checks for CI servers, monitoring and office networks
• Trusted Admin Protection (v1.0.4) — auto-learns IP + User-Agent (sha256 fingerprint) on successful admin login. Why IP+UA and not just IP? Because an attacker on the same IP cannot piggyback on a trusted session. Default ON, TTL 30 days
• Firewall Rules Registry — pluggable rules with priority, condition and action
• XML-RPC Protection — disabled by default (one of the most attacked endpoints in WordPress)
• Detailed Event Logs — full audit trail of every blocked request with IP, reason and rule matched

🔐 Login Security — Authentication Intelligence Engine

This is not a "5 fails = ban" plugin. It is a multi-stage analyser with identity correlation, device fingerprinting and dynamic risk scoring.

Progressive Penalties (instead of a binary block)

• 3 failures — 5-second delay (slowing responses to bots)
• 5 failures — warning event emitted to the Activity stream
• 8 failures — 15-minute IP block
• 15 failures — 24-hour block + admin notification
• Every threshold is configurable in the settings

Identity Correlation Engine

Built-in correlators that detect sophisticated attack patterns:

• Credential Stuffing — same IP + 5+ different usernames within 10 minutes → hard block IP 24h
• Distributed Brute Force — same username + 10+ different IPs within 30 minutes → block username + admin notification
• Admin Probing — 3+ failed attempts against the "admin" username → block IP for 1 hour
• Username Enumeration — 10+ attempts against non-existent usernames → block IP for 2 hours

Dynamic Risk Scoring

NOT a static severity. The score is calculated dynamically based on: failure count, velocity (attempts per minute), username intelligence (admin probing), bot signature detection, business hours / new country / previously blocked IP — 11 factors in total.

Device Fingerprinting

Lightweight session correlation via a sha256 hash of IP + User-Agent + Accept-Language + Accept-Encoding. This is not invasive tracking — it is used only for anomaly detection and session correlation.

2FA Architecture Ready

A pluggable provider system is already in the code — TOTP (Google Authenticator), Email OTP, Backup Codes, WebAuthn / passkeys. The provider implementations will arrive in future versions.

📊 Activity Monitor — Telemetry Engine

This is not an activity log. It is a production-grade event pipeline with a normalized schema, threat correlation and an event-driven feedback loop.

Normalized Event Schema

Every event in the system has a UUID, trace_id, category, severity, actor (IP / user / country), context, risk_score, tags and timestamp in a standardised JSON format — ready for SIEM integration or cloud sync.

Event Categories

• auth — login.success, login.failed, password.reset
• firewall — request.blocked, rule.triggered
• system — plugin.installed, theme.changed, core.updated
• filesystem — file.modified, file.created, file.deleted
• api — endpoint.unauthorized, malformed.payload
• license — activation.success, validation.failed
• user — user.created, role.changed, capability.granted

Severity-Based Retention

A different retention policy for each severity level (asynchronous cleanup via WP-Cron):

• debug → 7 days
• info → 30 days
• notice → 60 days
• warning → 90 days
• high → 180 days
• critical → 365 days
• emergency → PERMANENT (never deleted)

Async Ingestion

Events are NOT written synchronously during the request. An in-memory queue + batch INSERT on shutdown — zero blocking of user requests, up to 100× faster than per-event writes. Built for 10 million events.

Threat Correlation

Single events are noise — patterns are signal. Correlation rules group related events into threat narratives (e.g. brute force + successful login + role change = critical incident).

❤️ Health & Metrics — Operational Observability

A required module — the only one that cannot be disabled. The foundation for all dashboard visualisations.

Real-Time Health Service

Per-request health checks with reporting from every component: DB connectivity + latency, migration state, module registry (active vs loaded), cache health, event bus, activity ingestion queue depth, login security state, firewall state. Output: healthy / degraded / critical with a per-component breakdown.

Pre-Computed Metrics Aggregation

The dashboard does NOT query raw events (that would kill performance at 1M+ events). Background workers aggregate hourly + daily metrics, and the dashboard reads pre-computed rows. Under 50ms for a 24h summary.

Background Jobs System

A managed job runner with a full audit trail:

• HealthSnapshotJob — captures system state every 5 minutes
• MetricsHourlyAggregator — hourly rollup at :05 past every hour
• MetricsDailyAggregator — daily rollup at 03:00 UTC
• RetentionCleanupJob — async cleanup of expired events
• ExpiredBlocksCleanup — clears expired login blocks

A transient-based mutex prevents duplicate concurrent execution. Stale locks clear automatically.

📈 Security Operations Console (Dashboard)

A premium SOC dashboard in React (via @wordpress/element). Not a "WordPress admin page" — a Linear / Vercel / Datadog visual identity.

Security Score (0-100)

A composite metric — a product differentiator. It is calculated server-side from 5 signals:

• Active critical blocks (capped at -30)
• Failed logins last 24h (capped at -20)
• Active firewall blocks (capped at -15)
• Degraded health components (capped at -20)
• Inactive required modules (capped at -15)

Colour coding: 80-100 green (healthy), 50-79 amber (attention), 0-49 red (critical). A trend pill shows the delta against the previous measurement.

Three-Tier Layout

Top: 5 Security Posture Cards — Threat Level, Active Blocks, Failed Logins, System Health, Module Status. Sparklines + click-through.

Middle: 4 Charts — Hourly Threats (line), Auth Failures (line), Severity Distribution (donut), Category Breakdown (bar). Built from aggregated metrics, never raw events.

Bottom: 3 Operational Streams — Recent Activity (last 20 events), Login Attempts (last 50 with risk score), Blocked Requests (last 50 from firewall logs). Tabbed, paginated.

Smart Polling

Auto-pauses when the tab is hidden (Page Visibility API). Per-resource intervals — health 30s, metrics 60s, activity 15s. Manual refresh always available.

Performance Budget

• Initial render < 100ms after data is loaded
• < 10 API calls per dashboard view
• < 50KB JS bundle (gzipped)

📧 Notifications — Smart Alert Delivery

Not "an email for every error". A configurable notification layer with rate limiting and cooldown.

• Configurable Recipient — email address for alert delivery
• Severity Threshold — the minimum severity that triggers a notification (default: high)
• Category Filtering — firewall / auth / health / system / license
• Frequency Modes — realtime / daily / weekly digest
• Cooldown (default 15min) — identical events are suppressed, so you do not receive 100 identical emails during a continuous attack
• Queue + Delivery Jobs — async delivery that does not block the request flow

⚙️ 23 Configurable Settings

Every threshold, retention period and behaviour can be adjusted in the Settings UI:

• Firewall — enable / block duration / XML-RPC allow / log allowed requests
• Login — 4 thresholds (delay/warn/temp/long) + 2 durations + IP whitelist
• Activity — enable + 7 retention periods by severity
• Notifications — enable / threshold / recipient / frequency / categories / cooldown

🏗️ Architecture

• 22 database tables with proper compound indexes for all query patterns
• 33 REST endpoints under the namespace /cssp/v1
• Locked response envelope — semver discipline, no breaking changes in v1.x
• Modular DI container with an event bus between modules
• WP_Error responses with HTTP 400/401/403/404/422/500
• PHP 8.4 compatible

🎯 Who is it for?

• Professional WordPress administrators — who want SaaS-grade tools, not a free-plugin look
• Agencies that maintain many sites — Agency Unlimited plan + cross-site visibility
• Production e-commerce sites — where downtime costs money
• Membership and SaaS sites — where auth security is critical
• B2B sites — where a compliance audit trail is a requirement
• Businesses that have already experienced a lockout — Trusted Admin Protection is insurance against the most painful scenario

💡 Why CodeSeven Security Pro instead of Wordfence?

• Premium SaaS UI instead of overcrowded admin pages
• Calm operational tone — no panic-inducing red
• Modular architecture — disable the modules you do not need
• Trusted Admin Protection — Wordfence has no equivalent
• Async event pipeline — does not slow your site down, even under high traffic
• BG / EN / DE native support
• By-domain pricing — fair and predictable

🔒 Protection continues even after your licence expires

A unique guarantee: protection continues even if license lapses. Only updates and support require an active licence. Your site is never left unprotected because of a missed renewal date.

⚙️ Technical requirements

• WordPress 5.8 or later
• PHP 7.4 or later (tested up to PHP 8.4)
• MySQL 5.7+ or MariaDB 10.3+
• Current version: 1.0.4