Bearmor Security Docs

Getting Started

Installation

Install via WordPress admin:

1. Go to Plugins → Add New
2. Search for "Bearmor Security"
3. Click "Install Now" and then "Activate"
4. Enter your license key in Bearmor → Settings → License
5. Baseline scan runs automatically after 2 minutes

System Requirements

• WordPress 5.8+
• PHP 7.4+
• MySQL 5.6+
• Write permissions for quarantine directory

Quick Setup

Go to Bearmor → Security Hardening and click "Apply Recommended" to enable:

• Security headers (X-Frame, Content-Type, XSS)
• WordPress version hiding
• User enumeration blocking
• Generic login errors
• SSL enforcement
• Disable file editing

Malware Scanner

Scans WordPress core, plugins, and themes for malicious code using 60+ malware patterns.

What It Detects

• PHP backdoors (eval, base64_decode, shell_exec)
• Known malware signatures
• Code obfuscation techniques
• Suspicious file uploads
• Hidden iframes and redirects

Running a Scan

Manual: Navigate to Bearmor → Malware Scanner → Click "Run Malware Scan"

Automatic: Runs daily at 3:00 AM

Managing Threats

• Quarantine: Moves file to secure directory
• Mark False Positive: Whitelists legitimate code
• View Details: See matched code and line number
• Delete: Permanently remove threat

File Integrity Monitor

Tracks every file change using SHA-256 checksums. Detects modified, new, and deleted files.

How It Works

1. Baseline scan creates checksums of all files
2. Daily integrity check compares current state to baseline
3. Changes logged with timestamps
4. Automatic baseline updates after plugin/theme updates

Rebuilding Baseline

Go to Bearmor → File Changes → Click "Run Baseline Scan"

File Change Actions

• Mark Safe: Accept change and update baseline
• Quarantine: Move file to secure location
• Preview: View file contents
• Lock: Make file read-only

Login Protection

Brute-force protection with progressive IP blocking and anomaly detection.

Rate Limiting

Anomaly Detection

Automatically flags unusual login patterns:

• New country (20-40 points)
• New IP address (15 points)
• Unusual hours (10-25 points)
• Unknown user agent (5 points)

High scores (50+) flagged in Login Anomalies

Login Tracking

View in Bearmor → Login Activity:

• IP address and country (via ip-api.com)
• Username attempted
• Success/failure status
• Timestamp and user agent

Two-Factor Authentication

Email-based 2FA with device memory (30 days).

How It Works

1. User enters username and password
2. 6-digit code sent to email
3. Code expires in 10 minutes
4. Enter code on login screen
5. Optionally remember device for 30 days

Enabling 2FA

For your account: Go to Users → Your Profile → Enable 2FA checkbox

Enforce for all admins: Bearmor → Settings → Enable "Require 2FA for Administrators"

Lockout Recovery

If you're locked out of 2FA:

• Database access: Delete from wp_usermeta where meta_key='bearmor_2fa_enabled' for your user
• File access: Add to wp-config.php: define('BEARMOR_DISABLE_2FA', true);
• After regaining access, you can re-enable 2FA in your profile

Activity Log

Complete audit trail of user actions and system events.

Tracked Events

View in Bearmor → Activity Log with filters for date, user, and action type.

Security Hardening

One-click security improvements applied in 5 seconds.

Available Options

Security Headers

• X-Frame-Options (SAMEORIGIN)
• X-Content-Type-Options (nosniff)
• Referrer-Policy
• Permissions-Policy
• X-XSS-Protection

WordPress Hardening

• Hide WP version
• Block user enumeration (?author=1)
• Generic login errors
• Disable XML-RPC
• Force SSL
• Disable file editing

Go to Bearmor → Security Hardening → Click "Apply Recommended"

Deep Malware Scan

Database and uploads directory scanning for hidden threats.

Database Scanning

Scans all database tables for:

• Malicious JavaScript in posts/pages
• PHP backdoors in post metadata
• Injected code in options table
• Unauthorized admin accounts
• Suspicious iframes and redirects

Uploads Scanning

Checks /wp-content/uploads/ for:

• PHP files (shouldn't exist in uploads)
• Executable scripts disguised as images
• Hidden malware in file uploads

Run from Bearmor → Deep Scan (manual only, no automatic scheduling)

Smart Firewall

Real-time request filtering blocks attacks before they reach WordPress.

Protection Rules

Configuration

Configure in Bearmor → Settings → Firewall:

• Rate Limiting: Control login attempt thresholds
• Country Blocking: Block specific countries
• Honeypot: Deploy fake admin login traps

24/7 Uptime Monitoring

External monitoring pings your site every 15 minutes from multiple EU servers.

How It Works

• Pings your site every 15 minutes
• Multiple monitoring servers across Europe
• Measures response time and HTTP status
• Detects downtime within 15 minutes
• Data syncs automatically to WordPress

Dashboard Widget Shows

• 7-day uptime percentage
• Average response time
• Current status
• Last check timestamp
• Downtime events with duration

Downtime Alerts

When downtime detected:

1. Confirms with 2 additional checks
2. Email sent to admin
3. Event logged with start time
4. Recovery email when site returns

Vulnerability Scanner

Daily checks using WPVulnerability API for known security issues in your WordPress installation.

What It Checks

• WordPress Core vulnerabilities
• Plugin CVEs and security advisories
• Theme security issues

Automatic scan: Daily at 2:00 AM

Severity Levels

Actions Available

• Direct link to update
• Auto-disable vulnerable plugins (optional)
• Whitelist accepted risks
• Email alerts for new vulnerabilities

View in Bearmor → Vulnerabilities

AI Security Analysis

OpenAI-powered analysis providing plain English summaries and actionable insights.

What Gets Analyzed

Reviews last 7 days of:

• Malware detections
• File changes
• Login attempts and anomalies
• Firewall blocks
• Vulnerabilities
• Activity log events
• Security hardening status

AI Summary Includes

• Overall security posture
• Critical issues flagged
• Prioritized recommendations
• Trend analysis
• Security score (used in total score calculation if PRO enabled)
• Color-coded risk level (Green/Yellow/Red/Gray)

Risk Levels

Runs once daily at random time. View in Dashboard → AI Analysis Widget

Settings & Configuration

Firewall Settings (PRO)

Located in Bearmor → Settings → Firewall:

• Rate Limiting: Configure login attempt thresholds and lockout durations
• Country Blocking: Block login attempts from specific countries
• Honeypot: Enable fake admin login pages to trap bots

Scanning Settings

Located in Bearmor → Settings → Scanning:

• Rebuild Baseline: Recreate file integrity baseline after updates
• Auto-Quarantine Malware: Automatically move detected threats to quarantine (disabled by default)
• Scan Schedule: Configure file integrity monitoring frequency

Two-Factor Authentication

Located in Bearmor → Settings → 2FA:

• Enable 2FA: Require two-factor authentication for all administrator accounts
• Individual users can also enable/disable 2FA in their profile settings

Scan Exclusions

Exclude files/directories from scans in Settings → Exclusions

Already excluded by default:

• /wp-content/uploads/
• /wp-content/cache/
• /node_modules/
• .min.js files

License Management (PRO)

In Settings → License:

• Enter your PRO license key
• View activation status and expiry date
• Site registration happens automatically

Troubleshooting

Baseline Not Running

Solutions:

1. Check WP Cron: Tools → Site Health
2. Manual trigger: Bearmor → File Changes → Run Baseline
3. Check error logs for PHP errors
4. Verify write permissions

Firewall Blocking Legitimate Requests

Solutions:

1. Check firewall logs in Dashboard widget
2. Add URI to whitelist: Settings → Firewall
3. Or whitelist your IP address
4. Temporarily disable firewall if needed

Uptime Data Not Syncing (PRO)

Solutions:

1. Verify PRO license is active
2. Check WP Cron is working
3. Wait 1 hour for initial sync
4. Check error logs for API issues

High False Positives

Solutions:

1. Verify file is safe (check plugin reputation)
2. Mark as "False Positive" to whitelist
3. Report persistent issues to support

Performance Issues

Solutions:

1. Clear old activity logs: Settings → Data Management
2. Temporarily disable daily scans
3. Check server resources (CPU, memory)
4. Optimize database tables

Need More Help?

Contact Bearmor support:

• Email: support@bearmor.eu
• Include WordPress version, PHP version, and error logs
• PRO users get priority support