SQL injection protection
Catches requests trying to mess with your database. UNION SELECT, DROP TABLE, that kind of thing.
Free feature
Smart firewallin front of WordPress
Blocks bad requests before they hit WordPress. SQL injection attempts, XSS, bots probing for holes - stopped at the door.
What it does
Smart firewall
Looks at every incoming request. If it contains SQL injection patterns, XSS payloads, path traversal or command-injection signatures, it gets blocked. Rate limits, country block and a honeypot when you need them. Normal visitors do not notice.
XSS prevention
Blocks attempts to inject JavaScript. Script tags, event handlers, the usual tricks.
Path traversal
Stops requests trying to read files outside the web directory. The ../../../etc/passwd stuff.
Rate limits and country block
Slow down floods. Block countries you never serve, if you want.
Why it is there
What happens without it
Check your server logs sometime. Hundreds of requests trying SQL injection, path traversal, known exploits. Bots run 24/7. Without filtering, all of that hits WordPress directly.
Database dump
A successful SQL injection can dump user data, passwords, everything.
XSS on your pages
Attackers run JavaScript. Steal cookies, redirect users, deface the site.
Config files
Path traversal can read files they should not. Credentials included.
The day a CVE drops
New hole goes public, bots scan within hours. They find you before you patch.
The firewall sits between the internet and WordPress. Malicious requests get blocked. Pages, forms and checkouts still work. Not a replacement for updates. It runs on the free plugin. The firewall log tab in the dashboard shows the blocked requests.
Free. The blocking runs for every install.
Use Bearmor Security on your WordPress
Install the free plugin from WordPress.org. Every feature is free, with no paid plan to unlock.