Title: Owl Security Author: Owlgorithm Labs Published: 30.7.2026 Last modified: 9.9.2026 --- Hae lisäosia ![](https://ps.w.org/owl-security/assets/banner-772x250.png?rev=3688963) ![](https://ps.w.org/owl-security/assets/icon-256x256.png?rev=3688963) # Owl Security [Owlgorithm Labs](https://profiles.wordpress.org/owlgorithmlabs/) [Lataa](https://downloads.wordpress.org/plugin/owl-security.1.12.1.zip) * [Tiedot](https://fi.wordpress.org/plugins/owl-security/#description) * [Arvostelut](https://fi.wordpress.org/plugins/owl-security/#reviews) * [Asennus](https://fi.wordpress.org/plugins/owl-security/#installation) * [Kehitys](https://fi.wordpress.org/plugins/owl-security/#developers) [Tuki](https://wordpress.org/support/plugin/owl-security/) ## Kuvaus **Protect your WordPress site around the clock.** Owl Security blocks malicious traffic, scans for malware, hardens common weak points, and secures your login — all from one fast, clearly designed dashboard that doesn’t slow your site down. Owl Security brings practical WordPress protection and recovery tools into one responsive administration screen. The Free build works without a license, does not perform remote entitlement checks, and keeps its security features available locally. Free capabilities include: * Live risk score and security status overview. * Brute-force protection, login rate limiting, login alerts, built-in math CAPTCHA and honeypot protection. * Optional Google reCAPTCHA v2/v3 or Cloudflare Turnstile when an administrator selects and configures one of those providers. * RFC 6238 TOTP two-factor authentication and recovery controls. * Malware signature scanning and administrator-requested WordPress core checksum verification. * Reversible quarantine with path and symlink safety checks. * Firewall rules for high-confidence SQL injection, cross-site scripting, command execution, traversal, abusive bots, endpoint abuse, and request rate limiting. * Comment and registration anti-spam controls. * Activity logging for security-relevant WordPress events without storing passwords or submitted form bodies. * File-integrity baselines, file-permission checks, upload MIME validation, and upload-directory execution protection. * Manual protected backups, downloads, restore checks, and recovery tools available in the Free build. * Reversible hardening for the file editor, XML-RPC, directory browsing, version output, author enumeration, and anonymous REST access. * Manual reports, CSV/PDF exports, and a bounded debug-log viewer. * Multisite-aware activation, deactivation, and uninstall behavior. Owl Security does not silently enable commercial vulnerability, CAPTCHA, password- breach, GeoIP, reputation, AI, or uptime services. Optional providers remain inactive until the administrator chooses the related feature and supplies any required credentials. Scheduled scans, deep scan, virtual patching, trusted devices, behavioral anomaly detection, advanced file security, scheduled backups, WPScan vulnerability intelligence, Safe Update Guard, scheduled summaries, and country/IP/geo blocking are available only in the separate Pro build. ### External services and privacy Owl Security can contact the services listed below. Optional services remain disabled until an administrator enables the related feature and, where required, enters credentials. #### WordPress.org Core Checksums API What it is: The official WordPress.org service that returns file checksums for a specific WordPress release. When data is sent: Only when an administrator runs a malware scan with WordPress core verification enabled. Data sent: The installed WordPress version and locale are sent in the request URL. The request User-Agent also contains the Owl Security version and the site’s home URL. No site content, users, passwords, form submissions, or database records are sent. Service information: https://wordpress.org/about/ Privacy: https://wordpress.org/ about/privacy/ #### WPScan Vulnerability Database API What it is: An optional vulnerability-information service operated by Automattic. When data is sent: This service is used only by the separate Pro build. The WordPress. org Free build does not contact WPScan. In Pro, data is sent only after an administrator enables vulnerability intelligence, enters a WPScan API token, and runs or loads a vulnerability scan. Data sent: The WPScan API token is sent in the Authorization header, and the plugin or theme slug is sent in the request URL. The request User-Agent contains the Owl Security version and the site’s home URL. Installed component versions are compared locally against the returned records. Site content, users, passwords, and form submissions are not sent. Terms: https://wpscan.com/terms/ Privacy: https://automattic.com/privacy/ #### Have I Been Pwned Pwned Passwords API What it is: An optional compromised-password lookup service. When data is sent: Only when compromised-password checking is enabled and WordPress validates a password during a supported password or login flow. Data sent: Only the first five characters of an uppercase SHA-1 hash are sent through the k-anonymity range API. The raw password and the complete hash never leave the site. The request User-Agent contains only the Owl Security version. API information: https://haveibeenpwned.com/API/v3#PwnedPasswords Terms: https:// haveibeenpwned.com/TermsOfUse Privacy: https://haveibeenpwned.com/Privacy #### Google reCAPTCHA What it is: An optional third-party CAPTCHA provider. When data is sent: Only when an administrator selects reCAPTCHA v2 or v3, saves valid provider credentials, and a protected form is submitted. Data sent: The configured secret key, the provider response token, and the visitor IP address are sent server-side to Google’s siteverify endpoint. Google’s browser script may also receive browser, device, network, and interaction data under Google’s policies. Built-in Math and Honeypot modes do not contact Google. Terms: https://policies.google.com/terms Privacy: https://policies.google.com/privacy #### Cloudflare Turnstile What it is: An optional third-party CAPTCHA provider. When data is sent: Only when an administrator selects Turnstile, saves valid provider credentials, and a protected form is submitted. Data sent: The configured secret key, the provider response token, and the visitor IP address are sent server-side to Cloudflare’s siteverify endpoint. Cloudflare’s browser script may also receive browser, device, network, and interaction data under Cloudflare’s policies. Built-in Math and Honeypot modes do not contact Cloudflare. Terms: https://www.cloudflare.com/website-terms/ Privacy: https://www.cloudflare. com/privacypolicy/ Email reports and login notices use the WordPress site’s configured wp_mail() transport. Owl Security does not operate that mail service. Administrators can disable IP logging or enable IP anonymization. Request query values and submitted form bodies are not stored in the request log. ## Kuvankaappaukset [⌊Security dashboard — live security score, plain-language verdict, and recent activity at a glance.⌉⌊Security dashboard — live security score, plain-language verdict, and recent activity at a glance.⌉[ Security dashboard — live security score, plain-language verdict, and recent activity at a glance. [⌊Malware scanner — detected items with one-click quarantine, restore, or dismiss, and reversible actions.⌉⌊Malware scanner — detected items with one-click quarantine, restore, or dismiss, and reversible actions.⌉[ Malware scanner — detected items with one-click quarantine, restore, or dismiss, and reversible actions. [⌊Web firewall — blocked-request activity and rule controls.⌉⌊Web firewall — blocked- request activity and rule controls.⌉[ Web firewall — blocked-request activity and rule controls. [⌊One-click hardening — vulnerability scan and reversible hardening checklist.⌉⌊ One-click hardening — vulnerability scan and reversible hardening checklist.⌉[ One-click hardening — vulnerability scan and reversible hardening checklist. [⌊Login protection — two-factor authentication setup, CAPTCHA options, and brute- force defense.⌉⌊Login protection — two-factor authentication setup, CAPTCHA options, and brute-force defense.⌉[ Login protection — two-factor authentication setup, CAPTCHA options, and brute-force defense. ## Asennus 1. Upload the `owl-security` folder to `/wp-content/plugins/`, or upload the ZIP through Plugins > Add New > Upload Plugin. 2. Activate Owl Security. 3. Open Owl Security from the WordPress administration menu. 4. Review Login Protection, Firewall, File & Upload, Backup, and Hardening settings before enabling restrictive controls. 5. Create and download a known-good backup before performing restore or filesystem- hardening operations. No npm, Composer, or other build step is required after upload. ## UKK ### Does the Free build require a license? No. The Free build has no license field and does not contact a licensing service. ### Does Owl Security send data automatically? It does not silently enable optional third-party services. Official WordPress core checksums are requested only as part of an administrator-requested scan. Pwned Passwords, reCAPTCHA, and Turnstile require an administrator to enable or configure the related Free feature. WPScan vulnerability intelligence is available only in the separate Pro build. ### Can I keep CAPTCHA completely local? Yes. Use the built-in math CAPTCHA and honeypot instead of a third-party CAPTCHA provider. ### What does the Pwned Passwords check send? Only the first five characters of a SHA-1 password hash. The original password and complete hash stay on the WordPress site. ### Can quarantine permanently delete a file? Quarantine is reversible. Eligible files are moved into a protected directory and their original paths are recorded. WordPress core files and Owl Security’s own active files are protected from automatic quarantine. ### What backup file is created without ZipArchive? Owl Security creates a protected `.sql.gz` database-only backup and deletes the temporary raw SQL export. If neither ZipArchive nor zlib is available, backup creation fails clearly instead of retaining a standalone SQL file. ### Is restore risk-free? No restore tool is risk-free. Keep an off-site backup and test major restore operations on staging first. ### Is Owl Security free? Yes. The Free build is fully functional on its own — web firewall, malware scanner, login protection, two-factor authentication, manual backup and restore, hardening, activity logging, and reports all work without a license and without remote entitlement checks. A separate Pro build adds automation and scheduled or real-time protection. ### Does Owl Security slow down my site? It’s built to stay light. Scans run on demand or in the background rather than blocking page loads, and deep request inspection is optional. The dashboard is designed to be fast and unobtrusive. ### Do I need coding knowledge to use it? No. Every feature is controlled from a single WordPress admin screen with plain- language explanations. Hardening changes are reversible, so you can safely try them and undo any that don’t suit your site. ### Does Owl Security include two-factor authentication (2FA)? Yes. Free includes RFC 6238 TOTP two-factor authentication (compatible with apps like Google Authenticator and Authy) plus recovery controls, alongside brute-force protection, login rate limiting, and CAPTCHA options. ### Will it work on multisite? Yes. Activation, deactivation, and uninstall behavior are multisite-aware. ### What does the Pro version add? Pro adds automation and scale: scheduled and deep scanning, WPScan vulnerability intelligence with automatic patching, virtual patching, trusted devices, behavioral anomaly detection, scheduled backups, Safe Update Guard, scheduled report summaries, and country/IP/geo blocking. The Free build never contains locked Pro code. ## Arvostelut There are no reviews for this plugin. ## Avustajat & Kehittäjät “Owl Security” perustuu avoimeen lähdekoodiin. Seuraavat henkilöt ovat osallistuneet tämän lisäosan kehittämiseen. Avustajat * [ Owlgorithm Labs ](https://profiles.wordpress.org/owlgorithmlabs/) [Käännä “Owl Security” omalle kielellesi.](https://translate.wordpress.org/projects/wp-plugins/owl-security) ### Oletko kiinnostunut kehitystyöstä? [Browse the code](https://plugins.trac.wordpress.org/browser/owl-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/owl-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/owl-security/) by [RSS](https://plugins.trac.wordpress.org/log/owl-security/?limit=100&mode=stop_on_copy&format=rss). ## Muutosloki #### 1.12.1 * Updated compatibility for WordPress 7.1. * Documentation and readme improvements. No functional changes. #### 1.12.0 * Physically excluded trusted-device token and Pro login-risk execution modules from the WordPress.org package; Free two-factor authentication always requires its normal second factor. * Added a package audit that rejects direct Pro execution gates or upgrade-error paths in Free-shipped PHP. * Added protected `.sql.gz` database-only backup fallback and automatic deletion of the temporary raw SQL export. * Made backup archive and restore paths support renamed or relocated WordPress content directories through manifest metadata. * Reverified external-service disclosures, path handling, identifier prefixing, PHP syntax, JavaScript syntax, and the Free/Pro packaging boundary. #### 1.10.1 * Added a strict Free/Pro build boundary while preserving the shared plugin slug, options, tables, and data. * Made the Free administration interface independent from license activation. * Added a WordPress.org-focused external-services disclosure and GPL-2.0 license file. * Isolated Pro-only integrity and uninstall licensing code from the Free package boundary. * Switched Free third-party server requests to `wp_safe_remote_get()` or `wp_safe_remote_post()` with explicit timeouts. ## Metatiedot * Version **1.12.1** * Last updated **2 viikkoa sitten** * Active installations **20+** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.1** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/owl-security/) * Tags * [firewall](https://fi.wordpress.org/plugins/tags/firewall/)[login security](https://fi.wordpress.org/plugins/tags/login-security/) [malware](https://fi.wordpress.org/plugins/tags/malware/)[security](https://fi.wordpress.org/plugins/tags/security/) [two factor authentication](https://fi.wordpress.org/plugins/tags/two-factor-authentication/) * [Edistynyt näkymä](https://fi.wordpress.org/plugins/owl-security/advanced/) ## Arvosanat No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/owl-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/owl-security/reviews/) ## Avustajat * [ Owlgorithm Labs ](https://profiles.wordpress.org/owlgorithmlabs/) ## Tuki Onko sinulla jotain sanottavaa? Tarvitsetko apua? [Tukifoorumi](https://wordpress.org/support/plugin/owl-security/)