Qevix Shield

Security that stays out of your way

Qevix Shield hardens the parts of WordPress attackers hit first - the login form, XML-RPC, file access, and the URLs that leak information - and writes everything it blocks to a live, searchable audit log.

The free plugin is a complete security suite, not a teaser. Out of the box it gives you a hidden login URL, brute-force lockouts, two-factor authentication that even covers XML-RPC logins, reCAPTCHA (v2 and invisible v3), password rules, a request firewall, file and server hardening, core-file malware scanning and grouped email alerts. Every protection ships off until you read what it does and switch it on, one at a time, so nothing breaks on activation.

And nothing can lock you out of your own site. A one-line safe mode in wp-config.php suspends everything, reCAPTCHA keys must pass a live test before they can be enabled, a real person the bot check misjudges is emailed a one-time sign-in link, and 2FA ships downloadable recovery codes plus an admin reset.

Qevix Shield Pro adds what happens after detection: full-site malware scanning across plugins, themes, uploads and the database - with quarantine and scheduled scans - breached-password checks against Have I Been Pwned, advanced login blocking, all-user session management, granular XML-RPC control, and instant attack alerts by SMS, WhatsApp, Slack, Discord or webhook. The whole wave arrives as one digest, never fifty notifications at 3 a.m.

Licensing stays out of your way. Plans cover a single site up to your whole portfolio. The license validates locally - your visitors' page loads never wait on our servers - and if it ever lapses, your settings and data stay exactly where they were.