Title: Locktura Security Author: Alain Lankers Published: 31 de juliol de 2026 Last modified: 21 de setembre de 2026 --- Cerca extensions ![](https://ps.w.org/locktura/assets/banner-772x250.png?rev=3629932) ![](https://ps.w.org/locktura/assets/icon.svg?rev=3629932) # Locktura Security Per [Alain Lankers](https://profiles.wordpress.org/alainlankers/) [Baixa](https://downloads.wordpress.org/plugin/locktura.2.6.2.zip) * [Detalls](https://ca.wordpress.org/plugins/locktura/#description) * [Ressenyes](https://ca.wordpress.org/plugins/locktura/#reviews) * [Instal·lació](https://ca.wordpress.org/plugins/locktura/#installation) * [Desenvolupament](https://ca.wordpress.org/plugins/locktura/#developers) [Suport](https://wordpress.org/support/plugin/locktura/) ## Descripció Locktura Security brings modular WordPress protection, monitoring, maintenance, and alerts into one dashboard. Most protection runs locally; enable only what your site needs. #### Included modules * **Firewall** – Attack filtering and cache-aware protection. * **Brute Force Defense** – Login limits, bans, and unban controls. * **Hardening** – User enumeration, editor, XML-RPC, feed, hotlink, and server- exposure controls. * **Update Manager** – Updates, Software Health, rollback, and cleanup. * **Access Control** – IP lists, exclusions, and automatic bans. * **Geo Blocking** – Country rules and crawler verification. * **Hide Login** – Custom login URL and route protection. * **Anti-Spam Shield** – Local CAPTCHA and form or comment protection. * **Usernames & 2FA** – Username audits, TOTP, passkeys, recovery codes, role rules, and least-privilege Locktura permissions. * **Password Manager** – Policies, resets, risk scans, and breach checks. * **Email Alerts** – Configurable security notifications. * **Security Logs** – Tamper-evident local events, integrity checks, and export. * **Live Traffic** – Requests, visitors, bots, filters, and geolocation. * **User Log** – Tamper-evident account, content, and settings activity. * **File Scanner** – File and configuration checks, official checksum verification, incremental integrity scans, deployment windows, quarantine, and restore. * **File Permissions** – Permission checks, fixes, and history. * **SSL Control** – HTTPS, certificate, proxy, backup, and rollback. * **Email Encoder** – Email inventory and obfuscation. #### Separate Premium plugin Locktura Premium is separately distributed outside WordPress.org and is not included in this package. Every Free feature above works without a license. The separate Premium plugin adds: * **Pattern Recognition** * **Behavior Analytics** * **Admin Lockdown** * **Virtual Patching** * **Header Hardening** * **API Guardian** * **Neural Bot Suppressor** * **Network Reputation Control** * **Domain Security** * **Cookie Security Center** * **Malware Scanner & Cleanup** * **Smart 404** * **Extra Hardening Tools** * **Monthly Reports** * **Session Management** * **Extra User Safety Tools** * **Premium Signature Pack** [Buy Locktura Premium](https://locktura.com/download-locktura-premium/) ### Privacy Locktura stores security data locally, including IP addresses, request and login details, usernames, events, alert settings, password-policy and 2FA settings, encrypted TOTP secrets, public passkey credential data, hashed recovery codes, enrollment state, scan history, and update history. Passkey private keys remain on the user’s authenticator and are never stored by Locktura. Optional geolocation and password- breach checks use the services below. Administrators control retention, recipients, lookups, and privacy settings. Unique traffic estimates count each IP address once per calendar day, excluding recognized bots and blocked requests. This local counter stores a keyed hash of the IP address and date, without the raw IP address or a browser cookie. Identifiers change each day and follow the traffic aggregate retention period (up to 90 days). Shared IP addresses count together, and visits served without running WordPress may not be recorded. Daily unique counts are not a deduplicated total across multiple days. ### External services Locktura loads no scripts, styles, fonts, or images from third parties. It makes only the requests documented below when the related feature is enabled or used. #### WordPress.org and extension update providers Used for core, plugin, and theme update checks and downloads through WordPress.org and update endpoints declared by installed extensions. Requests occur during administrator- requested or scheduled checks and can contain the site URL, software versions, locale, and extension metadata. A manual Software Health scan and enabled Trusted Integrity Scanner also request official WordPress.org core and plugin checksums; the Software Health scan can additionally request plugin last-update metadata. These checksum requests contain the installed version, locale, and plugin slug. Scan results, local baselines, integrity findings, and update history are stored locally. Local file contents are never sent to WordPress.org by the integrity scanner. Documentation: https://developer.wordpress.org/apis/handbook/wordpress-org/update- api/ and https://developer.wordpress.org/cli/commands/plugin/verify-checksums/ Policies: https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin- guidelines/ and https://wordpress.org/about/license/ Privacy: https://wordpress. org/about/privacy/ #### Have I Been Pwned Pwned Passwords Used for optional breach checks through `https://api.pwnedpasswords.com/range/{first5- sha1}`. Only the first five characters of the password’s SHA-1 hash are sent, never the password or complete hash. Results can be cached locally, and stored status is discarded when the credential changes. Documentation: https://haveibeenpwned.com/API/v3#PwnedPasswords Terms: https:// haveibeenpwned.com/TermsOfUse Privacy: https://haveibeenpwned.com/Privacy #### Geolocation providers When enabled geolocation needs uncached data and no trusted country header exists, Locktura sends the public IP being looked up. Results can be cached locally for 24 hours. Providers are tried in this order: * Country (`https://api.country.is/{ip}`) – Primary provider. Service information and privacy: https://country.is/ | Source and self-hosting: https://github.com/ lineofflight/country * IPWhois (`https://ipwho.is/{ip}`) – First fallback. Documentation: https://ipwhois. io/documentation | Terms: https://ipwhois.io/terms | Privacy: https://ipwhois. io/privacy * ipapi.co (`https://ipapi.co/{ip}/json/`) – Final fallback. Documentation: https:// ipapi.co/api/ | Terms: https://ipapi.co/terms/ | Privacy: https://ipapi.co/privacy/ #### Own-site HTTPS and TLS checks SSL Control checks the configured `home_url()` or `site_url()`. An administrator- requested HEAD request or TLS handshake sends ordinary network metadata and a Locktura user-agent to the site’s own host. System Health also sends five small daily GET requests to the configured `home_url()`: one random missing path, three fixed sensitive paths, and the homepage. These requests check public exposure and unexpected external redirects. Response bodies and possible secrets are never stored; only status information is retained. No third-party endpoint is selected by Locktura. #### Site-configured email delivery Enabled alerts and tests can contain the recipient, site URL, event type, timestamp, IP address, relevant context, and remediation links. WordPress uses the site’s configured mail transport; Locktura selects no provider. #### Locktura website links Links to `https://locktura.com/` open only after an administrator clicks them; there are no background calls. Terms: https://locktura.com/terms-and-conditions/ Privacy: https://locktura.com/ privacy-policy/ ### Translations Dutch translations are managed through translate.wordpress.org and delivered by WordPress when an approved package is available. ### Bundled assets Runtime assets are bundled locally. Flag Icons, QRCode for JavaScript, and lbuchs/ WebAuthn use the MIT License; Inter and Bebas Neue use the SIL Open Font License 1.1. The modified Wikimedia Commons world map is public domain. Source and license details are included under `assets/` and `vendor/lbuchs/`. Locktura artwork is GPLv2 or later. ## Captures [⌊Security Overview with the protection score, security activity, blocked threats, scans, and blocked login attempts.⌉⌊Security Overview with the protection score, security activity, blocked threats, scans, and blocked login attempts.⌉[ Security Overview with the protection score, security activity, blocked threats, scans, and blocked login attempts. [⌊Recent security alerts with the most active threat categories, threat distribution, and blocked countries.⌉⌊Recent security alerts with the most active threat categories, threat distribution, and blocked countries.⌉[ Recent security alerts with the most active threat categories, threat distribution, and blocked countries. [⌊Traffic and blocked-login activity with an overview of installed Locktura security modules.⌉⌊Traffic and blocked-login activity with an overview of installed Locktura security modules.⌉[ Traffic and blocked-login activity with an overview of installed Locktura security modules. [⌊Module management overview showing active protections and the current status of each module.⌉⌊Module management overview showing active protections and the current status of each module.⌉[ Module management overview showing active protections and the current status of each module. [⌊Brute Force settings with protection controls, detection rules, security activity, and current status.⌉⌊Brute Force settings with protection controls, detection rules, security activity, and current status.⌉[ Brute Force settings with protection controls, detection rules, security activity, and current status. [⌊Hardening settings for reducing common WordPress attack surfaces and protecting sensitive files and services.⌉⌊Hardening settings for reducing common WordPress attack surfaces and protecting sensitive files and services.⌉[ Hardening settings for reducing common WordPress attack surfaces and protecting sensitive files and services. [⌊Firewall settings with request protection controls, rule configuration, and current protection status.⌉⌊Firewall settings with request protection controls, rule configuration, and current protection status.⌉[ Firewall settings with request protection controls, rule configuration, and current protection status. ## Instal·lació 1. Upload the `locktura` folder to `/wp-content/plugins/`, or install it through the WordPress Plugins screen. 2. Activate Locktura Security and open the Locktura dashboard. 3. Review the modules, enable the protections you need, and save changed settings. ## PMF ### Is the firewall included? Yes. Locktura Security includes the firewall with bundled community rules. ### Do all listed Free features work without a license? Yes. Every feature listed under Included in this plugin works without a license and has no time or usage restrictions. The separately distributed Premium plugin is not included in this package. ### Do I need a cloud account? No. Protection runs locally. Only the optional features documented under External services make network requests. ### Does Locktura Security store security logs? Yes. Security events are stored locally for administrator review. New records are linked and signed so unexpected changes or missing records can be detected. Existing records remain available as legacy logs after upgrading. ### Can IP addresses be anonymized? Yes. An IP anonymization setting is available. ### Do users need a passkey? No. Passkeys and physical security keys are optional. Existing authenticator-app 2FA keeps working without re-enrollment, and the familiar 2FA screen remains the default after password login. ### Where do users manage 2FA? Users manage their own authenticator app, passkeys, and recovery codes under Users > Profile. Administrators can require 2FA by role, set a grace period, review enrollment status, and reset 2FA without seeing user secrets. ### What does the Permissions tab control? It separates Locktura access into viewing security, managing blocks, running scans, repairing files, managing policy, and clearing logs. Administrators retain full access; other roles or individual users receive only the permissions you assign. Permission changes require a fresh 2FA verification. ## Ressenyes No hi ha ressenyes per a aquesta extensió. ## Col·laboradors i desenvolupadors «Locktura Security» és programari de codi obert. La següent gent ha col·laborat en aquesta extensió. Col·laboradors * [ Alain Lankers ](https://profiles.wordpress.org/alainlankers/) “Locktura Security” s’ha traduït a 1 configuració regional. Gràcies als [traductors](https://translate.wordpress.org/projects/wp-plugins/locktura/contributors) per les seves aportacions. [Traduïu «Locktura Security» a la vostra llengua.](https://translate.wordpress.org/projects/wp-plugins/locktura) ### Interessats en el desenvolupament? [Navegueu pel codi](https://plugins.trac.wordpress.org/browser/locktura/), baixeu- vos el [repositori SVN](https://plugins.svn.wordpress.org/locktura/), o subscriviu- vos al [registre de desenvolupament](https://plugins.trac.wordpress.org/log/locktura/) per [fisl de subscripció RSS](https://plugins.trac.wordpress.org/log/locktura/?limit=100&mode=stop_on_copy&format=rss). ## Registre de canvis #### 2.6.2 * Improved WooCommerce compatibility in the firewall. * Improved File Integrity Monitoring and File Scanner workflows. * Added daily unique visitor estimates to the dashboard. * Improved dashboard notifications, module cards, and Security Score calculations. * Refined Access Control ban-list presentation. * Fixed IP-address filtering in User Logs. * Improved Hardening server-rule updates, backups, and restore handling. #### 2.6.1 * Improved File Integrity Monitoring. * Improved Geo Blocking country-name searches, including Dutch and Caribbean names. * Improved 2FA policy saving and authenticator-enrollment messages. * Updated dashboard presentation and removed obsolete theme-status code. * Improved redaction of sensitive MainWP update parameters in security logs. #### 2.6.0 * Added Form Guard and improved step-up verification, including the Email Encoder workflow. * Improved File Integrity Monitoring. * Fixed Security Logs and User Logs behavior, and improved email templates and delivery. #### 2.5.3 * Improved signed integrity-manifest verification for distributor-processed plugin releases. #### 2.5.2 * Added File Scanner quarantine management and improved File Integrity Monitoring workflows. * Added a Live Traffic counter and improved dashboard cards, Security Score calculations, and rate limiting. * Improved Access Control translations, database-password strength checks, account- security navigation, step-up verification, and email delivery. ## Meta * Versió **2.6.2** * Darrera actualització **fa 3 dies** * Instal·lacions actives **10+** * Versió del WordPress ** 6.2 o posterior ** * Provada fins a **7.1.2** * Versió del PHP ** 8.0 o posterior ** * Idiomes * [Dutch](https://nl.wordpress.org/plugins/locktura/) i [English (US)](https://wordpress.org/plugins/locktura/). * [Traduïu a la vostra llengua](https://translate.wordpress.org/projects/wp-plugins/locktura) * Etiquetes * [Brute Force](https://ca.wordpress.org/plugins/tags/brute-force/)[firewall](https://ca.wordpress.org/plugins/tags/firewall/) [hardening](https://ca.wordpress.org/plugins/tags/hardening/)[security](https://ca.wordpress.org/plugins/tags/security/) [two factor authentication](https://ca.wordpress.org/plugins/tags/two-factor-authentication/) * [Vista avançada](https://ca.wordpress.org/plugins/locktura/advanced/) ## Valoracions Encara no s'ha enviat cap ressenya. [La vostra ressenya](https://wordpress.org/support/plugin/locktura/reviews/#new-post) [Visualitza totes les ressenyes](https://wordpress.org/support/plugin/locktura/reviews/) ## Col·laboradors * [ Alain Lankers ](https://profiles.wordpress.org/alainlankers/) ## Suport Problemes resolts durant els darrers dos mesos: 1 de 1 [Visualitza els fòrums de suport](https://wordpress.org/support/plugin/locktura/)