{"id":309751,"date":"2026-05-13T16:49:32","date_gmt":"2026-05-13T16:49:32","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/oosoft-waf-security\/"},"modified":"2026-05-13T16:49:10","modified_gmt":"2026-05-13T16:49:10","slug":"oosoft-waf-security","status":"publish","type":"plugin","link":"https:\/\/nl-be.wordpress.org\/plugins\/oosoft-waf-security\/","author":23490573,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_crdt_document":"","version":"1.0.0","stable_tag":"trunk","tested":"6.9.4","requires":"5.9","requires_php":"7.4","requires_plugins":null,"header_name":"OOSOFT WAF Security","header_author":"OOSOFT Technology","header_description":"A production-ready WordPress application-level Web Application Firewall with request filtering, upload malware protection, and security logging.","assets_banners_color":"","last_updated":"2026-05-13 16:49:10","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/oosoft.co.in","header_plugin_uri":"https:\/\/oosoft.co.in\/plugins\/waf-security\/","header_author_uri":"https:\/\/oosoft.co.in","rating":0,"author_block_rating":0,"active_installs":0,"downloads":27,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":[],"upgrade_notice":{"1.0.0":"<p>Initial release. No upgrade action required.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3531218,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3531218,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":[],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Dashboard overview showing real-time protection status and attack statistics.","2":"Settings page with firewall, upload scanner, and logging configuration.","3":"Security logs table with detailed attack information."},"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[2439,1174,1184,600,18199],"plugin_category":[54],"plugin_contributors":[261308],"plugin_business_model":[],"class_list":["post-309751","plugin","type-plugin","status-publish","hentry","plugin_tags-brute-force","plugin_tags-firewall","plugin_tags-malware","plugin_tags-security","plugin_tags-waf","plugin_category-security-and-spam-protection","plugin_contributors-oosoft","plugin_committers-oosoft"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/oosoft-waf-security\/assets\/icon-128x128.png?rev=3531218","icon_2x":"https:\/\/ps.w.org\/oosoft-waf-security\/assets\/icon-256x256.png?rev=3531218","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>OOSOFT WAF Security is a comprehensive WordPress security plugin that acts as an application-level Web Application Firewall. It protects your site in real-time by filtering malicious requests, scanning uploads for malware, and maintaining detailed security logs.<\/p>\n\n<h4>Free Features<\/h4>\n\n<p><strong>Request Firewall<\/strong><\/p>\n\n<ul>\n<li>SQL injection pattern detection and blocking<\/li>\n<li>Cross-site scripting (XSS) pattern detection and blocking<\/li>\n<li>Dangerous user-agent blocking (scanners, exploit tools)<\/li>\n<li>XML-RPC endpoint protection<\/li>\n<li>Brute-force login rate limiting<\/li>\n<\/ul>\n\n<p><strong>Upload Malware Protection<\/strong><\/p>\n\n<ul>\n<li>Block uploads with dangerous file extensions (PHP, ASP, shell scripts, etc.)<\/li>\n<li>Detect and block double-extension attacks (e.g., file.jpg.php)<\/li>\n<li>Basic malware signature scanning of file contents<\/li>\n<li>Admin email notification on blocked uploads<\/li>\n<li>Full audit trail for upload attempts<\/li>\n<\/ul>\n\n<p><strong>Security Logging<\/strong><\/p>\n\n<ul>\n<li>Detailed log of every blocked attack<\/li>\n<li>Detailed log of every blocked upload attempt<\/li>\n<li>IP address, user agent, request URI, and attack payload recorded<\/li>\n<li>Configurable log retention period<\/li>\n<li>Dashboard view of recent security events<\/li>\n<\/ul>\n\n<h4>Pro Features (Coming Soon)<\/h4>\n\n<ul>\n<li>Imunify360 integration for advanced scanning<\/li>\n<li>Auto-detect scanning engine (built-in, Imunify360, or automatic)<\/li>\n<li>Quarantine suspicious uploads<\/li>\n<li>Temporary automatic IP bans<\/li>\n<li>Custom malware signature rules<\/li>\n<\/ul>\n\n<h4>About OOSOFT Technology<\/h4>\n\n<p>OOSOFT Technology specialises in WordPress security solutions. Visit <a href=\"https:\/\/oosoft.co.in\">https:\/\/oosoft.co.in<\/a> to learn more.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>oosoft-waf-security<\/code> folder to the <code>\/wp-content\/plugins\/<\/code> directory.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Navigate to <strong>WAF Security<\/strong> in the WordPress admin menu to configure your settings.<\/li>\n<li>Review the dashboard to confirm all protection modules are active.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20this%20plugin%20slow%20down%20my%20site%3F\"><h3>Will this plugin slow down my site?<\/h3><\/dt>\n<dd><p>No. The WAF runs lightweight pattern matching on incoming requests. The performance overhead is negligible on any modern server.<\/p><\/dd>\n<dt id=\"will%20xml-rpc%20protection%20break%20the%20wordpress%20mobile%20app%3F\"><h3>Will XML-RPC protection break the WordPress mobile app?<\/h3><\/dt>\n<dd><p>Yes. If you use the official WordPress mobile app or services that rely on XML-RPC (such as Jetpack), leave XML-RPC protection disabled. Only enable it if you do not use any XML-RPC-dependent services.<\/p><\/dd>\n<dt id=\"can%20i%20whitelist%20my%20own%20ip%20address%3F\"><h3>Can I whitelist my own IP address?<\/h3><\/dt>\n<dd><p>IP whitelisting is planned for a future release. Currently, all requests are subject to the same firewall rules.<\/p><\/dd>\n<dt id=\"what%20file%20extensions%20are%20blocked%20by%20the%20upload%20scanner%3F\"><h3>What file extensions are blocked by the upload scanner?<\/h3><\/dt>\n<dd><p>The scanner blocks server-executable extensions including PHP variants (php, php3, php4, php5, php7, php8, phtml, pht, phar), ASP variants, shell scripts (sh, bash, csh), CGI scripts (cgi, pl, py, rb), and compiled executables (exe, dll, bat, cmd). Standard image, document, and media files are unaffected.<\/p><\/dd>\n<dt id=\"how%20do%20i%20report%20a%20security%20vulnerability%20in%20this%20plugin%3F\"><h3>How do I report a security vulnerability in this plugin?<\/h3><\/dt>\n<dd><p>Please report security issues responsibly by emailing the author via https:\/\/oosoft.co.in. Do not open a public issue.<\/p><\/dd>\n<dt id=\"is%20this%20plugin%20compatible%20with%20multisite%3F\"><h3>Is this plugin compatible with multisite?<\/h3><\/dt>\n<dd><p>Single-site operation is fully supported. Multisite compatibility is planned for a future release.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<li>Request firewall with SQL injection, XSS, and bad user-agent blocking.<\/li>\n<li>XML-RPC protection toggle.<\/li>\n<li>Brute-force login rate limiting.<\/li>\n<li>Upload malware scanner with extension and signature checks.<\/li>\n<li>Security logging with configurable retention.<\/li>\n<li>Admin dashboard with attack statistics.<\/li>\n<li>Pro feature architecture (gated, not yet activated).<\/li>\n<\/ul>","raw_excerpt":"A production-ready WordPress application-level Web Application Firewall (WAF) with request filtering, upload malware protection, and security logging.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/309751","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=309751"}],"author":[{"embeddable":true,"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/oosoft"}],"wp:attachment":[{"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=309751"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=309751"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=309751"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=309751"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=309751"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/nl-be.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=309751"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}