See thethreatsbeforethey hit.
Warren is a WordPress security plugin that catches the reconnaissance scan before the hack — real-time threat detection, device fingerprinting, and detailed event logging, all inside your own site.
Real-time
Detection
Identify suspicious activity as it happens.
AI-powered
Analysis
Find hidden threats and abnormal behavior.
Unique
Fingerprinting
Recognize attackers across sessions.
Detailed
Event Logs
Full visibility into what's happening.
Actionable
Insights
Clear recommendations to keep you safe.
HOW IT WORKS
Catches the scan.
Stops the attacker.
Bot scans your site
Before any exploit, a bot probes for weaknesses — /wp-login, /.env, hidden files, plugins.
Warren sees the behavior
It scores the reconnaissance in real time, right inside your WordPress.
Attacker is blocked
The hostile IP is banned automatically — at the PHP layer and, on Apache, the server.
Your site stays secure
Repeat offenders stay out; bans self-expire so real visitors are never stranded.
Good sites deserve
a guardian.
FEATURES
Everything Warren does.
One plugin, inside your own WordPress — no console to host, no monthly cloud bill. Reconnaissance detection and automatic banning come standard; the deeper intelligence is Premium.
Recon detection & auto-ban
Scores scanner behavior in real time and bans hostile IPs automatically — enforced in WordPress and, on Apache, at the server. Bans expire so false positives self-heal.
Real attacker IP
Resolves the true client IP behind Cloudflare and proxies — and can't be fooled by a forged header, so you ban the attacker, not your CDN.
One-click hardening
Neutralises XML-RPC abuse (pingback + multicall), blocks user-enumeration, disables the file editor, and sends security headers.
Honeypot
A decoy link and hidden login field no human ever touches — any hit is a bot, banned instantly.
Privilege-escalation guard
Blocks and bans unauthenticated requests that try to grant themselves an admin role — the SureTriggers/Hunk-class 2025 exploit pattern.
Breach detection
Daily checks flag a new or hidden admin account, a tampered wp-config.php, or a web-shell dropped in your uploads folder.
Device fingerprinting
Links one attacker across many IPs — and tells many devices behind one office IP apart.
Device-locked admin
Ties your admin session to the device you logged in from — a stolen session cookie is signed out on another machine, on wp-admin and the REST API.
wp-admin password wall
A second server-side password in front of wp-admin and wp-login — and it verifies it actually works on your server before switching on.
File-guard
Blocks PHP execution in /uploads (kills uploaded web-shells), denies sensitive files, and turns off directory listing.
Shared threat feed
Pre-blocks known-bad scanner networks from our hosted list the moment you activate — a head start on the bots everyone else has seen.
Edge bans & AI verdicts
Optionally push bans to Cloudflare's edge, and get an AI written assessment of any suspicious IP (your own or a free OpenRouter model).
PRICING
One-time. Per site.
No subscriptions, no per-month creep. Buy it once for a site and it runs offline forever on a domain-locked license.
- ✓ Real-time recon detection & automatic, self-expiring bans
- ✓ One-click hardening suite
- ✓ Honeypot & privilege-escalation guard
- ✓ Breach / integrity alerts
- ✓ True client-IP (Cloudflare & proxy aware)
- ✓ Full in-WordPress dashboard
- ✓ Device fingerprinting
- ✓ Device-locked admin sessions (anti stolen-cookie)
- ✓ wp-admin password wall (self-verifying)
- ✓ File-guard — blocks web-shells in /uploads
- ✓ Shared known-bad threat feed
- ✓ Cloudflare edge bans + optional AI verdicts
Already on Normal? Upgrade to Premium for the difference — handled on our end, no double-charge. Need many sites? Ask about a bundle.
DOCS
Up and running
in two minutes.
Install
- In wp-admin: Plugins → Add New → Upload Plugin, choose the .zip, Install, Activate.
- Open Warren → Settings.
- Paste your license key and click Activate (one time — then it runs offline). Protection is on.
Tip: turn on pretty permalinks (Settings → Permalinks → Post name) for the widest coverage, so filesystem probes like /.env are seen too.
Locked out? Recovery
Warren can never permanently lock you out. If you ever need back in:
- WP-CLI:
wp warren unlock(clears the admin + device lock) andwp warren unban all. - No shell? Remove the
Warrenblocks fromwp-admin/.htaccessand the root.htaccess, or just deactivate the plugin via FTP.
Hosting
Works on any host. PHP-level banning runs everywhere incl. nginx; the .htaccess edge layer and the password wall are Apache/LiteSpeed. The password wall verifies it actually works on your server before it claims to be on.
Does it replace keeping WordPress updated?
No — it's the layer that stops the automated scanning, brute-force, and repeat attacks that are most real hacks, and keeps working when you're behind on patches. Patch too; this covers the reconnaissance.
Will it slow my site down?
No. Detection is lightweight and fails open — if anything ever errors, the request just proceeds. Nothing blocks page rendering.
Is there a cloud service to host?
No. Everything runs inside your WordPress. The only phone-home is a one-time license activation.
What if a real visitor gets banned?
Your own IP is never banned, and every ban expires on its own. You can also unban any IP from the dashboard in one click.
SUPPORT
We've got your back.
Real help from the people who built it. Most answers are in the docs — for everything else, reach out.
Email support
Questions, licensing, or moving a license to a new domain — support@warren.help. We answer.
Documentation
Install, recovery, and every setting explained. Read the docs →
Locked out?
You can always get back in — wp warren unlock, or remove the .htaccess blocks. See recovery →