Brainwerk Security Suite

Описание

WordPress security that protects your site — without selling out you or your visitors.

Brainwerk Security Suite is a modern, lightweight security plugin that keeps 100 % of your security data on your own server. No third-party cookies. No Google reCAPTCHA. No silent phone-home. Just clear, honest protection — 2FA, brute-force defense, file-integrity monitoring, a vulnerability scanner and a full audit trail — with privacy treated as a first-class feature, not an afterthought, and Multisite supported from day one.

🇪🇺 Made in Europe. Made for Europe.

Brainwerk Security Suite is the European answer for privacy-first WordPress security — the solution built in the EU, for the EU.

Engineered in the EU, to EU standards, with privacy-by-design built into every log line — never bolted on afterwards. Out of the box the plugin makes no outbound calls at all, so your security data never leaves your infrastructure and you stay in control of your users’ trust.

• Privacy-focused by default — IP anonymisation on by default (/24 for IPv4, /64 for IPv6), username pseudonymisation, configurable retention, one-click erasure, and a published data map you can paste straight into your privacy policy. These are technical data-minimisation measures; whether a consent banner is required depends on your configuration and jurisdiction and should be legally reviewed.
• Built for NIS2-era governance — everything self-hosted, auditable and under your control, with an audit trail to support your GDPR (Art. 32) and NIS2 data-governance obligations.
• No phone-home, ever, unless you ask — every external service is opt-in and off by default, and each is documented byte-for-byte in the External services section below. The default anti-bot is a 100 % local honeypot — no reCAPTCHA, no Google data transfer.
• High-tech under the hood — a SHA-256 integrity baseline over ~10k files, time-budgeted resumable cron sweeps, an explainable Z-score anomaly model with a per-user baseline, indexed tables and a transparent 0–100 threat score — all computed locally, no cloud.

Free features — defense in depth

Login & accounts

• Login activity log (success / failure / blocked)
• Brute-force protection: IP-based AND account-based (botnet rotates IPs, account stays locked)
• IP whitelist (single IPs and CIDR)
• TOTP two-factor authentication (RFC 6238) — works with Google Authenticator, Microsoft Authenticator, Authy, 2FAS, FreeOTP, Aegis. 8 single-use recovery codes per user. Force-by-role.
• Honeypot anti-bot on login / register / comment forms — 100% local, no reCAPTCHA, no Google data transfer.
• Custom login URL — rewrite wp-login.php to a path of your choice; the original returns 404. Lockout-recovery via wp-config define.

File integrity & malware

• SHA-256 file-integrity monitor over WP core, mu-plugins, plugins, and themes (default: ~10k files indexed). Daily wp-cron sweep detects added / changed / missing files.
• Pattern-based suspicious-code scan (16 rules) on every changed file: eval(base64_decode(...)), webshell signatures (c99/r57/WSO/b374k), inline wp_insert_user(role=admin), preg_replace /e, remote include via URL — runs only against deltas, not full corpus, so it stays cheap.

Vulnerability scanner

• Opt-in daily check (off by default) of every installed plugin / theme / core version against an EU-hosted vulnerability API (default shieldforge-intel.brainwerk.at), which aggregates public sources (wpvulnerability.net, EUVD). No API key. The endpoint is configurable — point it at a self-hosted mirror. See External services below for exactly what is sent.
• CVE-IDs and CVSS scores with direct links; flagged ACTIVE vs INACTIVE so you know which to update first.

Hardening

• One-click toggles: disable XML-RPC, hide WordPress version, block author enumeration, restrict REST API for anonymous visitors (users / comments / search / settings / themes / plugins endpoints).
• Security HTTP headers — per-header toggle: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS.
• Content-Security-Policy with Report-Only mode for safe rollout — opt-in.
• Disable file editor in admin.

Detection

• 404 probing tracker (.env, wp-config.bak, xmlrpc.php and friends).
• Anomaly detection — explainable Z-score model on login_hour / IP family / user-agent class, per-user adaptive baseline, no cloud calls.
• Audit trail — who changed what when: post edits, user changes, plugin/theme/core updates, security-sensitive option changes (siteurl, admin_email, users_can_register, default_role, network site_admins …). Useful for incident response and DSGVO Art. 32 compliance.

Admin experience

• WordPress dashboard widget with transparent threat score (0–100), action items, system-status strip, top attackers, recent events.
• Daily digest email with threat score, 24h-vs-7d trend, ASCII heatmap, top targeted usernames, top probing patterns, vulnerable-active-components — pure ASCII so it renders identically through every mail pipeline (php mail / SMTP / OAuth-SMTP / Microsoft Graph).
• Healthcheck banner — auto-detects setup issues (proxy IP masking, anonymization off, brute-force disabled) so admins can’t ship a broken config.
• Quiet hours that critical alerts can override.

Privacy & GDPR

• IP anonymization (default on, /24 for IPv4, /64 for IPv6), username pseudonymization, configurable log retention with daily cleanup, retroactive anonymization helper.
• Privacy-policy snippet generator (DE / EN).
• Multisite-aware: network-activate, per-site overrides, aggregate dashboard.
• Onboarding wizard in 6 languages — DE / EN / FR / IT / PL / ES, language picker as first step.

Go Pro

The Pro tier (a separate companion plugin) adds:

• WebAuthn / Passkeys (FIDO2)
• Geo-blocking with a regularly updated database
• Cloud threat-intelligence feed (EU-hosted, opt-in)
• Slack / Discord / Mattermost / Telegram / MS Teams notifications
• Aggregate Multisite dashboard for agencies
• Whitelabel mode and priority support

🇪🇺 Auf Deutsch — kurz & knapp

Die europäische Antwort für datenschutzfreundliche WordPress-Security — die Lösung aus der EU für die EU.

Brainwerk Security Suite ist die schlanke, moderne Security-Suite für WordPress, die 100 % deiner Security-Daten auf deinem eigenen Server behält. Keine Tracking-Cookies, kein Google reCAPTCHA, kein stilles Phone-Home — nur ehrlicher Schutz und volle Kontrolle. Datenschutz ist Kernfunktion, nicht nachträgliches Extra, und Multisite ist von Anfang an mitgedacht.

• Made in Europe, made for Europe — in der EU nach EU-Standards entwickelt, Privacy-by-Design in jeder Logzeile
• DSGVO-ready ab Werk — IP-Anonymisierung standardmäßig an, Pseudonymisierung, konfigurierbare Aufbewahrung, Ein-Klick-Löschung, veröffentlichte Data-Map. Ob ein Consent-Banner nötig ist, hängt von deiner Konfiguration und Rechtslage ab und ist rechtlich zu prüfen.
• Für die NIS2-Ära gebaut — alles selbst gehostet, auditierbar, mit Audit-Trail für DSGVO Art. 32
• Kein Phone-Home ab Werk — jede externe Verbindung ist opt-in und standardmäßig aus, und im Abschnitt External services Byte für Byte dokumentiert
• Login-Schutz — TOTP-2FA, IP- und accountbasierter Brute-Force-Schutz, lokaler Honeypot (kein reCAPTCHA), eigene Login-URL
• Datei-Integrität & Malware — SHA-256-Baseline über ~10.000 Dateien, Pattern-Scanner mit 16 Regeln, nur auf Deltas
• Schwachstellen-Scanner — opt-in, täglicher Abgleich gegen eine EU-gehostete API (self-hostbar), CVE/CVSS
• Härtung & Erkennung — XML-RPC aus, Security-Header, CSP, 404-Probing-Tracker, erklärbare Anomalieerkennung (lokal)
• Multisite-First — netzwerkweit konfigurieren, Per-Site-Overrides, Onboarding-Wizard in 6 Sprachen (DE/EN/FR/IT/PL/ES)

Privacy Policy

Data stored in your WordPress database (never leaves the server)

• Login events: timestamp, event type (success / failure / blocked / 2FA required / 2FA passed / 2FA failed / logout), username (or hashed pseudonym if pseudonymization is on), IP address (or anonymized /24 if IP anonymization is on — default), user-agent, request URI.
• Brute-force blocks: blocked IP, reason, expiry timestamp.
• Anomaly baselines: per-user statistical aggregates (mean and variance of login_hour, IP family, user-agent class). No raw login history is retained beyond the rolling log retention window (default 30 days).
• File-integrity baseline: SHA-256 hash + size + mtime + tracked path of every PHP file under WP core / plugins / mu-plugins / themes. Used to detect added / changed / missing files. The file contents are never stored — only the hash.
• 2FA secrets (per user, if user enrolled): base32-encoded TOTP secret, sha256-hashed recovery codes (the plain codes are shown ONCE on enrollment and never persisted).
• Audit trail: who edited which post / user / option / theme / plugin, with field-level diffs (no post-content bodies, no password hashes — only [changed] markers for sensitive fields).
• Site option: configuration values, last cron timestamps.

Data sent to external services

The plugin makes no automatic outbound calls until you opt in. The one you are most likely to enable is the vulnerability scanner, which — once switched on — queries an EU-hosted vulnerability API (default https://shieldforge-intel.brainwerk.at/) once per day. It is off by default; the endpoint is configurable and the feature can be disabled again at any time.

• What is sent: per HTTP GET, one slug + one version per installed component (plugin / theme / core). Example: GET /v1/vulns/plugin/contact-form-7/.
• What is NOT sent: site URL, domain, admin email, IP addresses, user information, content, settings.
• Provider: shieldforge-intel.brainwerk.at is Brainwerk’s own EU-hosted API that aggregates public vulnerability data (wpvulnerability.net, EUVD).
• Enable / disable: Brainwerk Security Suite → Vulnerabilities → Settings → Enable scanner (off by default).
• Self-host: point the endpoint setting at your own mirror to keep everything in your network.

Several opt-in features contact external services only after you enable them — see the External services section below for the full list, the exact data sent, and how to turn each off.

Lifecycle

All Brainwerk Security Suite data is deleted on plugin uninstall (DB tables dropped, options removed, user-meta wiped, transients purged). The configurable log retention is enforced by a daily cron.

External services

This plugin can connect to the external services listed below. Every one of them is opt-in and off by default — out of the box the plugin contacts nothing. Each can be disabled again at any time, and the vulnerability endpoint can be re-pointed at a self-hosted mirror.

1. Brainwerk Vulnerability API — https://shieldforge-intel.brainwerk.at/ — OPT-IN, default OFF

• What it is used for: Daily vulnerability lookup for every plugin, theme and WordPress-core version installed on your site. Surfaces known CVEs, CVSS scores and fixed-in versions in the Vulnerabilities tab.
• When data is sent: Never until you enable the scanner. Once enabled, once per day via WP-Cron (plus any manual «Scan now» you trigger).
• What data is sent: One HTTP GET per installed component, with the component slug and version in the path (e.g. GET /v1/vulns/plugin/contact-form-7/). No site URL, no domain, no admin email, no IP, no user data, no content, no settings.
• How to disable: Brainwerk Security Suite → Vulnerabilities → Settings → Enable scanner = off.
• Self-host / re-point: set the endpoint option to your own mirror to keep everything inside your network.
• Provider: shieldforge-intel.brainwerk.at is Brainwerk’s own EU-hosted API that aggregates public vulnerability data (wpvulnerability.net — a community mirror of WPScan / Patchstack — and the EU Vulnerability Database, EUVD). Operated by Stefan Kogelgruber / Brainwerk (EU). Privacy: https://brainwerk.at/privacy

2. Brainwerk Threat Network (sensor) — https://shieldforge-intel.brainwerk.at/ — OPT-IN, default OFF

• What it is used for: Optional community threat-intelligence network. Your site shares fact-only attack telemetry and in return receives a signed feed of known-malicious IP indicators.
• When data is sent: Only after you give explicit consent AND the site registers with the network. Never before both steps are completed.
• What data is sent: Batched, HMAC-signed events containing hashed, non-reversible IP indicators (raw IP addresses never leave your server), a hashed user-agent class, a request-path pattern and a country code. No site URL owner data, no user identities, no content.
• How to disable: Brainwerk Security Suite → Threat Network → disable (or simply never enable it). Off by default.
• Provider: Brainwerk (EU-hosted), same operator and privacy policy as above.

3. Have I Been Pwned (Pwned Passwords) — https://api.pwnedpasswords.com/ — OPT-IN, default OFF

• What it is used for: Warns users whose password appears in known breach corpora, at login or password change.
• What data is sent: Only the first 5 characters of the SHA-1 hash of the password (k-anonymity range query). The password itself and the full hash never leave your server.
• How to disable: Off by default; enable under the login/hardening settings only if you want it.
• Provider: Have I Been Pwned, operated by Troy Hunt. https://haveibeenpwned.com/Privacy

4. hCaptcha / Cloudflare Turnstile (optional captcha) — https://hcaptcha.com/, https://challenges.cloudflare.com/ — OPT-IN, default OFF

• What it is used for: Optional captcha on login / registration / comment forms as an alternative to the built-in local honeypot.
• When it is active: Only if you enable the captcha module AND enter your own site/secret keys. When enabled it loads the provider’s JavaScript from their CDN in the browser and, on verification, sends the captcha token and the visitor’s IP address to the provider.
• How to disable: Off by default; the default anti-bot (honeypot) is 100% local and contacts nothing.
• Providers: hCaptcha privacy · Cloudflare Turnstile privacy

5. WordPress.org (core checksums & repository integrity) — https://api.wordpress.org/, https://downloads.wordpress.org/ — OPT-IN / on demand

• What it is used for: Verifying WordPress core files against official checksums (manual admin action) and, optionally, comparing installed plugins/themes against the official wordpress.org checksums / release packages to detect tampering. The plugin only reads these to report differences — it never modifies your plugin or theme files.
• What data is sent: The WordPress version + locale, and the slug/version of the components being verified. No user data.
• When: The core-checksum check runs only when you click it; the repository integrity check is off by default and, when enabled, runs via cron / on demand.
• Provider: WordPress.org (the WordPress project’s own infrastructure). https://wordpress.org/about/privacy/