Title: Locktura Security Author: Alain Lankers Published: 31 juli 2026 Last modified: 6 augustus 2026 --- Plugins zoeken ![](https://ps.w.org/locktura/assets/banner-772x250.png?rev=3629932) ![](https://ps.w.org/locktura/assets/icon.svg?rev=3629932) # Locktura Security Door [Alain Lankers](https://profiles.wordpress.org/alainlankers/) [Download](https://downloads.wordpress.org/plugin/locktura.2.4.2.zip) * [Details](https://nl.wordpress.org/plugins/locktura/#description) * [Beoordelingen](https://nl.wordpress.org/plugins/locktura/#reviews) * [Installatie](https://nl.wordpress.org/plugins/locktura/#installation) * [Ontwikkeling](https://nl.wordpress.org/plugins/locktura/#developers) [Ondersteuning](https://wordpress.org/support/plugin/locktura/) ## Beschrijving Locktura Security helps WordPress administrators manage core site protection from one plugin. This WordPress.org package includes 18 modules for firewall rules, login protection, anti-spam, hardening, update visibility, file checks, traffic review, logging, alerts, and privacy controls. Most protection runs locally inside WordPress. Enable only the modules you need, review local events, and manage common security tasks from one dashboard. #### Included in this plugin * Firewall – Blocks suspicious requests with bundled community rules and request analysis. * Page Cache Compatibility – Provides Strict protection or Cache-compatible public caching, with detection for commonly used cache plugins. * Brute Force Defense – Limits repeated failed login attempts and manages temporary bans. * Hardening – Reduces common WordPress attack surfaces such as enumeration, file editing, XML-RPC abuse, and direct exposure of sensitive server files. * Update Manager – Reviews WordPress core, plugin, and theme updates and stores local update history. * Access Control – Manages allowed, excluded, and blocked IP access controls. * Geo Blocking – Blocks configured countries using geolocation data for public IP addresses. * Hide Login – Replaces default login and admin entry points with a custom slug. * Anti-Spam Shield – Combines CAPTCHA challenges with spam-prevention controls for login, comments, and custom forms. * Usernames & 2FA – Reviews unsafe usernames, recent users, and per-user 2FA status. * Password Manager – Adds password policy checks, forced reset workflows, and password risk visibility. * Email Alerts – Sends security notifications for important events. * Security Logs – Stores local security events and firewall activity for review. * Live Traffic – Shows recent request activity with optional geolocation details. * User Log – Tracks user activity for audit and review. * File Scanner – Scans files for suspicious patterns and includes file integrity monitoring. * File Permissions – Checks risky file and directory permissions. * SSL Control – Helps enforce HTTPS and SSL-related protection. * Email Encoder – Obfuscates public email addresses against scraping. #### Hardening module options * User Enumeration * Disable Theme/Plugin Editor * Privilege Escalation * XML-RPC Shield * Secure wp-admin, wp-includes & wp-config.php * Disable Directory Browsing * Disable RSS Feeds * Prevent Image Hotlinking * Server Exposure Protection #### Separate Premium plugin Locktura Premium is a separately distributed plugin and is not included in this WordPress.org package. All functionality described above is included in this WordPress. org plugin. The separate Premium plugin adds these additional modules: * Pattern Recognition * Behavior Analytics * Admin Lockdown * Virtual Patching * Header Hardening * API Guardian * Neural Bot Suppressor * Network Reputation Control * Malware Scanner & Cleanup * Smart 404 * Extra Hardening Tools * Monthly Reports * Session Management * Extra User Safety Tools * Premium Signature Pack ### Privacy Locktura Security stores security data locally, including IP addresses, request and login details, usernames, events, alert settings, password-policy and 2FA status, scan history, and update history. Optional Geo-IP and password-breach checks use the services documented below. Administrators control retention, recipients, lookup use, and privacy settings. ### External services Locktura Security loads no scripts, styles, fonts, or images from third parties. It makes only the requests documented below when the related feature is enabled or used. #### WordPress.org and extension update providers Used for core, plugin, and theme update checks and downloads through `api.wordpress. org`, `downloads.wordpress.org`, `plugins.svn.wordpress.org`, `themes.svn.wordpress. org`, and update endpoints declared by installed extensions. Requests occur when an administrator uses Update Manager or WordPress performs scheduled checks. WordPress can send the site URL, core/PHP/MySQL versions, locale, and installed extension metadata. Completed update history is stored locally. Documentation: https://developer.wordpress.org/apis/handbook/wordpress-org/update- api/ Policies: https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin- guidelines/ and https://wordpress.org/about/license/ Privacy: https://wordpress. org/about/privacy/ #### Have I Been Pwned Pwned Passwords Used for optional password-breach checks through `https://api.pwnedpasswords.com/ range/{first5-sha1}`. When enabled and a password is evaluated, Locktura sends only the first five characters of its SHA-1 hash, never the password or complete hash. Responses are cached locally for 24 hours. Documentation: https://haveibeenpwned.com/API/v3#PwnedPasswords Terms: https:// haveibeenpwned.com/TermsOfUse Privacy: https://haveibeenpwned.com/Privacy #### Country / country.is Used as the primary country lookup at `https://api.country.is/{ip}`. When an enabled geolocation feature needs uncached data and no trusted country header exists, Locktura sends the public IP being looked up. Results can be cached locally for 24 hours. Country states that it does not log requests. Documentation, terms, and privacy: https://country.is/ Source and self-hosting information: https://github.com/lineofflight/country #### IPWhois / ipwho.is Used at `https://ipwho.is/{ip}` as a geolocation fallback when Country returns no usable data. When an enabled feature needs uncached location data, Locktura sends the public IP being looked up. Results can be cached locally for 24 hours. Documentation: https://ipwhois.io/documentation Terms: https://ipwhois.io/terms Privacy: https://ipwhois.io/privacy #### ipapi.co Used at `https://ipapi.co/{ip}/json/` as the final geolocation fallback when Country and IPWhois return no usable data. When an enabled feature needs uncached location data, Locktura sends the public IP being looked up. Results can be cached locally for 24 hours. Documentation: https://ipapi.co/api/ Terms: https://ipapi.co/terms/ Privacy: https:// ipapi.co/privacy/ #### Own-site HTTPS and TLS checks Used to verify the HTTPS response and certificate of the site’s configured `home_url()` or `site_url()`. When an administrator runs SSL Control, a HEAD request or TLS handshake sends ordinary network metadata and a Locktura user-agent to the site’s own host. No security log is sent. The site’s and hosting provider’s terms and privacy policies apply; Locktura selects no third party. #### Site-configured email delivery Used for enabled security alerts and administrator-requested tests. Messages can contain the recipient, site URL, event type, timestamp, IP address, relevant request or account context, and remediation links. WordPress uses the site’s configured mail transport. Any mail provider processes messages under the site owner’s agreement and policies; Locktura selects no provider. Related events can remain in local Security Logs. #### Locktura website links Links under `https://locktura.com/` provide documentation, plugin and Premium information, and support. They open only after an administrator clicks them; there are no background calls. The browser sends ordinary IP address, user-agent, and referrer data. Locktura appends no logs, settings, or license data. Terms: https://locktura.com/terms-and-conditions/ Privacy: https://locktura.com/ privacy-policy/ ### Translations Locktura Security includes a Dutch translation (nl_NL). ### Bundled assets All assets are bundled locally. Flag Icons and QRCode for JavaScript use the MIT License; Inter and Bebas Neue use the SIL Open Font License 1.1. Their license files are included under `assets/`. The modified Wikimedia Commons world map is public domain with details in `assets/images/world-map.SOURCE.txt`. Locktura artwork uses the plugin’s GPLv2-or-later license. ## Schermafbeeldingen [⌊Security Overview with the protection score, security activity, blocked threats, scans, and blocked login attempts.⌉⌊Security Overview with the protection score, security activity, blocked threats, scans, and blocked login attempts.⌉[ Security Overview with the protection score, security activity, blocked threats, scans, and blocked login attempts. [⌊Recent security alerts with the most active threat categories, threat distribution, and blocked countries.⌉⌊Recent security alerts with the most active threat categories, threat distribution, and blocked countries.⌉[ Recent security alerts with the most active threat categories, threat distribution, and blocked countries. [⌊Traffic and blocked-login activity with an overview of installed Locktura security modules.⌉⌊Traffic and blocked-login activity with an overview of installed Locktura security modules.⌉[ Traffic and blocked-login activity with an overview of installed Locktura security modules. [⌊Module management overview showing active protections and the current status of each module.⌉⌊Module management overview showing active protections and the current status of each module.⌉[ Module management overview showing active protections and the current status of each module. [⌊Brute Force settings with protection controls, detection rules, security activity, and current status.⌉⌊Brute Force settings with protection controls, detection rules, security activity, and current status.⌉[ Brute Force settings with protection controls, detection rules, security activity, and current status. ## Installatie 1. Upload the `locktura` folder to `/wp-content/plugins/`, or install it through the WordPress Plugins screen. 2. Activate Locktura Security and open the Locktura dashboard. 3. Review the modules, enable the protections you need, and save changed settings. ## FAQ ### Is the firewall included? Yes. Locktura Security includes the firewall with bundled community rules. ### Does Locktura Security include 18 modules? Yes. All 18 protection modules listed above are included. ### Do I need a cloud account to use Locktura Security? No. Protection runs locally. Only the optional features documented under External services make network requests. ### Does Locktura Security store security logs? Yes. Security events are stored locally for administrator review. ### Can IP addresses be anonymized? Yes. An IP anonymization setting is available. ## Beoordelingen Er zijn geen beoordelingen voor deze plugin. ## Bijdragers & ontwikkelaars “Locktura Security” is open source software. De volgende personen hebben bijgedragen aan deze plugin. Bijdragers * [ Alain Lankers ](https://profiles.wordpress.org/alainlankers/) “Locktura Security” is vertaald in 1 locale. Dank voor [de vertalers](https://translate.wordpress.org/projects/wp-plugins/locktura/contributors) voor hun bijdragen. [Vertaal “Locktura Security” in je eigen taal.](https://translate.wordpress.org/projects/wp-plugins/locktura) ### Interesse in ontwikkeling? [Bekijk de code](https://plugins.trac.wordpress.org/browser/locktura/), haal de [SVN repository](https://plugins.svn.wordpress.org/locktura/) op, of abonneer je op het [ontwikkellog](https://plugins.trac.wordpress.org/log/locktura/) via [RSS](https://plugins.trac.wordpress.org/log/locktura/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.4.2 * Improved user and 2FA management with pagination, username and email filtering, role-aware guidance, and session controls. * Improved file-permission safety guidance and support for accepting hosting-specific permissions. #### 2.4.0 * Redesigned Firewall page-cache handling with a clear choice between maximum-protection Strict mode and Cache-compatible mode for safe anonymous page caching. * Added automatic cache-plugin detection and live cache diagnostics for public pages, dynamic requests, response cacheability, cache hits, and web-server headers. * Improved cache safety by keeping authenticated, executable, and dynamic requests outside the public page cache and clearing supported caches after relevant protection settings change. * Improved File Permissions with hosting-aware recommendations and reversible approval of supported hosting-specific modes. * Corrected Dutch translation packaging so untranslated English source strings are not submitted as Dutch translations. #### 2.3.9 * Added Strict and Cache-compatible page-cache handling, including cache-plugin detection. * Corrected Dutch translation packaging so untranslated English source strings are no longer submitted as Dutch translations. * Added release checks that prevent source-language fallback values from entering the Dutch translation catalogs. * Improved File Permissions with hosting-aware recommendations and reversible approval of supported hosting-specific modes. #### 2.3.8 * Corrected the presentation of plugin information on the public plugin page. * Added release validation to prevent internal readme markers from appearing on the public plugin page. ## Meta * Versie **2.4.2** * Laatst geüpdatet **5 dagen geleden** * Actieve installaties **Minder dan 10** * WordPress versie ** 6.2 of nieuwer ** * Getest t/m **7.0.3** * PHP versie ** 8.0 of nieuwer ** * Talen * [Dutch](https://nl.wordpress.org/plugins/locktura/) en [English (US)](https://wordpress.org/plugins/locktura/). * [Vertaal in je eigen taal](https://translate.wordpress.org/projects/wp-plugins/locktura) * Tags * [Brute Force](https://nl.wordpress.org/plugins/tags/brute-force/)[firewall](https://nl.wordpress.org/plugins/tags/firewall/) [hardening](https://nl.wordpress.org/plugins/tags/hardening/)[security](https://nl.wordpress.org/plugins/tags/security/) [two factor authentication](https://nl.wordpress.org/plugins/tags/two-factor-authentication/) * [Geavanceerde weergave](https://nl.wordpress.org/plugins/locktura/advanced/) ## Waarderingen Er zijn nog geen beoordelingen ingediend. [Your review](https://wordpress.org/support/plugin/locktura/reviews/#new-post) [Bekijk alle beoordelingen](https://wordpress.org/support/plugin/locktura/reviews/) ## Bijdragers * [ Alain Lankers ](https://profiles.wordpress.org/alainlankers/) ## Ondersteuning Opgeloste problemen in de laatste twee maanden: 1 van de 1 [Het supportforum bekijken](https://wordpress.org/support/plugin/locktura/)