MVO Segurança e Proteção

Beschreibung

MVO Segurança e Proteção is a modular WordPress security suite developed by MVO Soluções, part of the MVO Tools plugin family. Enable only the protections you need. The plugin provides login security, hardening, attack prevention, on-demand vulnerability and malware-indicator checks, encrypted quarantine, integrity monitoring, and local security auditing.

Key features:

• Two-factor authentication (TOTP) compatible with Google Authenticator and one-time recovery codes.
• Optional XML-RPC blocking.
• Prevention of executable file uploads and execution rules for the uploads directory.
• Reduced username enumeration and less revealing login errors.
• Directory listing protection.
• Temporary IP-based blocking against brute-force login attempts.
• On-demand vulnerability and suspicious-file scanner.
• Encrypted quarantine and manual deletion of eligible suspicious files.
• Restricted automatic recovery for non-executable media and documents in the uploads directory.
• File integrity baselines and comparisons.
• Write-permission hardening for application code directories.
• Application Password and administrative session controls.
• Locally stored security event log.
• Sensitive-file protection and security HTTP headers.
• Conservative application firewall rules for high-confidence attack patterns.

The scanner runs only when an administrator explicitly starts it. The plugin does not perform expensive continuous malware scans in the background. Heuristic findings are not conclusive evidence of malware.

Modules

01. Two-factor authentication (2FA)

Adds a second authentication step with Google Authenticator or any compatible TOTP app. Each user enrolls individually and receives one-time recovery codes. TOTP secrets are encrypted where Sodium or OpenSSL is available.

02. Disable XML-RPC

Blocks xmlrpc.php, disables XML-RPC methods, and removes discovery hints such as X-Pingback and RSD. This module is optional because some legacy integrations rely on XML-RPC.

03. Prevent code execution in Uploads

Rejects executable file types during the WordPress upload process. On Apache/LiteSpeed, it also creates managed .htaccess rules to deny web access to executable files under the public uploads directory.

04. Login and user enumeration

Makes failed login messages less revealing, restricts common public author enumeration requests, limits public user listing via the REST API, and removes the public user sitemap.

05. Directory browsing

On Apache/LiteSpeed, adds managed rules to prevent visitors from listing files in directories without an index file.

06. IP blocking

Tracks authentication failures per IP address and temporarily blocks addresses that exceed a configurable threshold. Password and 2FA failures contribute to the same counter. Administrators can configure the limits, lookback window, duration, and trusted IPs.

07. Vulnerabilities and quarantine

Provides administrator-initiated checks of core integrity, suspicious files, installed plugins/themes, administrator accounts, and security settings. Eligible suspicious files may be placed in encrypted quarantine or deleted only after explicit administrator action.

Quarantine payloads are stored inside the WordPress uploads directory in a plugin-specific folder, using non-executable encrypted .bxsq files. The directory includes Apache/IIS access-denial rules; on Nginx, additional server rules may be needed to prevent direct downloads of encrypted payloads. The encryption key is kept in WordPress options. Quarantine files are preserved on uninstall to avoid accidental data loss.

Automatic restoration is limited to non-executable media/document extensions within the uploads directory and rejects PHP markers. Suspicious PHP files, other executable code, and files outside uploads cannot be rewritten to their original paths by this plugin. Recover trusted originals from a backup or reinstall the affected WordPress core, plugin, or theme. Existing encrypted quarantine items from earlier releases are copied to the new location when possible, leaving legacy copies untouched for safety.

The module can also create an integrity baseline and later compare newly added, changed, or removed code files.

08. File permissions

Reduces write permissions in WordPress code directories while preserving operational exceptions for uploads, identified caches, and quarantine. Includes a configurable maintenance window for updates and blocks editing plugin/theme code through the WordPress admin while protection is active. This is an additional hardening layer, not a replacement for proper operating system permissions or updates.

09. Credentials and sessions

Allows administrators to disable WordPress Application Passwords, inspect and revoke existing credentials, and end administrative sessions.

10. Security log

Stores events such as logins, failures, user and plugin changes, updates, IP blocks, quarantine actions, and security setting changes locally. Retention is limited, and passwords, TOTP secrets, and authentication tokens are not logged.

11. Sensitive files

On Apache/LiteSpeed, blocks web access to recognizable sensitive files and configuration backups, such as .env, .git, database dumps, logs, and certain archive names.

12. Security headers

Adds conservative headers including X-Content-Type-Options, framing protection, and Referrer-Policy. HSTS and Permissions-Policy are optional.

13. MVO firewall

Checks request URLs and query strings for high-confidence traversal, SQL injection, explicit XSS, and sensitive-file probing patterns. This version intentionally does not inspect POST bodies to minimize false positives and interference with checkouts and forms.

Privacy

MVO Segurança e Proteção stores only the local data needed for its security features, such as settings, audit events, temporary IP blocks, integrity hashes, and encrypted quarantine metadata. It does not transmit this data to MVO Soluções or include proprietary tracking or telemetry. When the WordPress core checksum feature is used during a manual integrity check, the official WordPress implementation may contact WordPress.org to obtain checksums for the installed version.