Locktura Security provides modular security tools for WordPress protection, monitoring, maintenance, and alerts. Most protection runs locally. Enable only the modules you need and manage them from one dashboard.<\/p>\n\n
Managed server rules are applied on supported Apache and LiteSpeed installations. Other servers receive configuration guidance.<\/p>\n\n
Locktura Premium is separately distributed outside WordPress.org and is not included in this package. Every Free feature above works without a license.<\/p>\n\n
The separate Premium plugin adds:<\/p>\n\n
Locktura stores security data locally, including IP addresses, request and login details, usernames, events, alert settings, password-policy and 2FA settings (including hashed recovery codes), scan history, and update history. Optional geolocation and password-breach checks use the services below. Administrators control retention, recipients, lookups, and privacy settings.<\/p>\n\n
Locktura loads no scripts, styles, fonts, or images from third parties. It makes only the requests documented below when the related feature is enabled or used.<\/p>\n\n
Used for core, plugin, and theme update checks and downloads through WordPress.org and update endpoints declared by installed extensions. Requests occur during administrator-requested or scheduled checks and can contain the site URL, software versions, locale, and extension metadata. Update history is stored locally.<\/p>\n\n
Documentation: https:\/\/developer.wordpress.org\/apis\/handbook\/wordpress-org\/update-api\/\nPolicies: https:\/\/developer.wordpress.org\/plugins\/wordpress-org\/detailed-plugin-guidelines\/ and https:\/\/wordpress.org\/about\/license\/\nPrivacy: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n
Used for optional breach checks through Documentation: https:\/\/haveibeenpwned.com\/API\/v3#PwnedPasswords\nTerms: https:\/\/haveibeenpwned.com\/TermsOfUse\nPrivacy: https:\/\/haveibeenpwned.com\/Privacy<\/p>\n\n When enabled geolocation needs uncached data and no trusted country header exists, Locktura sends the public IP being looked up. Results can be cached locally for 24 hours. Providers are tried in this order:<\/p>\n\n SSL Control checks the configured Enabled alerts and tests can contain the recipient, site URL, event type, timestamp, IP address, relevant context, and remediation links. WordPress uses the site's configured mail transport; Locktura selects no provider.<\/p>\n\n Links to Terms: https:\/\/locktura.com\/terms-and-conditions\/\nPrivacy: https:\/\/locktura.com\/privacy-policy\/<\/p>\n\n Dutch translations are managed through translate.wordpress.org and delivered by WordPress when an approved package is available.<\/p>\n\n Runtime assets are bundled locally. Flag Icons and QRCode for JavaScript use the MIT License; Inter and Bebas Neue use the SIL Open Font License 1.1. The modified Wikimedia Commons world map is public domain. Source and license details are included under Yes. Locktura Security includes the firewall with bundled community rules.<\/p><\/dd>\n Yes. Every feature listed under Included in this plugin works without a license and has no time or usage restrictions. The separately distributed Premium plugin is not included in this package.<\/p><\/dd>\n No. Protection runs locally. Only the optional features documented under External services make network requests.<\/p><\/dd>\n Yes. Security events are stored locally for administrator review.<\/p><\/dd>\n Yes. An IP anonymization setting is available.<\/p><\/dd>\n\n<\/dl>\n\n\nhttps:\/\/api.pwnedpasswords.com\/range\/{first5-sha1}<\/code>. Only the first five characters of the password's SHA-1 hash are sent, never the password or complete hash. Results can be cached locally, and stored status is discarded when the credential changes.<\/p>\n\nGeolocation providers<\/h4>\n\n
\n
https:\/\/api.country.is\/{ip}<\/code>) - Primary provider. Service information and privacy: https:\/\/country.is\/ | Source and self-hosting: https:\/\/github.com\/lineofflight\/country<\/li>\nhttps:\/\/ipwho.is\/{ip}<\/code>) - First fallback. Documentation: https:\/\/ipwhois.io\/documentation | Terms: https:\/\/ipwhois.io\/terms | Privacy: https:\/\/ipwhois.io\/privacy<\/li>\nhttps:\/\/ipapi.co\/{ip}\/json\/<\/code>) - Final fallback. Documentation: https:\/\/ipapi.co\/api\/ | Terms: https:\/\/ipapi.co\/terms\/ | Privacy: https:\/\/ipapi.co\/privacy\/<\/li>\n<\/ul>\n\nOwn-site HTTPS and TLS checks<\/h4>\n\n
home_url()<\/code> or site_url()<\/code>. An administrator-requested HEAD request or TLS handshake sends ordinary network metadata and a Locktura user-agent to the site's own host. No security log is transmitted.<\/p>\n\nSite-configured email delivery<\/h4>\n\n
Locktura website links<\/h4>\n\n
https:\/\/locktura.com\/<\/code> open only after an administrator clicks them; there are no background calls.<\/p>\n\nTranslations<\/h3>\n\n
Bundled assets<\/h3>\n\n
assets\/<\/code>. Locktura artwork is GPLv2 or later.<\/p>\n\n\n\n
locktura<\/code> folder to \/wp-content\/plugins\/<\/code>, or install it through the WordPress Plugins screen.<\/li>\n\n
Is the firewall included?<\/h3><\/dt>\n
Do all listed Free features work without a license?<\/h3><\/dt>\n
Do I need a cloud account?<\/h3><\/dt>\n
Does Locktura Security store security logs?<\/h3><\/dt>\n
Can IP addresses be anonymized?<\/h3><\/dt>\n
2.4.4<\/h4>\n\n
\n
2.4.3<\/h4>\n\n
\n
2.4.2<\/h4>\n\n
\n