Skip to content
defneo
ROEN

LIVE

Site Shield · free

A firewall for your hosting account. No root needed.

For WordPress, Joomla and PHP sites on cPanel shared hosting. Install it once in your home directory and it protects every site of the account — and blocks the addresses that other Defneo installations have caught attacking.

Download · v1.2.1Free account — first site protected, with a traffic and threats dashboardWordPress plugin (zip) — Plugins → Add New → Upload · v1.2.1No SSH? Web installer · v1.2.1

One PHP file: upload it to public_html with File Manager, open it in your browser, press Install. It deletes itself. From your Defneo account it comes with the site's token inside.

PHP 7.4 – 8.3 · AGPL-3.0 · WordPress: GPL-2.0+

SHA-256: 5ad1417873d232cce8047bbcc1a51af1f3f69d9bdd4fe0618c1410d58a04b753

Running your own server with root access? Defneo Community Edition protects the whole server

  • Real-time WAFRuns before WordPress or Joomla on every PHP request: path traversal, code injection, Log4Shell probes, the Joomla config-leak CVE, PHPUnit eval-stdin, known web shells, PHP executed from uploads, wp-login and xmlrpc brute force.
  • Static secretsA managed block in each site's .htaccess refuses .env, .git, wp-config.php backup copies, SQL dumps and debug.log — files PHP never sees.
  • Log analysisEvery 5 minutes it reads your own access logs and finds what one request does not show: brute force, user enumeration, plugin probing, 404 storms.
  • Community feedPulls the signed Defneo blocklist (verified with a key pinned in the package) and shares the attacks your sites see.
  • Site inventoryWordPress / Joomla versions against the newest release, installed plugins, and the classic backdoor sign: PHP files inside an upload folder. Optional e-mail alert.
  • ReversibleUninstall restores .user.ini and .htaccess byte for byte. An existing tool such as Wordfence's firewall is kept and chained, not replaced.
  • Mail filterReads what arrives in the account's mailboxes and moves clear junk, phishing and malware into each mailbox's Junk folder — nothing is deleted. Executable attachments (also inside ZIPs), HTML attachments with a password form, senders in hijacked networks or on mail-abuse lists, links that show one domain and go to another.
  • Your users teach itMoving a message into Junk — from webmail, Outlook or a phone — is a report: the account learns its links and files. Moving one back out marks it "not junk" and trusts the sender for that mailbox. No plug-in in the mail client.
  • Open antivirusAttachment hashes checked against ClamAV-format signature files, plus the host's ClamAV daemon when it offers one. A daily e-mail lists everything that was moved, so a wrong move is easy to find.

Install in three steps

  1. 1. Upload and installUnzip next to public_html (never inside it), then run the installer from cPanel → Terminal or SSH. No Terminal on your hosting? Use the web installer instead (download box above).
    cd ~ && unzip defneo-site-shield-1.2.1.zip
php ~/defneo-shield/shield.php install
  2. 2. Connect your free accountCreate a Defneo account (a code by e-mail, no password) and add your site: the install command comes with your token, and the site appears on your dashboard with its traffic and threats. Or enroll later:Create a free account →
    php ~/defneo-shield/shield.php enroll YOUR-TOKEN
  3. 3. Watch first, then blockThe shield starts in monitor mode: it detects and reports, and blocks nothing. Check what it would have blocked on your own traffic, allow what you trust, then switch:
    php ~/defneo-shield/shield.php replay ~/access-logs/*
php ~/defneo-shield/shield.php mode block

Never blocked

  • Private and reserved addresses, your own server, anything on your allowlist.
  • Cloudflare edges: without the real visitor IP, blocking an edge would take the site offline for everyone behind it.
  • The owner who mistypes a password: a successful login resets the brute-force counter.
  • If the shield itself fails, the request goes through. A broken firewall must not take your site down.

What leaves your account

Only the IP addresses that attacked your sites, the rule that caught them and a time — nothing about your visitors, content or files. Nothing from your mailboxes leaves the account. Turn it off with `shield.php share off` (an empty heartbeat still keeps your feed access). Reports from self-service installations count as one vote together, so they reach the shared list only when an independent source confirms them.

Requirements

  • PHP 7.4 – 8.3 running as PHP-FPM, CGI or LSAPI (the usual cPanel setup)
  • The PHP sodium extension (cPanel → Select PHP Version)
  • SSH or the cPanel Terminal, and Cron Jobs
  • For the mail filter: mailboxes stored as Maildir (the cPanel default)