MTS WP Security Shield — Technical Documentation

1. Overview

Understanding MTS WP Security Shield at a technical level

MTS WP Security Shield is a production-grade WordPress security plugin built on a Detect → Harden → Monitor → Respond architecture. Unlike basic security plugins that rely on a single layer of protection, this plugin implements a multi-layered security platform that addresses the full threat lifecycle.

Design Philosophy: Security is not a single feature — it is a process. MTS WP Security Shield provides the tools to detect vulnerabilities, harden the installation, monitor for threats, and respond to incidents.

Core Architecture Principles

D

DETECT

Scan files, configurations, login attempts, and user behavior to identify vulnerabilities and active threats.

H

HARDEN

Apply security configurations: disable XML-RPC, restrict REST API, add security headers, enforce 2FA.

M

MONITOR

Continuous file integrity checks, login monitoring, session tracking, and real-time activity logging.

R

RESPOND

Automated IP blocking, brute-force lockouts, email/webhook alerts, and incident response logging.

2. Technical Architecture

System design, module structure, and data flow

DETECT

HARDEN

MONITOR

RESPOND

▼

Risk Engine

▼

Security Scanner

▼

File Integrity

Login Security

User Security

Configuration

Headers

Plugins/Themes

Database

▼

Alert System

Activity Log

IP Blocking

Session Control

Module Architecture

The plugin uses a modular architecture with PSR-4 autoloading. Each security domain is encapsulated in its own namespace and can be independently enabled or disabled.

Module	Namespace	Responsibility	Files
Core	`MtsSs\Core`	Orchestration, database, activity log, risk engine	5
Scanner	`MtsSs\Scanner`	7 specialized security scanners	8
Login	`MtsSs\Login`	Authentication, 2FA, sessions, brute force	5
Firewall	`MtsSs\Firewall`	IP management, request filtering, headers	2
Alerts	`MtsSs\Alerts`	Email and webhook notifications	3
Admin	`MtsSs\Admin`	Dashboard UI, settings pages	1
API	`MtsSs\Api`	REST API endpoints	1
CLI	`MtsSs\Cli`	WP-CLI commands	1

File Structure

// Plugin root: mts-wp-security-shield/
mts-wp-security-shield.php          // Entry point, autoloader, constants
uninstall.php                        // Cleanup on uninstall
assets/
  admin.css                          // Dashboard styles
  admin.js                           // AJAX interactions
includes/
  class-mts-ss-core.php             // Main orchestrator
  core/
    class-risk-engine.php            // Severity scoring engine
    class-database.php               // DB abstraction layer
    class-activity-log.php           // Event logging
    class-mts-ss-activator.php       // DB table creation
    class-mts-ss-deactivator.php     // Cron cleanup
  scanner/
    class-scanner-engine.php         // Scan orchestrator
    class-scanner-file-integrity.php // File hash verification
    class-scanner-login-security.php // Login vulnerability checks
    class-scanner-user-security.php  // User account audits
    class-scanner-configuration.php  // WP config checks
    class-scanner-headers.php        // Security header audit
    class-scanner-plugins-themes.php // Plugin/theme integrity
    class-scanner-database-security.php // DB security checks
  login/
    class-login-protection.php       // Failed login tracking
    class-brute-force.php            // IP-based brute detection
    class-rate-limiter.php           // Request rate limiting
    class-two-factor-auth.php        // TOTP-based 2FA
    class-session-manager.php        // Session lifecycle
  firewall/
    class-firewall-engine.php        // Request filtering, headers
    class-ip-manager.php             // Block/unblock/allow/deny
  alerts/
    class-alert-manager.php          // Alert routing
    class-email-alerts.php           // HTML email alerts
    class-webhook-alerts.php         // Slack/Discord webhooks
  admin/
    class-admin-dashboard.php        // 12-page admin UI
  api/
    class-rest-controller.php        // 8 REST endpoints
  cli/
    class-cli-security.php           // 5 WP-CLI commands
tests/                              // PHPUnit + integration tests
                

3. Technical Features

Complete feature inventory with technical specifications

3.1 Security Scanner Engine

The scanner engine orchestrates 7 specialized modules, each targeting a specific security domain. The engine runs scans on-demand, via cron, or through REST API/WP-CLI.

Scanner Module	Checks Performed	Risk Levels
File Integrity	SHA-256 hash comparison, modified file detection, unknown file detection, permission checks	High Medium
Login Security	Default admin check, XML-RPC status, REST API enumeration, user enum protection	High Medium Low
User Security	Admin count audit, password age tracking, inactive user detection	Medium Low Info
Configuration	DISALLOW_FILE_EDIT, table prefix, debug mode, auto-updates, file editing	Medium Low
Security Headers	X-Content-Type-Options, X-Frame-Options, CSP, HSTS, Referrer-Policy, Permissions-Policy	Medium Low
Plugins/Themes	Update availability, abandoned plugin detection, inactive plugin audit	Medium Low Info
Database	Admin account security, charset verification, table size monitoring	Low Info

3.2 Risk Engine

Every finding is classified into one of five severity levels with associated scoring:

Severity	Score Weight	Description	Response Time
Critical	100	Immediate security risk, active exploitation possible	Immediate
High	75	Significant vulnerability, likely attack vector	Within 24 hours
Medium	50	Moderate risk, should be addressed soon	Within 7 days
Low	25	Minor issue, best practice recommendation	Within 30 days
Informational	10	Information only, no immediate risk	When convenient

// Risk Engine scoring formula
function calculate_score(findings) {
  total_impact = sum(finding.severity_weight for each finding)
  max_possible = count(findings) × 100
  score = 100 - (total_impact / max_possible × 100)
  return max(0, min(100, round(score)))
}
                

3.3 Login Protection System

BF

Brute Force Protection

IP-based tracking of failed login attempts with configurable thresholds and automatic lockout. Uses WordPress transients for storage.

Configurable max attempts (default: 5)
Configurable lockout duration (default: 900s)
Per-IP + per-username tracking
Automatic lockout with activity logging

2FA

Two-Factor Authentication

TOTP-based 2FA compatible with Google Authenticator, Authy, and other TOTP apps. Includes QR code generation.

RFC 6238 TOTP implementation
Per-user enable/disable
QR code for easy setup
Time-window verification (±1 step)

RL

Rate Limiting

HTTP request rate limiting per IP address with configurable window and threshold. Returns proper 429 status codes.

Requests per window (default: 60/60s)
Retry-After header support
X-RateLimit-Limit headers
Admin-ajax and REST API support

SM

Session Management

Track and manage user sessions with configurable limits and timeout. Admins can terminate sessions remotely.

Max active sessions per user
Session timeout enforcement
Session listing and termination
IP and user-agent tracking

3.4 Firewall & Hardening

XML-RPC Control: Disable or restrict xmlrpc.php to prevent brute-force amplification and DDoS attacks
REST API Security: Block anonymous access to /wp/v2/users and other enumeration endpoints
Security Headers: Automatically send X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, HSTS
User Enumeration Protection: Block author archive pages and feed-based username discovery
IP Allow/Deny Lists: Granular IP-based access control with permanent and temporary blocks
File Editing Disable: Enforce DISALLOW_FILE_EDIT to prevent dashboard code editing

3.5 Alert System

Channel	Features	Format
Email Alerts	HTML formatted, severity-based subject lines, critical finding details, scan summary reports	HTML multipart
Webhook Alerts	Slack/Discord compatible, Block Kit formatting, severity emoji indicators, real-time delivery	JSON payload

4. Database Schema

Custom tables and data storage architecture

The plugin creates 5 custom tables on activation, all prefixed with the WordPress table prefix. All queries use prepared statements via $wpdb->prepare().

Table	Purpose	Key Columns	Indexes
`wp_mts_ss_activity_log`	Security event logging	event_type, severity, message, user_id, ip_address, created_at	event_type, severity, user_id, created_at
`wp_mts_ss_user_sessions`	Active session tracking	user_id, session_token, ip_address, last_activity, expired	user_id, session_token, expired
`wp_mts_ss_file_hashes`	File integrity baseline	file_path, file_hash, file_size, last_modified, scan_batch	file_path, scan_batch
`wp_mts_ss_blocked_ips`	IP blocking records	ip_address, reason, blocked_by, expires_at	ip_address, expires_at
`wp_mts_ss_scans`	Scan history and results	scan_type, status, results, findings_count, critical_count, high_count	scan_type, status, started_at

Data Retention: Activity logs, sessions, and scan records older than 90 days are automatically cleaned up via the Mts_Ss_Database::cleanup_old_data() method.

5. REST API

Authenticated API endpoints for programmatic access

All endpoints require manage_options capability and use WordPress nonce authentication. Base URL: /wp-json/mts-ss/v1/

Method	Endpoint	Description	Parameters
POST	`/scan`	Run full security scan	—
POST	`/scan/{module}`	Run specific module scan	module: file_integrity, login_security, etc.
GET	`/activity`	Retrieve activity logs	limit, offset
GET	`/blocked-ips`	List blocked IPs	—
POST	`/block-ip`	Block an IP address	ip_address, reason
DELETE	`/unblock-ip/{id}`	Unblock an IP	id (path)
GET	`/settings`	Get plugin settings	—
POST	`/settings`	Update plugin settings	JSON body with settings

Example API Usage

// Run a security scan via REST API
curl -X POST https://yoursite.com/wp-json/mts-ss/v1/scan \
  -H "X-WP-Nonce: your_nonce_here" \
  -H "Content-Type: application/json" \
  -u "username:application_password"

// Response
{
  "score": 85,
  "counts": {
    "critical": 0,
    "high": 2,
    "medium": 5,
    "low": 8,
    "informational": 3
  },
  "findings": [...]
}
                

6. WP-CLI Commands

Command-line interface for server administrators

Command	Description	Options
`wp mts-security scan`	Run full security scan	--format=table\|json
`wp mts-security status`	Show current security status	—
`wp mts-security users`	Show user security status	—
`wp mts-security integrity`	Run file integrity check	—
`wp mts-security harden`	Apply hardening fixes	--fix=xmlrpc\|rest-api\|security-headers\|all

// Example: Run scan and output as JSON
$ wp mts-security scan --format=json

// Example: Apply all hardening fixes
$ wp mts-security harden --fix=all

// Example: Show security status
$ wp mts-security status
                

7. Security Model

How the plugin protects itself and your WordPress site

WordPress Security Best Practices

Practice	Implementation
Nonces	All AJAX actions use `wp_create_nonce('mts_ss_nonce')` and verify with `check_ajax_referer()`
Capabilities	All admin actions require `manage_options` capability check
Sanitization	All inputs sanitized via `sanitize_text_field()`, `wp_unslash()`, `absint()`
Escaping	All outputs escaped via `esc_html()`, `esc_attr()`, `esc_url()`, `esc_js()`
Prepared Queries	All database queries use `$wpdb->prepare()` with parameterized statements
REST Authentication	REST API uses WordPress nonce authentication or Application Passwords
Password Storage	Never stores plaintext passwords. 2FA secrets stored via `wp_hash()`
Data Minimization	Only collects necessary security data. No personal information collection.

Security Guarantee: This plugin does not execute arbitrary uploaded code. It does not collect unnecessary personal information. It does not store plaintext passwords. All external communications use HTTPS with SSL verification enabled.

Capabilities Required

manage_options — Required for all admin pages, AJAX actions, and REST API endpoints
edit_users — Required for user session management and 2FA settings
create_users — Not required (plugin does not create users)

8. System Requirements

Server and WordPress requirements

Requirement	Minimum	Recommended
PHP Version	8.2	8.3+
WordPress Version	6.4	6.7+
MySQL Version	5.7	8.0+
Memory Limit	128MB	256MB+
PHP Extensions	json, mbstring, hash	openssl, curl
Disk Space	5MB	10MB+ (for logs)

Database Impact

The plugin creates 5 custom tables with minimal storage footprint. Expected database overhead:

Activity Log: ~1KB per entry, auto-cleanup after 90 days
User Sessions: ~0.5KB per session, auto-expire based on timeout
File Hashes: ~0.3KB per file, updated on each scan
Blocked IPs: ~0.2KB per entry, auto-expire for temporary blocks
Scans: ~5KB per scan (JSON results), retained for history

Performance Considerations

File Integrity Scanning: The file integrity scanner reads and hashes files in wp-admin and wp-includes. On large installations, this may take 30-60 seconds. Scheduled scans run during low-traffic periods by default (daily cron).