Omega Web Apps Navigation

Site Navigation

Home Omega Performance Engine Omega SEO Engine Omega Image Engine Omega Security Engine Pro Omega Web Metrics

About Why Omega Is Worth Paying For Suite Comparison Technical Overview Pricing Docs Support FAQ Policies Blog Contact Privacy Terms Refund Policy

Omega Security Engine Pro 2.0.0 — Hero Overview

Local-First WordPress Security Engine

Omega Security Engine Pro 2.0.0

Latest Release: 19 August 2026

A local-first WordPress security engine with an immediate application firewall, temporary brute-force login lockouts, validated IP controls, file integrity monitoring, bounded PHP malware scanning, security headers, optional hardening, scheduled maintenance, and administrator diagnostics.

Buy — Unlimited Sites (Lifetime)

Built by Alpha & Omega Limited — local-first security, administrator-controlled hardening, protected local storage, and low normal-request overhead.

What Omega Security Engine Pro 2.0.0 Does

Version 2.0.0 protects WordPress through a modular local security architecture. It performs immediate high-confidence firewall checks during plugin bootstrap, monitors failed logins, manages manual IP allow/block lists, records bounded security events, performs local integrity and malware scans, and exposes security controls through a capability-checked WordPress dashboard.

Immediate Application Firewall

Runs directly during Omega plugin bootstrap and evaluates validated IP lists plus a deliberately small set of high-confidence request signatures.

Brute-Force Login Protection

Tracks failed logins per validated client IP, applies temporary lockouts after the configured threshold, and clears the current IP record after a successful login.

Validated IP Manager

Provides administrator-managed IP allow and block lists with validated IPv4/IPv6 handling and configurable manual-block expiration.

File Integrity Monitoring

Creates local integrity snapshots, reports modified, added, and removed files, avoids symlink traversal, skips volatile directories, and uses normalized relative paths.

Bounded PHP Malware Scanner

Scans PHP files for high-risk signatures with bounded file processing, skips volatile locations and oversized files, and reports suspicious findings for administrator review.

Security Headers

Can send X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy, with HSTS and CSP available separately as opt-in controls.

WordPress Hardening Controls

Provides settings-aware XML-RPC control, optional authenticated-only REST access, numeric author-enumeration blocking, optional file-editor disabling, and optional frontend HTTPS redirection.

Optional .htaccess Hardening

Apache/LiteSpeed sites can apply an isolated Omega marker block without replacing the standard WordPress marker block, and the Omega rules can be removed from the dashboard.

Protected Local Security Storage

Runtime security data is stored under protected wp-content/omega-security-engine-data/ using centralized locked temporary writes followed by atomic replacement.

Scheduled Maintenance

Separates lightweight daily maintenance from the heavier weekly malware scan, with file monitoring and weekly malware scanning independently configurable.

Bounded Local Event Logs

Records security events locally and exposes recent events in the Omega Security dashboard without requiring a remote monitoring service.

Dashboard Diagnostics

Provides a security configuration score, runtime health information, scan state, IP controls, hardening controls, settings, and security event review.

Local-First Security Architecture

Omega Security Engine Pro 2.0.0 does not require cloud malware scanning, remote firewall APIs, telemetry, remote replacement-file services, or external threat-processing queues. Security decisions and runtime security state are handled locally by the WordPress installation.

APPLICATION FIREWALL

Direct execution during plugin bootstrap
Validated local IP-list checks
High-confidence request signatures
Admin/AJAX safeguards to reduce false positives

LOGIN GUARD

Failed-login tracking
Configurable attempt threshold
Temporary lockout window
Successful-login cleanup

IP MANAGER

Validated IPv4 and IPv6 handling
Manual allow/block controls
Configurable block TTL
Proxy headers ignored unless explicitly trusted

FILE MONITOR

Local integrity baselines
Modified / added / removed reporting
No symlink following
Normalized relative-path storage

MALWARE SCANNER

Local PHP signature analysis
Bounded file count
Volatile directories excluded
Non-destructive findings for review

HARDENING

Security headers
XML-RPC control
Optional REST restriction
Author-enumeration control
Optional Apache/LiteSpeed marker rules

Immediate Application Firewall

The 2.0.0 firewall executes directly during Omega's plugin bootstrap instead of registering a callback on a hook priority that has already passed. Its runtime work is intentionally limited to validated IP-list checks and a small set of high-confidence request signatures.

Local blocking: no cloud firewall lookup is required.
Validated client IP handling: REMOTE_ADDR is the default source.
Proxy-safe configuration: forwarded/client proxy headers are trusted only when explicitly enabled.
Admin safeguards: generic payload scanning is skipped for normal admin/AJAX requests to reduce editor and plugin-dashboard false positives.
Manual allow/block support: administrators can manage validated IP lists from WordPress.

Brute-Force Login Protection

Login protection is intentionally separated from the permanent/manual firewall blocklist. Failed attempts create temporary login records, and a successful login clears the current IP's failed-attempt record.

Setting	Default
Brute-force login protection	Enabled
Failed attempts before lockout	5
Lockout duration	30 minutes
Manual block TTL	7 days

Administrators can change the attempt threshold, lockout duration, and manual block TTL from the Omega Security settings screen.

File Integrity Monitor

The integrity monitor records local snapshots and reports files that have changed, appeared, or disappeared. Version 2.0.0 deliberately avoids several scanning patterns that can make integrity tools unnecessarily expensive.

Does not follow symlinks.
De-duplicates scan roots instead of traversing nested trees repeatedly.
Skips volatile directories such as uploads, caches, upgrades, and backup trees where appropriate.
Filters file types and avoids hashing oversized files.
Stores normalized relative paths rather than exposing absolute hosting paths in distributable plugin data.
Supports a manual integrity scan from the dashboard.
Daily file-integrity scanning can be enabled or disabled by the administrator.

Bounded Local Malware Scanner

The malware scanner performs local PHP signature analysis and is intentionally non-destructive. A signature hit is treated as an indicator that deserves administrator review — not automatic proof that a file is malware.

Scans PHP files only.
Skips symlinks.
Skips files larger than the scanner's safety limit.
Skips uploads, caches, upgrades, backups, node modules, and Omega's protected security-data directory.
Processes a bounded maximum number of files per scan.
Records suspicious files and the signature names that triggered review.
Can optionally email the WordPress administrator when findings are recorded.
Does not automatically delete, quarantine, overwrite, or remotely replace files.

Security Headers & Hardening Controls

Version 2.0.0 makes hardening behavior settings-aware rather than silently forcing site-wide decisions. Compatibility-sensitive controls remain under administrator control.

Standard Security Headers

When enabled, Omega sends X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy.

HSTS — Opt-In

HSTS is off by default and should be enabled only after HTTPS is permanently correct. The PHP layer emits HSTS without the irreversible preload directive.

CSP — Opt-In

Custom Content-Security-Policy output is off by default because an untested policy can break analytics, editors, embeds, integrations, and checkout flows.

REST Restriction — Opt-In

Omega can require authentication for the REST API, but the option is off by default because block editors, headless sites, and integrations may depend on REST.

XML-RPC Control

XML-RPC can be disabled through the plugin setting, including removal of the X-Pingback response header.

Author Enumeration Control

Can block unauthenticated numeric author-enumeration requests without applying the rule to logged-in administrators.

File Editor Control

Can disable the built-in WordPress theme/plugin file editor through DISALLOW_FILE_EDIT without forcing DISALLOW_FILE_MODS.

HTTPS Redirect — Opt-In

Can redirect ordinary frontend requests to HTTPS while avoiding admin and AJAX redirect paths.

Optional .htaccess Hardening

On supported writable Apache/LiteSpeed environments, Omega can add a dedicated marker block using WordPress's marker-management API. It does not replace the normal WordPress rewrite block.

Adds selected server-level security headers.
Disables directory indexing.
Blocks direct access to sensitive files such as .env, wp-config.php, debug logs, and WordPress readme/license files.
Blocks PHP execution from the WordPress uploads path.
Can block xmlrpc.php when XML-RPC disabling is enabled.
Can be applied and removed from the Omega Security dashboard.
Requires a supported, writable .htaccess environment.

Protected Local Storage

Security state is not stored inside the plugin installation directory. Version 2.0.0 stores mutable security data under a protected wp-content/omega-security-engine-data/ directory so plugin replacement or updates do not package production incident history with the plugin itself.

Centralized JSON storage.
Locked temporary writes followed by atomic replacement.
Local firewall/log/IP/login/integrity/malware state.
No production logs or integrity snapshots distributed inside the plugin ZIP.
No cloud security-state database required.

Low Normal-Request Overhead

The 2.0.0 architecture separates heavyweight diagnostic work from ordinary page delivery.

No cloud security calls during runtime.
No telemetry.
No malware scan during ordinary page views.
No full file-integrity scan on every request.
No front-end CSS/JavaScript optimization or rewriting.
No global removal of WordPress script/style cache-busting versions.
Omega admin CSS/JavaScript loads only on the Omega Security administration screen.

Scheduled Security Tasks

Lightweight maintenance and heavier malware analysis are intentionally separated.

Task	Schedule	Control
Security maintenance / cleanup	Daily	Automatic plugin maintenance
File integrity monitoring	Daily when enabled	Administrator configurable
Malware signature scan	Weekly when enabled	Administrator configurable

WordPress Dashboard

Omega Security Engine Pro 2.0.0 includes one scoped black-and-gold WordPress administration interface. Privileged settings and security actions require the manage_options capability and WordPress nonces.

Dashboard

Security configuration score, firewall/login/header/file-monitor state, malware schedule status, SSL state, PHP/WordPress versions, storage status, and blocked-IP count.

Settings

Firewall, login protection, XML-RPC, REST, enumeration, file editor, headers, HTTPS, HSTS, CSP, scheduled scans, email findings, proxy trust, and lockout/block timing.

Scanners

Run manual file-integrity and malware scans and review the latest counts and suspicious scanner indicators.

IP Manager

Allow, block, remove, and unblock validated IP addresses from WordPress administration.

Hardening

Review safety guidance and apply/remove optional Omega .htaccess marker rules on supported servers.

Logs

Review recent local security events and clear the event log through a nonce-protected administrator action.

Default Security Configuration

Control	Default
Application firewall	Enabled
Brute-force login protection	Enabled
Failed attempts before lockout	5
Lockout duration	30 minutes
Disable XML-RPC	Enabled
Require login for REST API	Disabled
Block numeric author enumeration	Enabled
Disable theme/plugin file editor	Enabled
Security headers	Enabled
Force frontend HTTPS	Disabled
HSTS	Disabled
Custom CSP	Disabled
Daily file integrity scan	Enabled
Weekly malware scan	Enabled
Email malware findings	Disabled
Trust proxy IP headers	Disabled
Manual block TTL	7 days

Compatibility & Safety Decisions in 2.0.0

Version 2.0.0 deliberately avoids silently forcing security choices that can interfere with WordPress, page builders, commerce, APIs, proxies, analytics, embeds, or site maintenance.

HSTS is off by default.
CSP is off by default.
REST authentication restriction is off by default.
HTTPS redirection is off by default.
Proxy-header trust is off by default.
The plugin never forces DISALLOW_FILE_MODS.
The plugin never rewrites WP_DEBUG.
The plugin never changes FORCE_SSL_ADMIN.
WordPress script/style version query strings are preserved for correct cache invalidation.
Normal admin/AJAX requests receive additional firewall safeguards to reduce false-positive disruption.
Malware findings are reported for human review rather than automatically destroying files.

What Version 2.0.0 Does Not Do

Security product pages should distinguish implemented protection from functions the engine intentionally does not perform.

Does not perform cloud malware scanning.
Does not require a cloud firewall service.
Does not send telemetry as part of its security engine.
Does not remotely fetch replacement files.
Does not automatically delete suspicious files.
Does not automatically quarantine suspicious files.
Does not automatically overwrite suspicious files.
Does not silently enable HSTS preload.
Does not force DISALLOW_FILE_MODS, FORCE_SSL_ADMIN, or WP_DEBUG.
Does not strip WordPress asset-version query strings.

Technical Specifications

Plugin Version: 2.0.0
Requires WordPress: 6.0 or newer
Tested up to: WordPress 7.0
Requires PHP: 7.4 or newer
Security Model: local-first WordPress application security
Firewall: immediate application firewall during plugin bootstrap
Login Protection: configurable temporary IP lockouts
Security Storage: protected local wp-content/omega-security-engine-data/
Storage Writes: centralized locked temporary writes with atomic replacement
Malware Scanner: bounded local PHP signature scanning
Integrity Monitor: local snapshots using normalized relative paths and safe traversal
Server Hardening: optional Apache/LiteSpeed .htaccess marker rules when supported
Administrator Authorization: manage_options plus WordPress nonces for privileged actions
Cloud Security Calls: none required
Telemetry: none required by the engine

How To Install & Configure 2.0.0

Back up your WordPress site and database.
Purchase and download the Omega Security Engine Pro 2.0.0 ZIP package.
In WordPress, open Plugins > Add New > Upload Plugin.
Upload the ZIP, install it, and activate Omega Security Engine Pro.
Open Omega Security in the WordPress dashboard.
Review the default security settings and confirm the options appropriate for your environment.
Run one manual File Integrity Scan to establish the local baseline.
Run one manual Malware Scan to establish the first scanner state.
Enable HSTS, CSP, REST restriction, forced HTTPS, trusted proxy headers, or optional .htaccess hardening only after testing them against your exact hosting/theme/plugin stack.

Frequently Asked Questions

Does the firewall run during Omega plugin bootstrap?

Yes. Version 2.0.0 invokes the application firewall directly during Omega's plugin bootstrap rather than registering an already-passed hook priority.

Does Omega use cloud malware scanning?

No. The malware scanner operates locally on the WordPress server and does not require remote scanning APIs.

Does Omega automatically delete malware?

No. Signature hits are indicators for administrator review. Version 2.0.0 does not automatically delete, quarantine, overwrite, or remotely replace files.

Are login lockouts permanent firewall blocks?

No. Brute-force login lockouts are temporary records with a lockout expiration. Manual/firewall IP blocks are managed separately.

Does it trust Cloudflare or X-Forwarded-For automatically?

No. Omega uses REMOTE_ADDR by default. Trusted proxy headers are an explicit administrator option intended only for known trusted proxy environments.

Is HSTS enabled automatically?

No. HSTS is off by default and should be enabled only after HTTPS is permanently correct for the site.

Is Content-Security-Policy enabled automatically?

No. CSP is off by default. Administrators can configure and enable a policy only after testing it with the site's theme, plugins, analytics, embeds, and commerce flows.

Does REST restriction run by default?

No. Requiring authentication for the REST API is off by default because many WordPress integrations depend on REST.

Does it force WordPress update restrictions?

No. Version 2.0.0 never forces DISALLOW_FILE_MODS, FORCE_SSL_ADMIN, or WP_DEBUG.

Does it support manual file-integrity and malware scans?

Yes. Both scanners can be run manually from the WordPress dashboard, with scheduled integrity and malware tasks separately configurable.

Can Omega add server-level .htaccess rules?

Yes, on supported writable Apache/LiteSpeed environments. Omega inserts only its own marker block and provides dashboard actions to apply or remove those rules.

Does it alter front-end CSS or JavaScript?

No. Omega Security Engine Pro 2.0.0 does not perform front-end CSS/JS optimization or strip WordPress asset-version query strings.

Related Engines & Resources

Omega Security Engine Pro can be used independently or alongside the other Omega WordPress engines.

Purchase Omega Security Engine Pro 2.0.0

Get the current Omega Security Engine Pro 2.0.0 release with a local application firewall, temporary brute-force protection, validated IP controls, local integrity monitoring, bounded PHP malware scanning, settings-aware hardening, security headers, scheduled maintenance, and WordPress dashboard diagnostics.

Buy — Unlimited Sites (Lifetime)

Docs Index Features Installation Setup Guide FAQ Troubleshooting Security Headers Guide