Is this product sold separately?
Yes. This is an individual OmegaWebApps product priced at US$89 one-time. It is not sold as a required suite or subscription.
WORDPRESS PLUGIN · VERSION 2.0.0 · INDIVIDUAL PRODUCT
Omega Security Engine Pro
Separate OmegaWebApps commercial product: This product is sold and installed independently for customer websites. It is distinct from the integrated engine components used within the Omega Web Pro website-generation and quality pipeline.
Local-first WordPress firewall, login protection, integrity monitoring and malware indicators with restrained defaults.
A WordPress security plugin with application firewall, brute-force/login protection, IP controls, integrity monitoring, PHP malware scanning and optional hardening. Persistent security state is stored in protected wp-content storage rather than inside the plugin package.
OmegaWebApps product distinction: This is a separately sold, separately installed OmegaWebApps commercial product for customer websites. It is not the integrated engine component used internally within the Omega Web Pro website-generation pipeline at omegawebpro.com.
US$89one-time · lifetime licence for the purchased version · unlimited sites
Sold separately. No subscription or recurring licence fee. Stripe checkout. Product terms apply.
PURCHASE FAQ
Key commercial questions before checkout.
How many websites can I use the purchased version on?
The commercial offer provides a lifetime licence for the purchased version for unlimited websites/client sites, subject to the Terms & Licence and applicable open-source rights.
Does the core engine require a cloud account?
No. The product is designed around local/server-side operation for its core functions. Third-party hosting, browsers and platform components still behave according to their own environments.
Are results guaranteed?
No. The engine provides the functions described on this page, but outcomes such as rankings, page-speed scores, security immunity, browser metrics or universal compatibility depend on factors outside the software itself.
DOCUMENTATION
Installation, setup, features, troubleshooting and support.
The product documentation expands the operational details on this commercial page, including installation, configuration, feature use, troubleshooting and support guidance.
WHO IT IS FOR
Designed for website owners, developers and agencies who want direct control.
Omega Security Engine Pro is intended for operators who want a focused specialist engine for WordPress Plugin rather than an all-in-one subscription platform. The licence model makes the purchased version suitable for repeated use across the buyer’s own and client sites, while the product remains independently installable and separately sold.
TECHNICAL BOUNDARIES
Clear limits are part of a serious commercial specification.
- No WordPress security plugin can guarantee prevention/detection of every attack.
- Server/WAF/CDN/hosting security remains part of the overall security model.
- CSP/HSTS/REST/proxy settings are environment-sensitive and must be tested before production use.
LOCAL-FIRST ARCHITECTURE
Your engine runs where your website runs.
The core functions described on this page are designed to operate locally on the customer website/server rather than requiring an OmegaWebApps cloud processing subscription. This reduces dependency on remote processing services and keeps operational state under the website owner’s control, subject to the hosting/platform environment.
SAFETY & CONTROL MODEL
Built to make high-impact actions deliberate.
HSTS and CSP are off by default.
REST restriction is off by default.
Proxy IP headers are ignored unless explicitly trusted.
Malware findings do not trigger automatic deletion/healing.
DISALLOW_FILE_MODS, FORCE_SSL_ADMIN and WP_DEBUG are not forced.
Asset version query strings are preserved.
Admin actions require capabilities and nonces.
OPERATING WORKFLOW
From installation to production use.
- Back up the WordPress site/database and install/activate the plugin.
- Open Omega Security and review settings before enabling high-impact hardening.
- Configure IP handling, login protection and optional firewall/hardening controls.
- Run a manual File Integrity scan/baseline.
- Run the malware scan and review indicators.
- Enable HSTS, CSP, REST restriction, HTTPS redirect or proxy headers only when the site environment has been tested for them.
- Review security logs and scheduled maintenance behavior.
DETAILED FUNCTION SPECIFICATION
Technical depth for buyers who want to know exactly what they are purchasing.
Core processing & operation
- Local Application Firewall: Inspects relevant request URI/payload signals early in WordPress bootstrap and can block configured malicious request patterns.
- Malicious URI Detection: Evaluates suspicious URI patterns used by common exploit/scanning requests.
- Malicious Payload Detection: Evaluates request payload signals for configured attack indicators.
- Validated Client IP Handling: Normalizes/validates IP addresses before applying allow/block/security logic.
- IP Block List: Administrators can manually block validated IP addresses and later unblock them.
- IP Allow List: Administrators can allow trusted IPs and remove allow entries.
- Safe Proxy Header Opt-In: Proxy-derived client IP headers are ignored unless the administrator explicitly enables/trusts that model.
- Brute-Force / Login Guard: Tracks failed login attempts and applies temporary lockout behavior without permanently polluting the manual block list.
- Successful Login Reset Logic: Updates login-protection state appropriately after successful authentication.
- Expired Lockout Cleanup: Scheduled cleanup removes expired temporary security state.
- File Integrity Baseline/Scan: Calculates trusted hashes and reports file changes through manual integrity scanning.
Management, automation & diagnostics
- Manual Malware Scan: Scans eligible PHP/site files for configured malware/signature indicators for administrator review.
- No Automatic File Healing: Findings do not trigger automatic overwrite or deletion of site files.
- Protected Security Data Directory: Persistent state lives under wp-content/omega-security-engine-data rather than inside the plugin folder.
- Atomic Locked JSON Storage: Security state uses locked/atomic file writes to reduce race/partial-write problems.
- Optional Security Headers: Can send configured hardening headers through WordPress when enabled.
- HSTS Opt-In: HTTP Strict Transport Security remains off by default and requires deliberate activation.
- CSP Opt-In: Content Security Policy remains off by default because it must be tested against the site’s real resources.
- HTTPS Redirect Option: Optional HTTPS enforcement/redirect behavior under administrator control.
- XML-RPC / Pingback Controls: Includes controls that can reduce XML-RPC/pingback exposure where appropriate.
- Author Enumeration Protection: Can block common author-enumeration request patterns.
- Optional REST Restriction: REST restriction is off by default because many WordPress integrations depend on REST; it can be enabled deliberately.
Safety, integration & lifecycle
- Root .htaccess Hardening: Can install/remove managed WordPress-root hardening rules where supported.
- No Forced DISALLOW_FILE_MODS: Does not force WordPress file modification constants at runtime.
- No Forced FORCE_SSL_ADMIN/WP_DEBUG: Does not override these site-level constants/settings at runtime.
- Asset Version Preservation: Does not globally strip script/style version query strings, preserving cache invalidation semantics.
- Security Logs: Maintains local security event history for dashboard review.
- Optional Security Email Notifications: Includes notification support for configured security events/maintenance where applicable.
- Scheduled Maintenance: Registers recurring cleanup/scan maintenance tasks in addition to manual scans.
- Capability & Nonce Protection: Administrative actions require appropriate WordPress capability checks and nonces.
- Scoped Admin Assets: Admin interface assets are limited to Omega Security screens.
- Accessible Dashboard Tabs: The rebuilt dashboard organizes settings/scans/logs in accessible tabbed administration.
- Local-First Operation: No cloud scanning subscription, telemetry stream or vulnerability-service API key is required.
COMPLETE COMMERCIAL CAPABILITY MAP
Every meaningful customer-facing capability in this 2.0.0 engine.
This section maps the implemented product functions into buyer-facing capabilities. Internal helper methods are not exposed as marketing clutter; the real operations, controls, workflows and safeguards they implement are represented below.
Local Application Firewall
Inspects relevant request URI/payload signals early in WordPress bootstrap and can block configured malicious request patterns.
Malicious URI Detection
Evaluates suspicious URI patterns used by common exploit/scanning requests.
Malicious Payload Detection
Evaluates request payload signals for configured attack indicators.
Validated Client IP Handling
Normalizes/validates IP addresses before applying allow/block/security logic.
IP Block List
Administrators can manually block validated IP addresses and later unblock them.
IP Allow List
Administrators can allow trusted IPs and remove allow entries.
Safe Proxy Header Opt-In
Proxy-derived client IP headers are ignored unless the administrator explicitly enables/trusts that model.
Brute-Force / Login Guard
Tracks failed login attempts and applies temporary lockout behavior without permanently polluting the manual block list.
Successful Login Reset Logic
Updates login-protection state appropriately after successful authentication.
Expired Lockout Cleanup
Scheduled cleanup removes expired temporary security state.
File Integrity Baseline/Scan
Calculates trusted hashes and reports file changes through manual integrity scanning.
Manual Malware Scan
Scans eligible PHP/site files for configured malware/signature indicators for administrator review.
No Automatic File Healing
Findings do not trigger automatic overwrite or deletion of site files.
Protected Security Data Directory
Persistent state lives under wp-content/omega-security-engine-data rather than inside the plugin folder.
Atomic Locked JSON Storage
Security state uses locked/atomic file writes to reduce race/partial-write problems.
Optional Security Headers
Can send configured hardening headers through WordPress when enabled.
HSTS Opt-In
HTTP Strict Transport Security remains off by default and requires deliberate activation.
CSP Opt-In
Content Security Policy remains off by default because it must be tested against the site’s real resources.
HTTPS Redirect Option
Optional HTTPS enforcement/redirect behavior under administrator control.
XML-RPC / Pingback Controls
Includes controls that can reduce XML-RPC/pingback exposure where appropriate.
Author Enumeration Protection
Can block common author-enumeration request patterns.
Optional REST Restriction
REST restriction is off by default because many WordPress integrations depend on REST; it can be enabled deliberately.
Root .htaccess Hardening
Can install/remove managed WordPress-root hardening rules where supported.
No Forced DISALLOW_FILE_MODS
Does not force WordPress file modification constants at runtime.
No Forced FORCE_SSL_ADMIN/WP_DEBUG
Does not override these site-level constants/settings at runtime.
Asset Version Preservation
Does not globally strip script/style version query strings, preserving cache invalidation semantics.
Security Logs
Maintains local security event history for dashboard review.
Optional Security Email Notifications
Includes notification support for configured security events/maintenance where applicable.
Scheduled Maintenance
Registers recurring cleanup/scan maintenance tasks in addition to manual scans.
Capability & Nonce Protection
Administrative actions require appropriate WordPress capability checks and nonces.
Scoped Admin Assets
Admin interface assets are limited to Omega Security screens.
Accessible Dashboard Tabs
The rebuilt dashboard organizes settings/scans/logs in accessible tabbed administration.
Local-First Operation
No cloud scanning subscription, telemetry stream or vulnerability-service API key is required.
PRODUCT OVERVIEW
What Omega Security Engine Pro is built to do.
A local-first WordPress security plugin with application firewall controls, login protection, IP management, integrity monitoring, PHP malware indicators, optional hardening and protected local security storage. Version 2.0.0 deliberately keeps high-impact controls opt-in and avoids unsafe automatic file healing.
COMMERCIAL LICENCE
One product. One-time payment. Clear version scope.
US$89 one-time
No recurring licence charge for continued use of the purchased version.
Lifetime use of purchased version
Future major versions are not automatically promised unless expressly included in the offer.
Unlimited sites
Use is subject to the Terms & Licence and any open-source rights that apply to covered components.
Need the other platform edition or a different specialist engine?
Compare all ten products by platform, job, safety model and technical boundaries.