Silent Threads docs
Installing, activating and getting the most from every part of the plugin.
Getting started
Requirements
| WordPress | 6.4 or newer (tested up to 7.1) |
|---|---|
| PHP | 7.4 or newer |
| Network | Outbound HTTPS from your server, for license checks, updates and the live feeds |
Install the plugin
- Download the plugin zip from the download page and, if you like, check its SHA-256 checksum.
- In WordPress admin, go to Plugins → Add New → Upload Plugin and choose the zip.
- Click Activate. The activation pop-up appears.
Activate your license
The activation pop-up gives you two options:
- I already have a license key. Paste it and click Activate. The plugin contacts our licensing server directly and binds the key to your site.
- I'm new. This opens the pricing page with your site's address attached. Pick a plan and enter your email, and we email you a key with a link back into your WordPress admin.
Opening that link only shows you the key. You still click Activate now in WordPress yourself, so a link on its own can never bind anything to your site.
Trial
Every new license starts with a 30-day trial with every premium feature unlocked. If the trial ends without a paid plan, protection stops until you choose one. Your settings and scan history are kept.
Licenses and sites
Each license covers a set number of sites: Basic 1, Pro 3, Agency 10. To move a license, deactivate it on the old site first, either in the plugin or from your account, then activate it on the new site. If you are already at your limit, activating another site is refused; an existing site is never removed automatically.
Your account
Sign in at /account with a one-time link sent to your email (no password). There you can see your licenses, copy keys, deactivate sites and have the license email sent again.
Scanning
Scan modes
| Mode | Available on |
|---|---|
| Quick | every plan |
| Standard | every plan |
| Deep | Pro and Agency |
| Custom folders | Agency |
Scans use 74 built-in malware signatures plus live signatures from the cloud feed.
Scanners by plan
Every plan: Malware Scanner (Quick & Standard), Vulnerability Scanner, Database Scanner, Configuration Scanner, Attack Surface Scanner, Persistence Scanner and Core File Integrity.
Pro adds: Deep & Full Malware Scans, Secret Scanner, Media File Scanner, JS & Card-Skimmer Scanner, Bundled JS Dependency Scan, Premium Plugin Drift, Live CVE Correlation and Runtime Malware Detection.
Agency adds: Custom Folder Scan.
Firewall
Web Application Firewall
The firewall runs on every plan with 356 built-in rules. Live WAF rules from the cloud feed are added on top: immediately on Pro and Agency, 30 days after release on Basic.
A new live rule always starts in report-only mode and only blocks once it has run in the wild without false positives.
Brute-force protection and rate limiting
Included on every plan. Repeated failed logins and abusive request rates are detected and blocked.
Rules Manager, Sandbox and Progressive Response
On Pro and Agency, the WAF Rules Manager gives fine-grained control over individual rules, the WAF Rule Sandbox lets you test custom rules against real traffic before enabling them, and Progressive WAF Response escalates the firewall's response automatically under sustained attack.
Country blocking and outbound monitoring
Pro and Agency include Country Blocking (block or allow traffic by country) and the Outbound Connection Monitor, which watches outbound connections from your site for signs of compromise.
Login security
Two-factor authentication
Two-factor authentication is included on every plan, together with a strong password policy and suspicious-username blocking.
Login controls on Pro
Pro adds Custom Login URL, Login reCAPTCHA, Bot Login Detection, Registration Abuse Prevention, a New-User Approval Queue and Canary Credentials (decoy credentials that alert you the moment they are used).
Session controls on Agency
Agency adds New-Device Login Approval, Session Fingerprinting, Active Session Monitoring, Step-Up Verification and Auto-Suspend Rogue Admins.
Hardening
One-click hardening
Every plan includes 16 hardening checks, and each one can be applied in one click.
Security Baseline
On Pro and Agency, the Security Baseline tracks drift from your site's known-good security state.
Cloud protection
Live signatures and rules
Live malware signatures and live WAF rules: Pro and Agency sites get them immediately; Basic sites get each one 30 days after release.
Every new live rule starts in report-only mode and only blocks after it has run in the wild without false positives.
Network IP Blocklist
Network IP Blocklist (Pro and Agency): an IP is listed only after several different sites have reported it. Search engines and CDNs are never listed.
Your own login IPs, your trusted IPs and logged-in administrators are never blocked by the network list.
Entries expire automatically.
Help protect other sites
“Help protect other sites” is opt-in and off by default. It shares only IPs your site already blocked, plus the rule IDs that blocked them.
Turning it off stops new reports immediately. Reports already sent are deleted on the normal 30-day schedule.
Alerts & support
Email alerts
Every plan includes a weekly security email digest and an instant alert when a new administrator is added. Pro and Agency can set a custom email alert schedule.
Getting support
Pro includes support tickets and Agency adds live chat. When we reply, the plugin shows a bell notification and a pop-up. On any plan you can also use the contact form.
Multi-Site Hub (Agency)
Agency licenses cover up to 10 sites. The Multi-Site Hub manages them from one view, and cross-site threat intelligence shares attack signals between them.
Troubleshooting
When a license check fails
The plugin checks in roughly every 12 hours. If the check really fails (the license expired or was suspended, or a payment did not go through), protection stops and WordPress admin tells you why.
If our server is just unreachable, the plugin keeps running on its last known-good license state for a short offline grace window first.
License email not arriving
License and sign-in emails are sent by our server, not by your WordPress site, so your site's mail settings don't affect them. Check your spam folder, then use your account to have the email sent again, or contact us. If an email can't be sent, the pricing page says so, and no license is created half-way.
Updates
Updates are delivered through WordPress's normal update screen. Every update package is Ed25519-signed and the plugin refuses one whose signature doesn't verify. See the changelog for what changed.