How a WordPress security plugin works, from install to blocked attack
This is how a WordPress security plugin works, using Silent Threads as the example: you install and activate it, it checks in about every 12 hours, filters each request through its firewall, scans files and the database, and alerts you. New rules arrive as signed feeds, and opt-in sites share blocked IPs.
Select any step below to see what happens there. The arrow keys move between steps.
Main flow: from install to a blocked attack
Install
Upload the plugin zip in WordPress (Plugins → Add New → Upload) and activate it. An activation pop-up appears.
Upload the plugin zip in WordPress (Plugins → Add New → Upload) and activate it. An activation pop-up appears.
Paste the license key we emailed you, or follow the pop-up to pick a plan. The license is bound to your site; you always click “Activate” yourself.
About every 12 hours the plugin checks its license and asks for updates. Each request from your site is individually signed and sent over HTTPS.
The firewall checks incoming requests against 356 built-in rules plus any live rules, and brute-force protection and rate limiting watch the login page.
Scans check files, the database and configuration against 74 built-in signatures plus live signatures.
You get an instant email when a new administrator appears, a weekly security digest, and the findings in WordPress admin.
Review the findings, apply hardening in one click, and on higher plans let progressive WAF response and incident playbooks act for you.
Cloud lane: new protection, delivered signed
New threat
We write a new malware signature or WAF rule.
We write a new malware signature or WAF rule.
The feed is signed with our Ed25519 key.
Pro and Agency sites receive it immediately; Basic sites receive it 30 days after release.
The plugin checks the signature and refuses any feed that does not verify.
A new live rule first runs in report-only mode, recording what it would have blocked.
Only after it has run in the wild without false positives does the rule start blocking.
Network lane: the opt-in IP blocklist
Opt in
“Help protect other sites” is off by default. When you turn it on, your site shares only the IPs it already blocked and the rule IDs that blocked them.
“Help protect other sites” is off by default. When you turn it on, your site shares only the IPs it already blocked and the rule IDs that blocked them.
An IP is listed only after several different sites have reported it. Search engines and CDNs are never listed.
The signed list goes to Pro and Agency sites.
Your own login IPs, your trusted IPs and logged-in administrators are never blocked by the network list, and entries expire automatically.
Trust lane: why you can rely on what arrives
Signed updates
Every plugin update package is Ed25519-signed.
Every plugin update package is Ed25519-signed.
The plugin verifies the signature before installing an update.
The plugin checks its own files against a signed manifest and stops if they have been modified.
The plugin never sends your posts, files or passwords. The only visitor data it sends is the IP address of requests it identified as attacks.