Title: Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA) & Malware Protection Author: lunexiait Published: 16 de mayo de 2026 Last modified: 13 de septiembre de 2026 --- Buscar plugins ![](https://ps.w.org/lunexia-htaccess-shield/assets/banner-772x250.png?rev=3693517) ![](https://ps.w.org/lunexia-htaccess-shield/assets/icon-256x256.png?rev=3693517) # Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA) & Malware Protection Por [lunexiait](https://profiles.wordpress.org/lunexiait/) [Descargar](https://downloads.wordpress.org/plugin/lunexia-htaccess-shield.3.2.2.zip) * [Detalles](https://es-ar.wordpress.org/plugins/lunexia-htaccess-shield/#description) * [Valoraciones](https://es-ar.wordpress.org/plugins/lunexia-htaccess-shield/#reviews) * [Instalación](https://es-ar.wordpress.org/plugins/lunexia-htaccess-shield/#installation) * [Desarrollo](https://es-ar.wordpress.org/plugins/lunexia-htaccess-shield/#developers) [Soporte](https://wordpress.org/support/plugin/lunexia-htaccess-shield/) ## Descripción **Lunexia Security & .htaccess Shield** is an all-in-one WordPress security suite engineered to defend your website against attacks, malicious bots, unauthorized login attempts, and malware infections. Combining proven **.htaccess server hardening**, an intelligent **Web Application Firewall (WAF)**, **Two-Factor Authentication ( 2FA / OTP login protection)**, **login brute force defense**, and a deep **malware scanner with 1-click quarantine**, Lunexia provides comprehensive website security that is ultra-lightweight, safe, and fully compatible with WordPress 7.0 Modern admin and PHP 8+. Whether you need rock-solid login protection, two-factor authentication, malware removal, or instant .htaccess security headers, Lunexia delivers enterprise-grade protection with zero bloat. ### 🛡️ Key Security Features: * **Two-Factor Authentication (2FA) & OTP Login Security**: Add time-based one- time password (OTP) verification for Administrators, Editors, and custom roles. Protect your login forms from credential stuffing and unauthorized access. * **Login Brute Force Protection**: Detect, limit, and automatically block malicious IP addresses attempting brute force login attacks. * **Web Application Firewall (WAF)**: Real-time inspection for SQL Injection (SQLi), Cross-Site Scripting (XSS), Local File Inclusion (LFI), and Remote Code Execution( RCE) attempts without breaking page builders like Elementor or Gutenberg. * **Malware Scanner & Threat Detection**: Deep file integrity and heuristic scanner to detect webshells, backdoors, obfuscated base64 code, eval injections, and unauthorized core file modifications. * **1-Click Quarantine & Cleanup**: Instantly isolate infected files into a safe, non-executable quarantine vault with full 1-click restoration and permanent deletion controls. * **Automatic .htaccess Hardening**: Safely apply proven Apache/LiteSpeed security rules with automatic timestamped backups before every change. * **Admin Approval Workflow**: Require administrator approval for newly registered administrative and editor accounts before they can log in. * **Backend Access Control**: Restrict access to `wp-admin` and `wp-login.php` exclusively to trusted, whitelisted IP addresses. * **Security Headers Protection**: Automatically enforce Content Security Policy( CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, and Referrer-Policy. * **Live Traffic Monitor & IP Reputation**: Real-time traffic surveillance tracking visitor requests, malicious bots, automated crawlers, and blocked threat origins. * **Modern WordPress 7.0 Ready**: Centered layout, high-DPI retina interface, and modern glassmorphic dashboard widgets. ### 🔒 Security Rules Included: * Disable directory browsing and file listing (`Options -Indexes`) * Protect `wp-config.php` database credentials and `.htaccess` configuration files * Block direct web access to sensitive files (`.bak`, `.sql`, `.log`, `.ini`, `. sh`, `.env`) * Disable XML-RPC (`xmlrpc.php`) to block pingback DDoS and brute force amplifications * Prevent unauthorized PHP script execution in the `wp-content/uploads/` directory * Block malicious query string injections, GLOBALS variable overrides, and script tags * Block author enumeration attacks (`?author=1`) to prevent username discovery * Enforce essential HTTP security headers (XSS Protection, No-Sniff, HSTS, Frame Guard) ### ⚡ Safe, Non-Destructive & Reliable: * Automatically creates a backup before applying any file modifications. * Uses native WordPress filesystem APIs for maximum server compatibility. * All generated rules are cleanly encapsulated in custom markers for 1-click restore. * Seamless compatibility with Elementor, Gutenberg, WooCommerce, and caching plugins. ### External Services This plugin connects to external services as follows: **Lunexia License Authority (api.lunexiait.com)** This plugin connects to the Lunexia central license server to validate commercial license authenticity, verify cryptographic Ed25519 tokens, and check domain bindings. This connection is used when activating, validating, or deactivating a license key in the plugin dashboard. * **Purpose**: Validates license authenticity, cryptographic tokens, and domain licensing. * **When it’s used**: When activating, validating, or deactivating an enterprise license. * **What data is sent**: License key, website URL/domain, verification nonces, PHP and WordPress version numbers. * **Service provider**: Lunexia IT (api.lunexiait.com) * **Terms of Service**: https://lunexiait.com/terms/ * **Privacy Policy**: https://lunexiait.com/privacy/ ## Instalación 1. Upload the `lunexia-htaccess-shield` folder to the `/wp-content/plugins/` directory( or search for **Lunexia Security** in **Plugins > Add New**). 2. Activate the plugin through the **Plugins** menu in WordPress. 3. Navigate to **Lunexia Security** in your WordPress admin menu. 4. Review and toggle your desired security rules and login protection features. 5. Click **Save & Apply Rules** to instantly harden your site. ## Preguntas frecuentes ### How does the Two-Factor Authentication (2FA) and Login Protection work? Lunexia adds OTP (one-time password) verification during login for selected user roles (such as Administrator and Editor). When enabled, users must enter a secure verification code sent to their registered email address before gaining dashboard access, effectively stopping unauthorized logins even if passwords are leaked. ### Does this plugin work with Elementor and Gutenberg? Yes! Lunexia includes intelligent page builder detection. Firewall inspection automatically accommodates Elementor editor previews, AJAX widget saving, and REST API publishing without false positives or 403 blocks. ### How does the Malware Quarantine Manager work? When the malware scanner detects a suspicious file or backdoor, you can quarantine it with a single click. The file is immediately moved into a secure, isolated quarantine directory with revoked execution permissions (`0400`) and blocked from direct browser access. You can restore the file to its original location or delete it permanently at any time. ### Is this plugin safe for my server? Yes. Lunexia automatically creates timestamped backups of your `.htaccess` file prior to applying any rule changes. If needed, you can restore your configuration with one click from the plugin dashboard. ### Does this replace other security plugins? Lunexia can be used as your primary lightweight security shield or alongside complementary tools. Its low memory footprint and server-level rules provide exceptional performance without slowing down your site. ## Reseñas No hay reseñas para este plugin. ## Colaboradores y desarrolladores “Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA) & Malware Protection” es un software de código abierto. Las siguientes personas han colaborado con este plugin. Colaboradores * [ lunexiait ](https://profiles.wordpress.org/lunexiait/) [Traduce “Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA) & Malware Protection” a tu idioma.](https://translate.wordpress.org/projects/wp-plugins/lunexia-htaccess-shield) ### ¿Interesado en el desarrollo? [Revisa el código](https://plugins.trac.wordpress.org/browser/lunexia-htaccess-shield/), echa un vistazo al [repositorio SVN](https://plugins.svn.wordpress.org/lunexia-htaccess-shield/), o suscríbete al [log de desarrollo](https://plugins.trac.wordpress.org/log/lunexia-htaccess-shield/) por [RSS](https://plugins.trac.wordpress.org/log/lunexia-htaccess-shield/?limit=100&mode=stop_on_copy&format=rss). ## Registro de cambios #### 3.2.2 * Enhanced dual-mode cryptographic token verification supporting both 64-byte Sodium Ed25519 and 32-byte HMAC-SHA256 signatures. * Added staging and local domain normalization (.local, .test, localhost) for seamless local development. * Fixed Lifetime enterprise license status persistence and renewal status indicators. * Polished Midnight Obsidian administrative interface with dynamic cache-busting asset versions. #### 3.2.1 * Upgraded license authority client to `api.lunexiait.com` with Ed25519 cryptographic token verification and anti-tampering protection. * Added 1-click malware quarantine, file restoration, and permanent file deletion actions. * Added live Quarantine Manager dashboard table displaying isolated files and file metadata. * Fixed Elementor editor preview canvas and REST publishing false positives in Web Application Firewall (WAF). * Fixed HTTP method restrictions to preserve REST API and Elementor `DELETE` operations. * Added official high-DPI WordPress.org banners (1544×500, 772×250) and square icons (256×256, 128×128). * SEO optimized title, keywords, and description for security, login, two factor, firewall, and malware searches. #### 3.0.0 * Redesigned dashboard with four separate protection score widgets and modern admin visuals. * Added premium badges to Firewall, Malware Scan, and Advanced Settings navigation tabs. * Added Security Intelligence and Threat Center dashboards for malware, reputation, and threat intelligence visibility. * Centered plugin layout with an 80% width wrapper for a cleaner WordPress 7.0 admin experience. ## Meta * Versión **3.2.2** * Última actualización **hace 1 mes** * Instalaciones activas **Menos de 10** * Versión de WordPress ** 5.0 o superior ** * Testeado hasta **7.0.7** * Versión de PHP ** 7.4 o superior ** * Idioma * [English (US)](https://wordpress.org/plugins/lunexia-htaccess-shield/) * Etiquetas: * [firewall](https://es-ar.wordpress.org/plugins/tags/firewall/)[login](https://es-ar.wordpress.org/plugins/tags/login/) [malware](https://es-ar.wordpress.org/plugins/tags/malware/)[security](https://es-ar.wordpress.org/plugins/tags/security/) [two factor](https://es-ar.wordpress.org/plugins/tags/two-factor/) * [Vista avanzada](https://es-ar.wordpress.org/plugins/lunexia-htaccess-shield/advanced/) ## Valoraciones Todavía no se enviaron reseñas. [Your review](https://wordpress.org/support/plugin/lunexia-htaccess-shield/reviews/#new-post) [Ver todas las reseñas](https://wordpress.org/support/plugin/lunexia-htaccess-shield/reviews/) ## Colaboradores * [ lunexiait ](https://profiles.wordpress.org/lunexiait/) ## Soporte ¿Tenés algo que decir? ¿Necesitás ayuda? [Ver el foro de asistencia](https://wordpress.org/support/plugin/lunexia-htaccess-shield/)