by
andrewjbaker
0 (0 reviews)
CloudScale Cyber & DevTools
Free AI security audit, 2FA, passkeys, brute-force protection, SMTP and server logs, plus code blocks that draw Mermaid diagrams.
CloudScale Cyber & DevTools ranks #29,515 among WordPress.org plugins with 10+ active installations, is #1,834 of 5,058 in the Security category, and was last updated Oct 30, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.10.1085
Current Version v1.10.1085
Updated 1 week ago
Last Update on 30 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#1,834 of 5,058 in Security
Top 50% by installs
Downloads +291.9% this week
Actively maintained
Rank
#29,515
—
No change
Active Installs
10+
—
No change
KW Avg Position
13
—
No change
Downloads
117
+148 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 20
10+
20+
6,342
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 2 more installs to reach 20+
Rank Changes
Current
#29,515
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.10.1085
- Last Updated
- Oct 30, 2026
- Requires WP
- 6.2+
- Tested Up To
- 7.1.4
- PHP Version
- 8.0 or higher
- Author
- andrewjbaker
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about CloudScale Cyber & DevTools
Anthropic Claude (Sonnet 5 and 5.5, Opus 5 and 5.5, Haiku 4.5 and 5.5), Google Gemini (3.8 Flash, 3.6 Flash, 3.5 Flash Lite and 3.1 Pro Preview) and OpenAI (GPT-6.1 Sol, GPT-6 Astra and GPT-6 Luna). You supply your own API key, no keys are stored anywhere other than your WordPress database (wp_options). A free Gemini tier is available.
Nothing until you switch it on (Firewall tab). Then, for each request that reaches WordPress: the time, address, Cloudflare country, method, path without its query string, HTTP status, the first 200 characters of the user agent, and the user ID if signed in. Never the query string, body, cookies or referrer. Rows are kept for 24 hours, at most 20,000, and uninstall drops the table. Pages served from a cache never reach PHP, so they are not shown.
A visitor claiming to be Googlebot, Bingbot, Applebot, YandexBot, Baiduspider or Yahoo Slurp has its address checked with forward-confirmed reverse DNS, through your server's own resolver. The lookup runs after the response is sent and the result is cached, so no visitor waits. It starts in Log only; Block refuses a proven fake on its next request.
When a plugin or theme you have installed has a published vulnerability, a virtual patch refuses the one kind of request it needs, for example a non-number in one AJAX action's id field, until you update. The patches come from a feed signed by CloudScale and checked against a key built into the plugin; each one is drafted from the difference between the vulnerable and the fixed release and approved by a person. A patch is a description, not code: it names an AJAX action, REST route or file inside that component, and one of a fixed set of checks the plugin carries. Only patches for a component installed here at an affected version are used, and each stops applying when you update. Off by default; Log only records matches as vpatch in Recent Matches, Block also refuses them. Signed-in editors are never checked, and the firewall's exceptions apply.
An optional signed message, every 5 minutes, from WordPress to an uptime monitor you run (such as a Cloudflare Worker). It stops exactly when WordPress stops, and carries a few signals the monitor can alert on: a new administrator, the firewall switched off, a new must-use plugin, persistence watch changes, the plugin deactivated. The token is stored encrypted. Off by default.
Every 5 minutes the plugin compares a fingerprint of what the site runs: the WordPress version, the PHP version the web server uses, the active theme and each active plugin with its version. When any of them changes, whether through an update in WordPress, copied files or a rebuilt server image, it waits 2 minutes and checks the front page, the login page, the REST API, admin AJAX, PHP fatals since the change, that each changed part reports its new version, core files against WordPress's checksums (only while file integrity is on), and that scheduled tasks still run. A failure sends one alert. It is a report only: nothing is rolled back or changed, and the requests go only to your own site. On by default; never runs on a standby copy.
Only IP addresses, each as one IP Access Rule on your zone with a note marking it as this site's. An address qualifies when it is blocked here now and was blocked by hand, is a repeat offender, made a firewall attack in Block mode, or is a proven fake crawler in Block mode; the newest 200. An administrator's address from the last 30 days, your never-block list, private or reserved ranges, Cloudflare's own ranges and the site's own address are never sent. Off by default; switched on it starts in Dry run, which only reads. Rules without this site's mark are never changed. The token needs Zone > Firewall Services > Edit.
One switch (Login Security tab, or the link in an alert) for when someone may already be in. While it is on: no registration, no new administrators or role grants, no plugin or theme install, update, edit, activation or theme switch, no application password or XML-RPC logins, and 3 failed logins refuse an address for 30 minutes. Other administrators are signed out. Two-factor and the hidden login page are untouched, and your own and recent administrator addresses are never refused. Release it in wp-admin. The automatic trigger only reports unless you set it to Enforce.
The plugin uses fastcgi_finish_request() to close the browser connection immediately, then continues the scan in the same PHP-FPM worker. A progress bar polls every 3 seconds. This does not depend on WP-Cron.
Go to Tools > Cyber and Devtools > Code Block tab > Code Block Settings panel. Select your preferred theme from the dropdown and click Save.
