by
papy3d
1 (0 reviews)
Papy3D Security Guard
A modular, self-hosted WordPress security suite with no external CAPTCHA or TOTP service.
Papy3D Security Guard ranks #51,306 among WordPress.org plugins with 1+ active installations, is #2,854 of 5,058 in the Security category, a 1/5 rating from 0 reviews, and was last updated Aug 25, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v2.0.10
Current Version v2.0.10
Updated 2 months ago
Last Update on 25 Aug, 2026
Refreshed 1 week ago
Last Refreshed on
#2,854 of 5,058 in Security
Rank
#51,306
—
No change
Active Installs
1+
—
No change
KW Avg Position
29
—
No change
Downloads
205
+1 today
Support Resolved
0%
—
No change
Rating
20%
Review 1 out of 5
1
(0 reviews)
Next Milestone 10
0+
10+
38,369
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 6 more installs to reach 10+
Rank Changes
Current
#51,306
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
1.0
0 reviews
Overall
20%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 2.0.10
- Last Updated
- Aug 25, 2026
- Requires WP
- 6.5+
- Tested Up To
- 7.1
- PHP Version
- 8.0 or higher
- Author
- papy3d
Support & Rating
- Rating
- ★ ☆ ☆ ☆ ☆ 1
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about Papy3D Security Guard
Temporarily add define( 'PAPY3D_SECURITY_BYPASS', true ); to wp-config.php, sign in, correct the configuration, then remove the constant immediately. It suspends Security Guard protections, including the pre-WordPress guard.
The optional guard uses PHP auto_prepend_file to count credential submissions before WordPress loads and can require a short-lived signed local CAPTCHA during reinforced mode. Because WordPress has not bootstrapped yet, the challenge uses its own expiring HMAC-signed nonce bound to the client IP and user agent; that nonce is verified before the submitted CAPTCHA answer is read. It does not inspect or store passwords or usernames. The stable loader is stored under the plugin-owned directory returned by wp_upload_dir() so plugin updates do not remove a path that PHP workers may still cache. Mutable configuration and runtime state are protected under the same plugin-owned uploads tree. The plugin never replaces an unknown third-party auto_prepend_file directive.
They use authenticated encryption with a dedicated versioned random master key stored in the WordPress database. The option is non-autoloaded on single-site and network-scoped on multisite. Historical formats are migrated without rotating the key.
The local WAF runs inside WordPress. It can reject application attacks but cannot stop traffic before PHP, protect files served directly by the web server, or absorb volumetric denial-of-service attacks. Administrators are not blocked by the local WAF while authenticated.
After explicit administrator confirmation, a source file is streamed into an authenticated-encryption container under wp_upload_dir()/papy3d-security-guard/quarantine. Plaintext hash and size are verified before removal and again during restoration. Existing destination files are never overwritten.
The optional Wordfence Intelligence module sends the configured API key only to the official Scanner Feed endpoint in an Authorization Bearer header. The complete feed is imported locally; installed components are then checked offline. A conservative local delay prevents excessive synchronization attempts.
