2MNY Shield
WordPress & PHP security with a 182-rule WAF, 237-signature malware scanner, file integrity monitoring, live traffic view, and email alerts — free forever.
Pro unlocks auto-fix and cloud sync — features no other plugin offers. Works on WordPress AND non-WordPress sites with the same license.
Live threat-intel blocklist synced hourly from URLhaus, ThreatFox & OpenPhish by the 2MNY cloud.
Match Wordfence On Core. Beat Everyone On Price.
$89/yr Pro, plus two things nobody else has: cloud platform sync and auto-fix.
Web Application Firewall
182 OWASP rules in free — SQLi, XSS, LFI, RFI, RCE, XXE, SSRF, SSTI, traversal, upload, brute-force, scanner bots. More than AIOS (63) and iThemes (0).
Malware Scanner
237 signatures covering backdoors, web shells (c99, r57, b374k), obfuscation, function abuse. Daily scan with email alerts when threats are found.
File Integrity Monitoring
SHA-256 hash baseline of wp-admin, wp-includes, themes, plugins, wp-config.php, .htaccess. Alerts on modified / added / deleted files. One-click restore for core files.
Live Traffic View
Real-time list of the last 500 requests — IP, method, URL, browser/bot identification, status. Separate block log with rule IDs. 24h stats and top blocked IPs.
Email Alerts
Six alert types: malware found, file integrity changes, brute-force blocked, firewall block (optional), vulnerability, daily summary. Rate-limited: max 20/hour, 5 per type.
Real-time Firewall
Hooks into plugins_loaded at priority 1 — blocks attacks before WordPress or any other plugin processes them. Plus user enumeration and admin POST protection.
Live Threat Blocklist
Hourly sync from the 2MNY cloud: 2,400+ attack IPs and 20,000+ malicious hosts from URLhaus, ThreatFox & OpenPhish — blocked at your edge before they reach WordPress.
Country Blocking
Block entire countries site-wide while keeping wp-login and xmlrpc open to your own — geo fail-open so a lookup outage can never lock you out of your admin.
Auto-Fix & Cloud Dashboard
One-click remediation with backup included, and multi-site management from 2mny.com. No competitor offers either at any price. Pro features.
Non-WordPress Too — Same License
Same license works on cPanel, raw PHP, Laravel, CodeIgniter, custom sites — via the standalone script. Wordfence, Sucuri, iThemes, AIOS only work on WordPress.
Protected In Under Five Minutes
Install Plugin
Upload to WordPress (Plugins → Add New → Upload) or include shield.php in your PHP site.
Auto-Protect
Firewall (priority 1), scanner, headers, FIM, and live traffic activate immediately on first request.
Monitor & Fix
Daily scans + email alerts. Cloud sync and one-click auto-fix in Pro.
Ready to Secure Your Site?
Free forever, GPL v2, and protecting your site in under five minutes — 2MNY Shield v1.4.0.
Download 2MNY Shield Free v1.4.0 →