2MNY Shield v1.4.0 is a complete website security plugin that protects your site from hackers, malware, and vulnerabilities. This document covers installation, configuration, and every feature.

1. Install on WordPress

1. Download the WordPress ZIP from the download page.
2. In your WordPress admin, go to Plugins → Add New → Upload Plugin.
3. Upload 2mny-shield-wordpress-v1.4.0.zip and click Install Now.
4. Activate the plugin.
5. Navigate to 2MNY Shield in the WordPress admin sidebar.
6. The firewall, scanner, headers, FIM, live traffic, and alerts activate immediately.

Requirements: WordPress 5.8+, PHP 7.4+. Tested up to WordPress 7.0.

2. Install on Non-WordPress Sites (Standalone)

The standalone version protects any PHP site — cPanel, shared hosting, custom frameworks (Laravel, CodeIgniter, CakePHP), and static sites with PHP entry points.

1. Download the Standalone ZIP from the download page.
2. Upload shield-standalone/ to your server (e.g. /home/user/shield-standalone/).
3. Visit https://your-site.com/shield-standalone/installer.php in your browser.
4. Enter your admin password and (optional) Pro license key from 2mny.com.
5. Add this line to the top of your site's main index.php (or any PHP entry point you want protected):

   <?php require_once '/home/user/shield-standalone/shield.php';

That's it — every request to your site now passes through the 2MNY Shield firewall.

3. Web Application Firewall (WAF)

The firewall is the core of 2MNY Shield. It inspects every HTTP request — GET, POST, COOKIE, REQUEST_URI, QUERY_STRING, USER_AGENT, REFERER, and raw php://input — and blocks attacks before they reach WordPress or your PHP application.

182 rules across 14 categories:

• SQLi (30): UNION, OR 1=1, stacked queries, timing, information_schema, load_file, outfile
• XSS (35): script tags, event handlers, SVG, iframe, eval, charcode, hex encoding
• LFI (20): directory traversal, PHP wrappers, /etc/passwd, wp-config, .env, .git
• RFI (5): remote file inclusion via HTTP, FTP, PHP streams
• RCE (21): system, exec, passthru, shell_exec, eval, assert, preg_replace /e
• XXE (5): entity declaration, DOCTYPE, SYSTEM entity, file://, http://
• SSRF (10): url parameter, cloud metadata 169.254.x, gopher://, file://
• SSTI (5): Jinja2, Twig, Smarty, Ruby ERB, Thymeleaf
• Upload (12): PHP, PHTML, PHAR, .htaccess, .htpasswd, content-type
• Traversal (4): ../, encoded, double-encoded
• Brute-force (5): wp-login, xmlrpc, admin/login, api/auth/login
• Scanner/Bot (25): SQLMap, Nikto, Nmap, WPScan, Nuclei, Burp, Metasploit, Hydra
• Auth (4): default credentials, weak passwords
• CSRF (1): POST without token logging

Real-time blocking (NEW in v1.2)

The firewall hooks into plugins_loaded at priority 1, meaning it runs before any other plugin. This is the same approach Wordfence uses — attacks are blocked before WordPress processes them.

Additional real-time protections:

• User enumeration: Blocks ?author=N requests (410 Gone).
• Admin POST protection: Checks admin form submissions for SQL injection.
• Rate limiting: 5 failed login attempts → 1-hour IP block (HTTP 429).
• Cloudflare-aware: Reads CF-Connecting-IP and X-Forwarded-For for accurate IP detection.

When a request is blocked, the visitor sees a 403 (or 429 for rate limits) page with the rule ID. The block is logged to Live Traffic and (optionally) triggers an email alert.

4. Malware Scanner

The scanner checks every PHP file in your web root against 237 malware signatures. It runs daily via WordPress cron (or your server cron for the standalone version).

Signature categories:

• Backdoor patterns (69): eval+base64, system+$_GET, exec+$_POST, common web shell names
• Obfuscation (12): hex encoding, chr(), str_rot13, gzinflate, pack
• Function abuse (30): file operations, include/require with user input, ini_set
• Known malware (91): WordPress-specific backdoors, PHP info disclosure, SQL injection helpers, session hijackers
• Web shell identifiers (35): c99, r57, b374k, WSO, FilesMan, and more

When threats are found, an email alert is sent to the admin (configurable in Settings → Alerts). The dashboard shows a list of infected files with severity ratings.

Pro users can click Auto-Fix on any threat to trigger automated remediation.

5. File Integrity Monitoring (FIM) — NEW in v1.2

FIM builds a SHA-256 hash baseline of your WordPress files and alerts you when any file is modified, added, or deleted. This is the same feature Wordfence, Sucuri, AIOS, and iThemes all offer — and it was the #1 gap in 2MNY Shield v1.1.

What's monitored:

• wp-admin/ directory
• wp-includes/ directory
• wp-content/themes/
• wp-content/plugins/
• wp-config.php
• .htaccess

Monitored extensions: .php, .php5, .php7, .phtml, .htaccess, .js, .htpasswd. Capped at 5,000 files for performance.

How to use:

1. Go to 2MNY Shield → File Integrity.
2. Click Create Baseline. This stores the current state as the "known-good" snapshot.
3. Run Check Integrity at any time, or wait for the daily scheduled check.
4. If changes are detected, you'll see a list of modified/added/deleted files with timestamps.
5. For modified WordPress core files, click Restore from WordPress.org to download the original from SVN.
6. For suspicious added files, click Delete (with confirmation).

Whenever FIM detects changes, an email alert is sent to the admin.

6. Live Traffic View — NEW in v1.2

Live Traffic shows the last 500 HTTP requests hitting your site, plus a separate log of every blocked attack. This is one of Wordfence's most popular features — and now we have it too.

What you see:

• Time — when the request was made
• IP — visitor IP (Cloudflare and proxy-aware)
• Method — GET / POST / PUT / DELETE
• URL — the requested path
• Browser/Bot — auto-detected (Googlebot, Bingbot, Chrome, Firefox, cURL, WPScan, etc.)
• Status — OK (200) or BLOCKED (403/429)
• Rule ID — for blocked requests, which firewall rule matched

24-hour statistics:

• Total requests
• Total blocked attacks
• Unique IPs
• Top attack types (SQL Injection, XSS, etc.)
• Top blocked IPs

Filter by "all traffic" or "blocked only". The log is stored in cache/live_traffic.json (standalone) or the wp_options table (WordPress) and rotates when it exceeds 500 entries.

7. Email Alerts — NEW in v1.2

Email alerts notify the site admin when security events happen — no more checking the dashboard every day to see if anything went wrong.

Six alert types:

1. Malware detected — sent when a scan finds threats, including the file paths and severity. Always on.
2. File integrity changes — sent when FIM detects modified/added/deleted files. Always on.
3. Brute-force blocked — sent when an IP is auto-blocked after 5 failed logins. Always on.
4. Firewall block — sent when the firewall blocks an attack. Off by default (noisy on busy sites). Enable in Settings → Alerts.
5. Vulnerability found — sent when a known plugin/theme vulnerability is detected. Always on.
6. Daily security summary — sent once a day with firewall stats, scan results, and login attempts. Always on.

Rate limiting

To prevent inbox flooding during an attack:

• Maximum 20 alerts per hour (total)
• Maximum 5 alerts per hour (per type)

Configure the recipient email in Settings → Alerts. Defaults to the WordPress admin email (or admin_email in standalone config).

8. Login Security

• 2FA (TOTP): Google Authenticator compatible. Scan QR code in user profile.
• Brute-force protection: 5 failed attempts from one IP → 1-hour block.
• Login rate limiting: Max 10 login attempts per minute per IP.
• Username enumeration: Blocks ?author=N requests.
• Default credential check: Alerts if admin/admin or other common defaults are in use.

9. Security Headers

2MNY Shield sends the following security headers on every response:

• Strict-Transport-Security — HSTS, 1 year, includeSubDomains
• Content-Security-Policy — default-src 'self', configurable
• X-Content-Type-Options — nosniff
• X-Frame-Options — SAMEORIGIN
• Referrer-Policy — strict-origin-when-cross-origin
• Permissions-Policy — geolocation, microphone, camera, payment disabled

10. Auto-Fix (Pro)

Auto-Fix is a unique 2MNY Shield feature — no competitor offers automated vulnerability remediation at any price.

What Auto-Fix can do:

• Fix file permissions (e.g. wp-config.php → 640, .htaccess → 644)
• Remove suspicious files identified by the scanner
• Disable file editing in WordPress admin (DISALLOW_FILE_EDIT)
• Disable XML-RPC if not needed
• Force strong password requirements
• Move WordPress keys/salts to a non-web-accessible location
• Block PHP execution in wp-content/uploads/

Each fix is reversible and a backup is taken before any change. Cloud sync (Pro) lets you trigger Auto-Fix remotely from the 2mny.com dashboard.

11. Cloud Sync (Pro)

Cloud sync is the second unique 2MNY Shield feature. It connects your site to the 2mny.com platform so you can:

• View scan results, firewall stats, and security scores for all your sites in one dashboard
• Trigger scans and Auto-Fix remotely from 2mny.com/dashboard/shield
• Receive consolidated email reports across all sites
• Manage licenses and sites centrally

Cloud sync sends: site URL, plugin version, license key, scan results, firewall block counts, and security score. It does NOT send your content, user data, or passwords.

12. License Activation

1. Purchase a Pro license at /shield/pricing. You'll receive a license key by email automatically.
2. In your WordPress admin, go to 2MNY Shield → Settings → License.
3. Paste your license key (format: 2MNY-XXXX-XXXX-XXXX-XXXX).
4. Click Activate. The plugin validates against https://2mny.com/api/v1/shield/validate.
5. Pro features unlock immediately.

For the standalone version, enter the license key in shield-standalone/config.php or via the installer.

License types:

• Pro ($89/yr): 1 site, all Pro features
• Multi-Site ($249/yr): 5 sites
• Enterprise ($499/yr): Unlimited sites + dedicated engineer

13. FAQ

Will 2MNY Shield slow down my site?

No. The firewall processes each request in <1ms. The scanner runs in the background via cron. FIM only runs when triggered or on the daily schedule.

Does it work with caching plugins (WP Rocket, W3 Total Cache)?

Yes. The firewall runs before caching, so cached pages are still protected. Security headers are added to cached responses.

Does it work with Cloudflare?

Yes. We read CF-Connecting-IP for accurate visitor IP detection. You can also use Cloudflare's WAF alongside 2MNY Shield — they don't conflict.

Can I use the same license on multiple sites?

No — each license is for one site (Pro), five sites (Multi-Site), or unlimited (Enterprise). However, the free version has no site limit.

What happens if my license expires?

The plugin continues to work but Pro features (Auto-Fix, cloud sync, multi-site) are disabled. Your site stays protected by the free firewall and scanner. You can renew at any time.

How is 2MNY Shield different from Wordfence?

See our full comparison. Short version: we match Wordfence on firewall, scanner, FIM, live traffic, and email alerts; we beat them on price ($89 vs $149/yr); and we offer cloud sync and auto-fix that Wordfence doesn't have. Wordfence has a much larger malware signature database (vs our 237) and a real-time threat feed (Premium only) — both are on our Phase 2/3 roadmap.

Is 2MNY Shield GDPR compliant?

Yes. We only collect data necessary for security (IP addresses for blocking, scan results for cloud sync). No personal data is sold or shared. Full privacy policy at /privacy.

Need more help? Email [email protected] (free) or [email protected] (Pro). Documentation last updated September 2026 for v1.4.0.