Stalza Security
Stalza Security protects your site without weighing it down. Instead of hundreds of generic warnings, it tells you what changed, why it matters, how confident the detection is, and what to do.
Detect → Correlate → Assess Risk → Explain → Protect → Verify
Free features
- File & WordPress integrity — core, plugin and theme checksums plus a local baseline for everything else.
- Malware detection — heuristic analysis of PHP, JS and .htaccess files; no signature database needed.
- Vulnerability detection — daily check of your installed components against known advisories (opt-in).
- Brute-force protection — login, XML-RPC and REST user-enumeration limits with escalating lockouts.
- Security hardening — one-click fixes and clear advisories for common misconfigurations.
- Security events & reports — a single timeline of what happened, with a weekly digest.
Designed to be light
- Zero frontend queries unless a login attempt is being evaluated.
- Scans run in small resumable chunks with CPU and memory budgets.
- No autoloaded option bigger than 50 KB. No bundled React runtime — uses the one WordPress already ships.
Premium
Stalza Security Pro extends the same engine with cloud threat intelligence, real-time protection, behavioral analysis, automatic remediation, IP reputation and advanced alerting.
External services
This plugin works fully offline by default. Nothing is sent anywhere until you opt in.
If you enable Vulnerability intelligence in Settings, the plugin sends the slugs and version numbers of your installed WordPress core, plugins and themes, plus your site URL, to https://stalza.com/api/stalza-security/v1/vulnerabilities/match once per day to receive matching security advisories. No user data, content or visitor information is included. See the Stalza privacy policy and terms.
Integrity checks fetch official checksums from WordPress.org (api.wordpress.org, downloads.wordpress.org), the same service WordPress core uses for updates.