Good evening
ThreatWall Shield
Loading priority actions...
Calm, application-aware protection for your WordPress estate.
—
Security Score
Awaiting scan data
Priority actions recommended next steps
Severity distribution
Security score trend last 20 scans
Website connection health
| Website | Status | Score | Firewall | Action |
|---|
Multi-site control
Websites
Sort your WordPress portfolio by protection state, scan freshness, and urgent risk.
Websites
Business priority. Higher importance raises urgency when findings are scored and prioritized.
| Website | Verified | Score | Schedule | Actions |
|---|
Prioritized remediation
Vulnerabilities
Review what matters first, whether protection is active, and what action closes the risk.
Findings
Click any finding for evidence, analysis and remediation.
| Priority | Risk | Vulnerability | Asset | Protection | Status |
|---|
Alerts
Managed protection
Firewall
Application-aware WordPress firewall controls: monitor-first rules, signed packages, exclusions, rollback, and investigated IP actions.
Firewall active extended protection
Connect a website install the agent
Generate a one-time connection token, then send it to the site owner with the installer. They upload one file, paste the token, and press Connect.
Firewall rules
| Rule | Lifecycle | Telemetry | Action |
|---|
Blocked IPs
| IP/CIDR | Reason | Status |
|---|
Network defense
| IP/CIDR | Corroboration | Categories | Expires |
|---|
External intelligence
Firewall health
Exclusions and overrides
| Scope | Reason | Status |
|---|
Analyst work queue
Triage
Related detections collapse into groups by rule, site, and path. Review a group once — the verdict covers every event in it, past and future.
Detection groups
| Severity | Rule | Path | Site | Events | Sources | Last seen | Status | Verdict |
|---|
Rule quality reviewed groups only
False-positive rate is computed over groups a human actually reviewed — never over raw event counts.
| Rule | Groups | Reviewed | FP rate | Confirmed | Health |
|---|
Raw event stream last 30 days
| Time | Source | Target | Attack | Rule | Action |
|---|
Temporary protection
Virtual Patches
Show customers they are protected while permanent WordPress updates are pending.
Compromise detection
Malware
File integrity, suspicious PHP changes, uploaded scripts, and plugin/theme drift.
Malware protection status
Ready
Integrity agent
Plugin endpoint available
0
Suspicious files
No uploaded integrity alerts shown
Portal
Next step
Connect plugin diagnostics for live file events
Client-ready evidence
Reports
Download executive and technical reports, then schedule recurring summaries.
Scheduling
Executive summarySend every Monday to organization admins.
Critical-event reportSend immediately when a critical issue or active exploit is detected.
Compliance evidenceAvailable in the Compliance page after assessment.
Technical readiness
Compliance
Map scan findings, firewall evidence, and platform controls to GDPR, OWASP, ISO 27001, NIS2, and CIS readiness. ThreatWall provides technical evidence, not legal certification.
Scan → Protect → Govern → Prove Evidence
Technical readiness pending
—
Control matrix weighted technical controls
| Control | Status | Risk | Evidence | Action |
|---|
Evidence repository stored proof
| Evidence | Hash | Captured |
|---|
Governance settings readiness support
Manual review required: lawful basis, DPO appointment, contracts, staff training, incident reporting obligations, and records of processing activities must be confirmed outside automated scans.
Contextual assistant
AI Advisor
ThreatWall explains risk, prioritizes remediation, and grounds every answer in scan and attack evidence.
Ask ThreatWall
risk
What should I fix first?Prioritize by exploitability, protection state, and business impact.
attacks
Summarize attacks from this weekUse firewall events and blocked request categories.
fix
Create a remediation checklistTurn open findings into owner-friendly tasks.
Answer
Choose a question to generate a grounded workflow answer.
Threat intelligence feeds CISA KEV · FIRST EPSS · NIST NVD
Feeds sync automatically on a schedule. When a CVE affecting your assets lands on KEV or its EPSS score jumps, open findings are re-scored and you are alerted — without waiting for the next scan.
| Feed | Status | Records | Last run |
|---|
Re-scores open findings against current intel. No scanning involved.
Known exploited vulnerabilities CISA KEV catalogue
| CVE | Product | EPSS | Ransomware | Due |
|---|
Team members
| Member | Role | Status | Staff controls |
|---|
System audit trail
Logs
Tracks auditable security and account actions: websites, verification, scans, findings, reports, staff changes, firewall changes, billing, API keys, agents, and compliance. Platform admins see all organization activity; other users see only their own actions.
Activity log recent actions
| Actor | Action | Target | Details | When |
|---|
Upgrade plan subscription access
Enterprise access1000 websites, 100000 monthly scans, API keys, AI analysis, nuclei scans, and 7-year retention.
Current subscriptionLoading plan details...
UsageLoading usage...
Personalization workspace preferences
ThemeDark security console
DensityComfortable tables and controls
Default scheduleManual scans for newly added websites
Alert styleCritical alerts are highlighted in red and surfaced in the Alerts tab.
Profile account identity
Email-
Role-
Plan-
SessionAuthenticated
Settings security and workspace controls
SecurityMFA and API key controls are available from account endpoints.
TeamInvite members and assign roles from the Team tab.
ScanningVerified websites can be scanned manually or scheduled.
Threat intelSync CVE feeds and re-evaluate assets from the Threat Intel tab.
Issue tracking file findings into Jira or GitHub
Connect the tracker your team already works in. Findings become tickets with the full explanation and remediation, and ThreatWall closes them automatically once a rescan proves the fix.
Loading integrations…
Reports who receives the recurring security report
ThreatWall emails a security report covering every verified website, with the full per-site report attached as a PDF. Leave the recipients empty to send it to this organization's owners and admins.
Loading report settings…
Product guide
How ThreatWall Works
Set up, operate, and troubleshoot ThreatWall from website verification through scanning, active protection, reporting, and access management.
Guided Security Setup the safe first-run path
Owners and organization administrators see a resumable setup guide on their first dashboard session. Progress is calculated from ThreatWall's records, not from browser checkboxes, so it remains accurate after logout, on another computer, and for every website independently.
1. Add company membersEnter each person's name and company email, then assign the least-privileged role they need. ThreatWall creates the account, attempts to email sign-in instructions, and requires a generated temporary password to be changed on first login. This step is recommended but optional for a solo owner.
2. Add an authorized websiteEnter the public HTTPS URL, an optional label, and its business importance. Only add a website you own or are authorized to assess.
3. Verify ownershipUse the generated HTML file, meta tag, or DNS TXT record. Vulnerability scanning remains locked until verification succeeds.
4. Establish the vulnerability baselineRun the first safe scan. Review the security score, evidence, affected URLs, and remediation in Vulnerabilities; scanning and firewall protection are separate controls.
5. Connect the firewall agentSelect the exact website in Firewall, create one single-use connection token, install the PHP or WordPress agent on that website's server, and delete the public installer immediately.
6. Prove agent healthThe guide waits for enrollment, a recent heartbeat, an enabled firewall, and the latest signed ruleset. A stale or disconnected agent produces a recovery action instead of pretending setup is complete.
7. Begin with monitoringExercise normal login, search, form, upload, administration, API/webhook, checkout, and scheduled workflows. Review unexpected matches and add only narrow justified exclusions.
8. Enable blocking deliberatelyBlocking is optional during initial setup. Enable it per website only after monitor evidence is acceptable, server access and rollback are available, and critical normal workflows have passed.
| Role | Use during setup |
|---|---|
| Viewer | Reads dashboards, findings, setup status, and reports without changing protection. |
| Analyst | Adds and verifies websites, runs scans, reviews events, and operates site-level firewall workflows. |
| Organization admin | Adds company accounts, assigns invite roles, configures organization settings, and performs analyst work. |
| Billing admin | Handles subscription and billing responsibilities without receiving security-administration rights. |
| Owner | Controls the organization and can complete every guided setup action available to customers. |
Account safety: use individual company accounts rather than sharing the owner login. Temporary passwords are shown once, must be transferred through an approved secure channel if email fails, and must be changed at first login. Automatic first-session opening is limited to owners and organization administrators.
Security Lifecycle from discovery to verification
Add and verify a websiteThe admin adds a URL, opens verification instructions, places the ThreatWall token by HTML file, meta tag, or DNS TXT record, then clicks Verify. Scans stay disabled until ownership is confirmed.
Run a scanChoose safe, standard, or thorough intensity. ThreatWall crawls same-site pages, checks TLS and headers, fingerprints the stack, runs WordPress checks, and uses Nuclei when available.
Convert evidence into findingsRaw scanner output becomes normalized findings with severity, risk score, affected URL, evidence, and remediation guidance.
Connect an agentInstall the WordPress plugin or standalone PHP agent on the protected website. The cloud service manages policy; the on-site agent is what inspects live requests and enforces protection.
Prioritize and protectCritical and high items appear as priority actions. Suitable findings can receive an automatic virtual patch while permanent remediation is pending.
Fix, verify, report, and governRepair the underlying issue, rescan to verify it, deliver reports, and review Compliance for technical readiness across GDPR, OWASP, ISO 27001, NIS2, and CIS.
Web Verification how ownership is proven
ThreatWall creates a unique tokenEach website gets its own verification token. The token proves the person using ThreatWall can control the site or its DNS.
Option 1 - HTML filePlace the generated file at the site root, for example /threatwall-token.txt, with the token as its content. ThreatWall fetches the file and checks that the token is present.
Option 2 - Meta tagPaste the generated meta tag into the homepage head. ThreatWall requests the homepage and looks for the threatwall-site-verification tag with the matching token.
Option 3 - DNS TXT recordCreate a TXT record on the domain with threatwall-site-verification=token. ThreatWall checks DNS for the matching value.
Verified unlocks scanningIf the check succeeds, the website is marked verified and scans can run. If it fails, ThreatWall shows the reason so the admin can fix the file path, tag placement, DNS value, or propagation delay.
Why this matters: Ownership verification keeps scanners limited to websites the organization is authorized to test.
Scan Engine what each intensity means
| Intensity | Best for | Coverage | Admin expectation |
|---|---|---|---|
| Safe | First checks and low-impact reviews | Passive checks, homepage plus small crawl, conservative templates | Fastest, lowest noise, may miss deeper issues |
| Standard | Routine monitoring | Broader same-site crawling, headers, TLS, fingerprinting, WordPress checks, Nuclei standard templates | Recommended default for verified websites |
| Thorough | Pre-launch, incident review, important sites | Deeper crawl, more URLs, more Nuclei coverage, WordPress-specific checks | Takes longer and may produce more findings to triage |
Important: The scanner is evidence gathering. AI does not scan or invent findings; it explains and prioritizes evidence produced by scanners or firewall events. Source-code SAST runs only when a source tree or archive is supplied to a scan.
Connect A Protection Agent live protection runs on the website
Choose the agentUse the ThreatWall WordPress plugin for WordPress. Use the standalone PHP installer for another PHP website. A cloud scan works without an agent, but live request blocking does not.
Create a connection tokenIn Firewall, select the exact website and create a single-use token. Copy it immediately; it is shown once. Treat it like a password until enrollment completes.
Install on the protected websiteUpload or install the agent in that website's hosting environment—not on the ThreatWall API server. The PHP installer belongs in the same document root as the site's index.php and must be deleted after installation.
Enroll securelyThe website generates its Ed25519 key pair locally. ThreatWall receives only the public key, binds the agent to the selected website, and consumes the connection token.
Confirm healthCheck Firewall Health for the website name, connected state, agent/PHP version, heartbeat, and current versus latest ruleset version before testing protection.
Server distinction: the ThreatWall API distributes policy and receives events. The agent must be installed separately on every website that should enforce the firewall.
Firewall Protection how requests are handled
Cloud creates signed rulesRules are deterministic protections for SQL injection, XSS, sensitive files, XML-RPC abuse, login attack signals, and known WordPress exploit patterns.
Agent downloads the packageThe WordPress or standalone PHP agent receives the latest rules, blocklist, allowlist, exclusions, and website mode. It verifies the package signature before accepting it.
Requests are inspected locallyThe agent checks method, path, query data, user agent, source IP, endpoint, and safe request metadata. Passwords, session cookies, and full request bodies are not intended for telemetry.
Start in monitor modeMatches are evaluated and reported but requests are allowed. Test normal logins, forms, uploads, APIs, webhooks, and scheduled tasks; add narrow exclusions for confirmed false positives.
Enable blocking deliberatelyAfter reviewing monitor events, enable blocking per website from Firewall Health. Blocking rules can reject malicious requests; monitor-only rules continue to record without blocking.
Events return to the portalBlocked or suspicious activity appears in Attack Events, Blocked IPs, Firewall Health, and Reports.
Safe rollout: connect → monitor → exercise normal traffic → review matches → add justified exclusions → enable blocking → watch health and events. The agent is designed to fail open when it cannot safely apply policy.
False Positives & Safe Exclusions review first, tune narrowly
A false positive is legitimate application traffic that resembles an attack and matches a firewall rule. A false-positive verdict records the analyst's conclusion; it does not automatically change enforcement.
1. Reproduce legitimate behaviorKeep the website in monitor mode and repeat the real login, search, form, upload, API, webhook, admin, or checkout workflow. Confirm the expected result and identify the exact route and rule.
2. Open the detection groupIn Attack Events, inspect the website, normalized path, rule, severity, sources, event count, timestamps, and sanitized evidence. Related events are reviewed as one group; original events remain immutable.
3. Record a defensible verdictSelect False positive only when the request is legitimate and reproducible. Enter a reason explaining the application behavior and evidence. Benign/expected, suspicious, and confirmed malicious are separate conclusions.
4. Preview before excludingA verdict never creates an exclusion automatically. Preview the narrowest candidate against 30 days of stored events and check whether it would silence unreviewed or confirmed-malicious activity.
5. Scope and expireUse one rule, one website, one normalized route, and only the needed IP/CIDR or parameter. Add a reason and short expiry. Permanent or site-wide exclusions require an organization administrator.
6. Retest both sidesThe legitimate request must succeed. The malicious pattern must still match on a non-excluded route, other websites and organizations must remain unaffected, and the agent must receive the new signed ruleset.
7. Review and removeCheck Activity for the verdict and exclusion. Disable or let the exclusion expire after the application or rule is corrected. Reversing a verdict flags related exclusions for review rather than silently removing them.
| Decision | What changes | Safety rule |
|---|---|---|
| False-positive verdict | Closes the investigation group and updates rule-quality statistics. | Does not alter firewall enforcement. |
| Exclusion preview | Shows which recent events the proposed scope would have silenced. | Uses the same matcher as live enforcement. |
| Temporary exclusion | Allows the exact scoped match after agent synchronization. | Must remain rule-, tenant-, website-, and route-scoped. |
| High-risk override | May affect site-wide, permanent, or confirmed-malicious evidence. | Requires an organization administrator and written justification. |
Never include secrets: investigation notes and evidence must not contain passwords, cookies, connection tokens, API keys, or complete sensitive request bodies. If legitimate traffic is blocked unexpectedly, return that website to monitor mode while investigating.
Virtual Patches & Shared Defense temporary and collective protection
Automatic virtual patchingWhen a suitable critical or known-exploited finding maps safely to firewall controls, ThreatWall can create and test a scoped patch and distribute it through a signed ruleset.
Temporary protection is not remediationKeep the patch active while updating the vulnerable plugin, theme, application, or server. Rescan afterward; only evidence that the vulnerability is gone closes the remediation loop.
Shared blocklistRepeated malicious activity independently observed across the configured number of organizations and sites can promote an address into shared network defense.
Controlled distributionParticipating organizations receive active shared blocks in agent rulesets. Entries have evidence, thresholds, status, and expiry; administrators can leave the shared list from Firewall settings.
Review context: an IP can be shared infrastructure, a proxy, or a compromised host. Use event evidence and expiry rather than treating reputation as permanent identity.
Reports & Delivery stored evidence and scheduled email
Download on demandReports provide an executive posture view and technical evidence for each verified website, including scores, findings, remediation, and protection state.
Choose recipients and cadenceUnder Settings → Reports, select weekly, monthly, or off and enter recipients. If recipients have never been configured, owners and admins are used by default.
Test with Send nowSend now creates one organization email with a summary and one PDF attachment per verified website. It is the quickest way to validate recipients and SMTP.
Understand delivery stateReports are still generated and stored when email is disabled or SMTP is unavailable. Email delivery requires the platform operator to configure SMTP and a deliverable From address.
Admin Workflow what to do each day
| Where | Question it answers | What the admin should do |
|---|---|---|
| Overview | Am I protected and what is urgent? | Start with Priority actions. Fix critical items first, then disconnected sites. |
| Websites | Are all websites connected and scanned? | Verify new sites, run scans, adjust schedules, and download site reports. |
| Vulnerabilities | What is risky and how do I fix it? | Open each critical/high item, read evidence and remediation, then verify after fixing. |
| Firewall | Is protection active? | Check rule package version, active rules, health, and blocked IPs. |
| Attack Events | Is someone attacking me? | Review blocked requests by source, target, attack type, and matched rule. |
| Virtual Patches | Am I temporarily protected? | Confirm temporary protection, then complete the permanent plugin/theme/core update. |
| Malware | Have protected files changed? | Review integrity drift and suspicious-file signals, confirm legitimate deployments, and investigate unexplained changes. |
| Reports | What can I share with clients or management? | Download reports, configure delivery under Settings → Reports, and use Send now to test email. |
| Compliance | What technical evidence supports audit readiness? | Review framework scores, open mapped controls, export evidence, and confirm manual governance items outside ThreatWall. |
| Threat Intelligence | Is exploitation likely or known? | Use KEV, EPSS, CVE context, and feed freshness to prioritize—not as a replacement for finding evidence. |
| AI Advisor | How should I understand the evidence? | Use grounded explanations and remediation guidance, then validate changes with a rescan. |
| Team & Activity | Who can act and what changed? | Keep least-privilege roles, review security-sensitive actions, and investigate unexpected account or firewall changes. |
Access & Integrations people, automation, and issue tracking
Assign the smallest useful roleOwners and administrators control organization-wide settings; analysts operate security workflows; viewers should remain read-only. Review Team and Activity regularly.
Protect accountsEnable MFA where available. Enterprise organizations can configure OIDC SSO and SCIM provisioning; keep an approved recovery path before enforcing SSO.
Use API keys narrowlyName keys by purpose, select the minimum role, set an expiry, keep the raw value in a secrets manager, and revoke unused or exposed keys.
Connect Jira or GitHubConfigure credentials under Settings → Issue tracking, test the connection, then create remediation issues from findings. Integration secrets are encrypted by the platform.
Operations & Troubleshooting what to check when work stops
| Symptom | Check first | Next action |
|---|---|---|
| Verification fails | Exact file URL, meta tag, or DNS TXT value | Correct placement, account for DNS propagation, and retry. |
| Scan fails or stalls | Ownership, target reachability, intensity, and scanner error | Retry Safe, confirm the site permits authorized scanning, then escalate the recorded error. |
| Agent disconnected | Heartbeat, outbound HTTPS, site clock, agent state, and API reachability | Restore connectivity and run the agent status/sync command; do not create a new token unless re-enrollment is required. |
| Ruleset behind | Current and latest package versions plus signature/sync status | Trigger a sync and investigate connectivity or signature errors before enabling blocking. |
| Expected email missing | Report enabled, cadence, recipients, verified sites, and Send now result | Platform operators should check SMTP configuration and scheduled-job execution. |
| Normal request matched | Matched rule, route, source, mode, and sanitized evidence | Keep monitor mode and create the narrowest justified exclusion; never disable broad protection without evidence. |
Platform maintenance: database migrations are not automatic. Operators must back up, apply Alembic migrations, restart services, and verify scheduled jobs after an update. Customers should contact their ThreatWall operator rather than attempting server maintenance from this console.
Compliance Readiness technical evidence, not certification
ThreatWall maps completed website scans and their open normalized findings to a bounded set of technical controls. It does not currently score raw firewall events, contracts, staff training, legal decisions, or incident-notification procedures.
1. Establish current evidenceOwnership-verify the website and complete a recent scan. Check its scope and confirm optional scanners such as Nuclei actually ran. Without a completed scan, automatic controls remain manual review.
2. Choose scope and frameworkCompliance supports GDPR, OWASP Top 10, ISO 27001, NIS2, and CIS. Select all websites for organization readiness or use the website filter for site-specific evidence.
3. Interpret the score correctlyThe score is passed automatic-control weight divided by applicable automatic-control weight. Partial and failed controls earn no passed weight; manual controls are excluded. It is a prioritization indicator, not an audit opinion.
4. Work the control matrixPassed means a relevant scan exists with no mapped open finding. Partial means mapped Low, Medium, or Info findings remain. Failed means at least one mapped High or Critical finding remains. Manual review requires evidence outside automated scanning.
5. Inspect the evidenceOpen mapped findings and confirm the URL, scanner evidence, severity, and remediation. The evidence repository stores finding-derived records with capture times and SHA-256 hashes for traceability; a hash is not independent certification.
6. Fix and verifyApply the permanent remediation and run another scan. A temporary firewall patch can reduce exposure, but it does not close the control. The finding must disappear from verification evidence before the next assessment improves.
7. Complete the audit packageRetain the detailed vulnerability report, evidence records, and Activity export, then add policies, contracts, training, risk acceptance, incident records, and legal review managed outside ThreatWall.
| If you see | What it means | What to do |
|---|---|---|
| Score unavailable | No completed scan exists in the selected scope. | Complete a scan, review scanner coverage, then refresh Compliance. |
| Passed | No mapped open finding was found by the relevant completed assessment. | Retain the evidence and confirm that scan coverage was sufficient. |
| Partial | Mapped findings exist, but none is High or Critical. | Review and schedule remediation, then verify with a rescan. |
| Failed | A mapped High or Critical finding remains open. | Prioritize the finding, apply a permanent fix, and run verification. |
| Manual review | The control needs organizational evidence, or the selected scope has no completed scan. | Collect the external record or complete the missing scan. |
Boundary: ThreatWall helps assemble technical readiness evidence. It does not certify GDPR, ISO 27001, NIS2, CIS, OWASP, or any legal/regulatory outcome. A clean external scan also does not prove authenticated paths, source code, internal systems, or business processes were tested.
Translation Key badges, clues, and signals
| Signal | Meaning | How to respond |
|---|---|---|
| Critical | High-impact issue that may allow serious compromise or is known to be actively exploited. | Fix first. Confirm whether a virtual patch is active. |
| High | Important vulnerability or misconfiguration with meaningful risk. | Schedule immediate remediation and monitor firewall events. |
| Medium | Risk exists, but exploitation or impact is more limited. | Fix after critical/high items or combine with maintenance work. |
| Low | Minor hardening or hygiene issue. | Track and resolve during routine cleanup. |
| Info | Useful context, fingerprinting, or non-dangerous evidence. | Use for awareness; usually no urgent action. |
| Verified | The system has confirmed ownership, protection, or a positive state. | No immediate action unless paired with a warning elsewhere. |
| Pending | An action is waiting: verification, scan completion, review, or scheduled work. | Open the related page and complete the next step. |
| Failed | A verification, scan, sync, or protection step did not complete. | Read the error, retry, or reconnect the plugin. |
| Risk score | A prioritization number based on severity, confidence, exploit signals, and business context. | Use it to sort work, but always read the evidence before making a change. |
| Evidence | The observed proof: URL, header, scanner output, CVE/CWE, or sanitized firewall event. | Use it to confirm the issue and avoid guessing. |
| Compliance readiness | A weighted technical score for automatic controls inside a selected framework. | Use it to prioritize technical work, then complete manual governance review separately. |
| Manual review | A compliance control that depends on organizational or legal evidence ThreatWall cannot observe. | Track the item with policy, contract, training, incident-response, or legal records. |
| Virtual patch active | The firewall is temporarily reducing exposure before the permanent fix is applied. | Do not treat it as the final fix. Update the vulnerable component and verify. |
| Nuclei enabled | The scan used Nuclei templates for broader detection. | Expect deeper coverage, especially on standard/thorough scans. |
| CISA KEV | The vulnerability appears in the Known Exploited Vulnerabilities catalog. | Escalate. Treat as urgent even if the scan score is not the highest. |
| EPSS | Probability-style exploit prediction signal from threat intelligence. | Higher EPSS means prioritize sooner, especially with exposed WordPress components. |