Security
WordPress security without a security plugin: a firewall, a login lock and two factors
A WordPress site is not attacked because it matters. It is attacked because it answers. Programs work through addresses, passwords and old holes day and night, on every site they can reach. ambera stands in front of that — with rules that turn suspicious requests away, a lock after too many failed sign-ins, and a second factor for everyone who is allowed in.
Before WordPress
- Rules against injection, path tricks and PHP in a value
- Known scanners and probes for backups and keys
- A brake on sixty requests a minute from one address
- Lists: always allowed, never allowed, whole countries
- The early firewall, in front of WordPress itself (Pro)
The way in
- A lock after as many attempts as you allow
- Hide the sign-in page if you want to
- Two factors: a passkey, or a code from an app
- A message when somebody is locked out
- Lift every lock again with one click
Screws and checks
- XML-RPC, file editing, the user list, the version number
- The files on the server against their checksums
- A log: when, from where, which rule — and what came of it
- No server module, no external blocklist service
- All of it on as soon as ambera runs
The firewall
What looks like an attack does not get through.
Every request from outside runs through a set of rules: injection into database queries, scripts in values, paths climbing upwards, PHP code, probing for backups and secrets, known scanners. What trips a rule gets a plain refusal and a line in the log; five attempts in ten minutes buy an hour of quiet. Whoever is signed in and may write is not checked — the builder sends HTML on purpose.
The log
Who knocked, and what they ran into.
Under the firewall stands what was turned away last: the time, the address, the rule. This is not a number to show off — it is the answer to the question that comes after every strange morning: did somebody get in? Beside it the countries you may shut out entirely, and the addresses that always get through: your own office, a monitoring service, a payment provider calling back.
Two factors
A password on its own is not enough any more.
Passwords leak, get copied from a fake sign-in page, or are read over a shoulder. The second step asks for something you have: a code from an app, or a passkey — fingerprint, face or the PIN of the device, with no password at all. The key never leaves the device, and the browser signs the address along with it, so a copied sign-in page under another address gets nothing it can use.
Questions
Do I need Wordfence or iThemes Security?
No. Firewall, login lock, two factors, hardening and the file check are in ambera, including the free version. Only the early firewall in front of WordPress is Pro.
Does it work on any hosting?
Yes. No server module, no cron service, no external blocklist. Everything runs in PHP inside your own installation.
Does the firewall slow the site down?
Not noticeably: the checks run on the request before WordPress loads, and cached pages go past all of it anyway.
And if the lock catches me?
Every lock can be lifted with one click, and your office address can be on the always-allowed list. With no access at all there is the setting that lifts all locks when the page is saved — or support.
Does this replace a backup?
No, which is why there is both. Security keeps people out; a backup brings the site back. They are the lock and the spare key.
The WordPress theme builder has a name.
Built in Switzerland. Built for WordPress.