Total Security Suite - Firewall, Captcha, 2FA & Scanner. Total Security bundles into one module a web application firewall, a captcha for the store forms, two-factor authentication (2FA) for the back office and customers, a local malware/webshell scanner, and a live security score that tells you what to improve. Everything runs on your own server: nothing leaves your shop. No coding, no theme edits.
Total Security bundles into one module a web application firewall, a captcha for the store forms, two-factor authentication (2FA) for the back office and customers, a local malware/webshell scanner, and a live security score that tells you what to improve. Everything runs on your own server: nothing leaves your shop. No coding, no theme edits.
1. Installation
- In the back office go to Modules → Module Manager → Upload a module and select the module ZIP.
- Once installed, click Configure. A short panel opens with a Go to configuration button that takes you to the full page.
.local, .test, localhost) are always allowed. When a new version is available it is shown right inside the module.2. Configuration: the tabs
The module page is organised in tabs across the top: Dashboard, Firewall rules, Blocked log, Login protection, Captcha, Two-factor auth, Malware scanner and Settings.
Dashboard security score
A live Security score with a letter grade (A/B/C/D), computed from your shop settings, the firewall/captcha/2FA layers and the last malware scan (nothing leaves your server). Below it a Checklist of security checks (examples visible: debug mode off in production, HTTPS enforced everywhere, web application firewall active, captcha on login/registration, two-factor authentication on the back office, no malware/webshell detected, back-office folder name not guessable, back-office security token enabled). Items that need attention show a Fix now shortcut that jumps straight to the relevant setting.
Firewall rules
Add and manage the rule lists with one Add a rule form: Whitelist IP/CIDR (trusted, bypasses everything), Blacklist IP/CIDR (blocked), Country rules (ISO-2 codes), Bad user-agents (substring match), Custom attack patterns (substring match), and a Pattern whitelist (URI substrings exempt from pattern blocking). A banner shows your current IP and warns you to whitelist it before enabling lockdown mode or back-office-whitelist-only, so you never lock yourself out.
Blocked log
Every blocked request is logged with date, IP, country, reason (e.g. user_agent, attack_pattern, ip, rate, login), detail, the requested URI and the user-agent. Filter by reason or IP, Export CSV, Clear log, or unblock an IP right from here.
Login protection
Tracks back-office login attempts and locks an account/IP after too many failed attempts within a time window; you can unlock an entry manually. Configure the thresholds in Settings (Back-office login protection).
Captcha
- Captcha provider: choose Google reCAPTCHA v2 (checkbox), reCAPTCHA v3, hCaptcha, Cloudflare Turnstile, or the Lightweight provider that needs no keys and keeps everything on your server.
- Site key / Secret key: from the chosen provider's dashboard, reCAPTCHA v3 score threshold, widget theme, badge position, lightweight token lifetime.
- Protected forms: Login, Registration, Forgot password, Contact form, Newsletter, Product review, Guest checkout (each on/off).
- Advanced: Fail closed (block when the provider is unreachable), Skip captcha for logged-in customers, Verification timeout, Trusted IP whitelist, verify hostname, verify action.
- Rate limiting: rate-limit failed captcha attempts with a max and a window.
Two-factor auth (2FA)
Time-based one-time codes (Google Authenticator, Authy, 1Password and any compatible app). Nothing leaves your server: secrets are encrypted at rest and verified locally.
- Your account: set up 2FA for the account you are signed in with (scan a QR code, enter a 6-digit code).
- Enable 2FA for the back office (staff) and/or for customers (front office).
- Force 2FA for specific employee profiles, by ID (1 = SuperAdmin, 2 = Logistician, 3 = Translator, 4 = Salesman); listed profiles cannot use the back office until they enrol.
- Tolerance window, number of backup codes, issuer name shown in the app.
- Enrolled employees and enrolled customers are listed and can be reset.
Malware scanner
Local malware / webshell scan: scans for known webshell and obfuscation signatures, executable code hidden in media folders, and files added or changed since your trusted baseline. Everything runs on the server: no file, hash or path ever leaves the shop.
- Metrics: suspicious files, files in baseline, last scan.
- Run scan now and Set current files as trusted baseline.
- Findings are listed with severity, what, file and when.
Settings firewall configuration
The firewall's own configuration, grouped by section.
- General: Enable firewall; Behind a proxy/CDN with a trusted proxy header and trusted proxy IPs/CIDRs, only enable this behind a real trusted proxy, otherwise IP/country headers are spoofable.
- IP/CIDR blocking.
- Country blocking: block-list or allow-list mode, ISO-2 codes, an optional MaxMind GeoLite2 database path or a CDN country header, the database is never bundled, for licensing reasons.
- Bad bots / user-agents: enable UA blocking, block empty UA, extra blocked substrings merged with a built-in list.
- Rate limiting: max requests per window, window seconds, temporary block duration.
- Attack-pattern blocking: SQLi/XSS/LFI/probing.
- Back-office login protection: max failed attempts, attempt window, lockout duration, allow back office only from whitelisted IPs.
- Maintenance & logging: Lockdown mode (allow only whitelisted IPs), log blocked requests, log retention days, drop all data on uninstall.
- Weekly security report: emails a short report; runs in the background in small steps so it never slows the shop.
In the front office
When the firewall blocks a request, the visitor gets a plain 403 "Forbidden, your request has been blocked by the site firewall" page: bots and scanners never reach your shop.
3. Check that it works
- Open the Dashboard and read your security score and checklist.
- Send a request with a scanner-like user-agent (or a probing URL) and confirm you get the 403 block page and a new row in the Blocked log.
- After several failed back-office logins, the account/IP is locked in Login protection.
- Enable captcha and confirm it appears on the login/registration form.
- Set up 2FA on your account and log in again with a 6-digit code.
- Run the Malware scanner and read the findings.
4. FAQ
Does it slow down the shop?
No: the firewall runs first with cheap, indexed lookups; the scanner and the weekly report run in the background.
Will it lock me out?
Whitelist your current IP first (the page warns you, and 127.0.0.1/::1 are whitelisted at install); enable lockdown mode or back-office-whitelist-only only after that.
Does any data leave my server?
No: the firewall, the Lightweight captcha option, the 2FA secrets and the malware scanner all run locally on your server.
Does it replace separate firewall / captcha / 2FA modules?
Yes: it is the single, unified security suite.
Do I need to edit my theme?
No: it works through standard hooks and is compatible with any theme.