Stalza Security

Description

Stalza Security protects your site without weighing it down. Instead of hundreds of generic warnings, it tells you what changed, why it matters, how confident the detection is, and what to do.

Detect → Correlate → Assess Risk → Explain → Protect → Verify

Free features

• File & WordPress integrity — official core and repository plugin checksums plus a local baseline for other files.
• Malware detection — heuristic analysis of PHP, JS and .htaccess files; no signature database needed.
• Vulnerability detection — daily check of your installed components against known advisories (opt-in).
• Brute-force protection — login, XML-RPC and REST user-enumeration limits with escalating lockouts.
• Security hardening — one-click fixes and clear advisories for common misconfigurations.
• Security events & reports — a single timeline of what happened, with a weekly digest.

Designed to be light

• Resumable background scans and bounded protection checks on applicable requests.
• Scans run in small resumable chunks with CPU and memory budgets.
• No autoloaded option bigger than 50 KB. No bundled React runtime — uses the one WordPress already ships.

Premium

Stalza Security Pro adds manual quarantine and guarded recovery, license management and signed updates. Guided Safe Repair is in development and is not yet a customer release. Real-time protection, automatic remediation and other future capabilities are not included in the current release.

External services

Vulnerability matching is opt-in. Integrity checks contact WordPress.org for official checksums and packages; the plugin is not entirely offline.

If you enable Vulnerability intelligence in Settings, the plugin sends the slugs and version numbers of your installed WordPress core, plugins and themes, plus your site URL, to https://stalza.com/api/stalza-security/v1/vulnerabilities/match once per day to receive matching security advisories. No user data, content or visitor information is included. See the Stalza privacy policy and terms.

Integrity checks fetch official checksums from WordPress.org (api.wordpress.org, downloads.wordpress.org), the same service WordPress core uses for updates.