Security Features

Firewall Protection #

What It Does #

The Zxeion firewall provides real-time protection against common web attacks including:

• SQL injection attempts
• Cross-site scripting (XSS) attacks
• File inclusion attacks
• Malicious bot traffic
• Brute force attacks

How to Configure #

1. Go to Zxeion Security → Firewall
2. Enable Firewall Protection: Toggle the main firewall switch
3. Configure Protection Levels:
   • Basic: Standard protection for most websites
   • Enhanced: Increased security for business sites
   • Maximum: Highest protection for sensitive sites

Firewall Rules #

• Automatic Rules: Updated automatically based on threat intelligence
• Custom Rules: Add your own IP blocks or allow lists
• Whitelist Management: Ensure legitimate traffic isn’t blocked

Login Protection #

Brute Force Protection #

• Failed Attempt Limits: Set maximum login attempts before IP ban
• Lockout Duration: Configure how long IPs remain banned
• Progressive Delays: Increasing delays between failed attempts

User Enumeration Protection #

Prevents attackers from discovering usernames through:

• REST API Blocking: Blocks user enumeration via WordPress REST API
• Author Archive Hiding: Prevents username discovery through author pages
• Generic Error Messages: Standardizes login error messages

Configuration Steps #

1. Navigate to Zxeion Security → Settings
2. Login Protection Section:
   • Enable brute force protection
   • Set maximum login attempts (recommended: 3-5)
   • Configure lockout duration (recommended: 30-60 minutes)
3. User Enumeration Section:
   • Enable REST API protection
   • Disable author archives
   • Enable generic login errors

WordPress Hardening #

Version Hiding #

• WordPress Version: Removes version information from HTML source
• Plugin Versions: Hides plugin version numbers
• Theme Versions: Conceals theme version information

File Protection #

• Directory Browsing: Prevents directory listing
• Sensitive Files: Protects wp-config.php, readme files
• XML-RPC Disable: Blocks XML-RPC attacks

Security Headers #

• X-Frame-Options: Prevents clickjacking attacks
• X-Content-Type-Options: Prevents MIME type sniffing
• X-XSS-Protection: Enables browser XSS filtering

Setup Instructions #

1. Go to Zxeion Security → Plugin Security
2. WordPress Hardening Section:
   • Enable version hiding
   • Enable directory browsing protection
   • Disable XML-RPC if not needed
   • Enable security headers