DEV Community: Nexura Security

Nexura Security v1.0.11: A Smarter Vulnerability Scanner and Faster WordPress Security Architecture

Nexura Security — Wed, 26 Aug 2026 09:17:31 +0000

WordPress security is not only about blocking malicious requests.

A modern security plugin also needs to answer several important questions:

Are my plugins or themes affected by known vulnerabilities?
What security events happened on my website?
Are there suspicious scheduled tasks?
Are important security headers configured correctly?
Is my database carrying malicious or unnecessary data?
Can malware scanning run safely on shared hosting?
Can a scanner distinguish legitimate files from actual threats?

With Nexura Security v1.0.11, we focused on these areas.

This release introduces several new security modules while also improving the scanning architecture to reduce CPU usage, false positives, and unnecessary overhead.

What's New in v1.0.11?

Vulnerability Scanner

The new Vulnerability Scanner detects known CVEs affecting installed WordPress plugins and themes.

Instead of relying only on malware detection, the scanner helps identify software that may already have a publicly known security vulnerability.

This gives administrators another important layer of visibility:

Installed Plugin/Theme
↓
Version Detection
↓
Known Vulnerability Check
↓
CVE Information
↓
Security Risk Assessment

The goal is simple: find vulnerable software before attackers find it.

Nexura Security already provides security auditing capabilities for WordPress plugins and themes, and v1.0.11 expands this area with dedicated vulnerability scanning.

Security Audit Logs

Security events can be difficult to investigate without historical information.

Version 1.0.11 adds Security Audit Logs for tracking important user actions and security events.

Examples include:

Authentication-related events
Administrative actions
Security configuration changes
Important security events
Other activities that may require investigation

Audit logs can be particularly useful when troubleshooting a compromised website.

Instead of asking:

"What happened?"

you can start investigating:

"What changed, when did it change, and which action triggered it?"

Security Headers Manager

HTTP security headers are an important part of modern website hardening.

Nexura Security v1.0.11 adds a Security Headers Manager supporting:

HSTS
X-Frame-Options
Content Security Policy (CSP)
X-XSS-Protection

The objective is to make common security hardening controls easier to manage directly from WordPress.

For example:

WordPress
│
├── HSTS
├── X-Frame-Options
├── CSP
└── X-XSS-Protection
│
▼
Additional Browser-Side Protection

Headers should still be configured carefully because an overly restrictive policy can break legitimate website functionality.

Database Security & Safe Cleanup

WordPress databases can accumulate expired transients, unnecessary data, and potentially suspicious entries over time.

The new DB Security & Safe Cleanup module focuses on helping administrators maintain a cleaner database while looking for potentially malicious transients.

The important word here is safe.

Security cleanup should not blindly delete database records.

A security tool should identify what it believes is unnecessary or suspicious and allow administrators to make informed decisions.

Cron Job Auditor

WordPress scheduled tasks are useful for legitimate automation.

But they can also become interesting persistence mechanisms after a website compromise.

For example, an attacker could attempt to create a scheduled task that periodically executes unwanted activity.

The new Cron Job Auditor helps identify suspicious or hidden WordPress scheduled tasks.

A simplified security workflow looks like:

WordPress Cron Jobs
↓
Audit Scheduled Tasks
↓
Identify Suspicious Entries
↓
Review
↓
Take Action

This adds another layer of visibility for administrators investigating a potentially compromised website.

Security Score & Reporting

Security tools can generate a lot of information.

But information is only useful if administrators can understand the overall security posture of their website.

Nexura Security v1.0.11 adds Security Score & Reporting to provide a real-time view of the site's security posture.

Instead of checking every security feature individually, administrators can use the security score as a high-level indicator and then investigate individual findings.

Think of it as:

Security Score
│
├── Vulnerabilities
├── Security Headers
├── Malware Detection
├── Authentication
├── Database Security
└── Configuration

The score is designed to provide visibility, not replace detailed security analysis.

Performance Improvements

Security scanning can be expensive on shared hosting.

A scanner that consumes too much CPU can affect the entire WordPress installation.

That's why v1.0.11 includes several architectural changes.

Freemius SDK Removed

Nexura Security has completely removed the Freemius SDK from the plugin.

The result is a more independent architecture with fewer external components inside the plugin.

The focus is now on keeping the security core lightweight and focused on its primary purpose.

More Targeted Malware Signatures

Another major improvement is the reduction and targeting of cloud threat-intelligence signatures.

Instead of attempting to match an unnecessarily broad collection of patterns, the scanner focuses more heavily on targeted PHP and WordPress malware signatures.

This has two important benefits:

Faster scanning
Fewer false positives

False positives are especially problematic for security plugins.

A scanner that continuously reports legitimate files as malware creates alert fatigue and makes real threats harder to identify.

Better CPU Management for Shared Hosting

Shared hosting environments have limited CPU resources.

Running large malware scans without resource management can create unnecessary load.

Nexura Security v1.0.11 introduces a 1.5-second CPU breathing gap between scan steps.

The scanner also reduces the per-step execution time from 10 seconds to 6 seconds.

The basic idea is:

Scan
↓
Short CPU Breathing Gap
↓
Scan
↓
Short CPU Breathing Gap
↓
Scan
↓
...

This approach is designed to make background scanning more friendly to shared hosting environments.

Fewer Malware False Positives

One of the most important improvements in v1.0.11 is more precise malware detection.

The scanner no longer flags legitimate theme and plugin files simply because they contain Windows binary formats such as:

Armadillo
UPX
PE32

Domain-matching YARA rules have also been improved to reduce false positives.

The goal is not simply to detect more.

The goal is to detect better.

Improved Database and Post Content Scanning

Earlier generic cloud YARA patterns could produce large numbers of false positives when scanning database options and post content.

Version 1.0.11 changes this approach.

The database and post-content scanner now uses more targeted injection detection patterns, including indicators such as:

eval () <script> <iframe>

Rather than relying on broad generic malware patterns for every database value, the scanner focuses on indicators that are more relevant to WordPress database injection scenarios.

This significantly reduces unnecessary findings.

Stability Fix: Missing Plugin Files

WordPress administrators sometimes manually delete plugin files or remove incomplete plugin installations.

Version 1.0.11 fixes a fatal error that could occur when specific plugin files were missing or manually deleted.

Security software should be able to handle imperfect installations gracefully.

A missing file should result in a manageable security finding or scan condition—not a fatal error that takes down the process.

Safer Plugin ZIP Uploads

Another technical improvement involves malware regex patterns.

Hardcoded malware regex patterns were moved into an encoded external file.

One practical benefit is reducing the chance of cPanel ClamAV flagging the Nexura Security plugin ZIP during upload because of embedded malware-like regex patterns.

This is especially useful for hosting environments where uploaded plugin packages are automatically scanned.

Why This Release Matters

Nexura Security v1.0.11 is not just a feature update.

The release focuses on three areas:

Security Visibility

CVE detection, audit logs, cron auditing, security headers, and security reporting give administrators more visibility into their WordPress security posture.

Better Detection

More targeted malware signatures and improved database scanning help reduce false positives.

Better Performance

CPU breathing gaps, shorter scan steps, and the removal of unnecessary SDK dependencies make the scanner better suited to resource-constrained hosting environments.

What's Next?

WordPress security is continuously evolving.

New vulnerabilities appear, attackers change their techniques, and security tools need to adapt.

Our goal with Nexura Security is to build a security platform that remains:

Lightweight
Transparent
Performance-focused
Developer-friendly
Practical for shared hosting
Accessible to WordPress users

Version 1.0.11 is another step toward that goal.

Try Nexura Security

Nexura Security is available for WordPress users who want malware scanning, firewall protection, vulnerability auditing, authentication security, and other WordPress hardening features.

👉 Website: https://nexurasecurity.com/

👉 WordPress.org: https://wordpress.org/plugins/nexura-security/

If you're a WordPress developer, security researcher, or website administrator, we'd love to hear your feedback.

What security feature would you like to see in the next release?

WordPress #WordPressSecurity #CyberSecurity #WebSecurity #MalwareScanner #VulnerabilityScanner #CVE #PHP #WebDevelopment

Stop Attacks Before Your App Boots: Building an Early-Load WAF in PHP

Nexura Security — Wed, 15 Jul 2026 04:41:56 +0000

If you are building web applications in PHP, whether it's a custom Laravel app or a WordPress plugin, security is always a top priority. But when that security executes is just as important as what it does.

Most application-level firewalls make a critical mistake: they load too late.

Today, I want to share a technical dive into how we solved this problem when building Nexura Security, and how you can use PHP's native features to build an early-load Web Application Firewall (WAF).

The "Late Execution" Problem
Let's take WordPress as an example. A typical security plugin initializes its firewall via a hook (like plugins_loaded or init).

Think about what has already happened on the server by the time that hook fires:

The web server (Nginx/Apache) received the request.
PHP started up.
Database connections were established.
Hundreds of core PHP files were parsed and loaded.
The active theme and other plugins were initialized.
If a malicious bot sends a massive SQL Injection payload, your server is wasting CPU and memory parsing the entire application architecture just to tell the bot "No" at the very end. During a DDoS or brute-force attack, this late execution is exactly what brings servers down.

The Solution: auto_prepend_file
PHP has a brilliant, often-underutilized directive in its php.ini configuration called auto_prepend_file.

When configured, PHP will execute the specified file before executing the main script requested by the user. It happens at the absolute beginning of the PHP lifecycle, before database connections, before frameworks, and before any heavy lifting.

If you block a malicious payload here, the server resource cost is practically zero.

How We Implemented It in Nexura Security
When architecting Nexura Security, we knew we didn't want to be just another plugin that slows down the site. We wanted to intercept traffic at the server level.

Here is a simplified breakdown of how an early-load WAF works:

The Setup (Setting the Directive) We programmatically add the directive to the server configuration (e.g., .htaccess or .user.ini):

# In .htaccess <IfModule mod_php7.c> php_value auto_prepend_file "/absolute/path/to/nexura-waf.php" </IfModule>

The WAF Logic (nexura-waf.php) This file is intentionally kept incredibly lightweight. It does not connect to the database. It does not load large classes. It simply inspects the incoming superglobals ($_GET, $_POST, $_SERVER, $_COOKIE) against a set of known malicious patterns.

<?php
// Extremely simplified conceptual example
function nexura_inspect_request() {
    $payload = file_get_contents('php://input') . print_r($_GET, true) . print_r($_SERVER, true);

    // Check for obvious SQLi patterns
    $sql_patterns = '/(UNION\s+SELECT|CONCAT\(|WAITFOR\s+DELAY)/i';

    if (preg_match($sql_patterns, $payload)) {
        // Block the request immediately!
        header('HTTP/1.1 403 Forbidden');
        die('Blocked by Nexura Security WAF.');
    }
}

nexura_inspect_request();
// If it passes, PHP naturally continues to load the main app (e.g., index.php)
?>

The Performance Impact is Massive
By moving the firewall logic to the auto_prepend_file stage, we achieved a zero performance hit on the actual application load time.

If a request is legitimate, the WAF inspection takes less than 1 millisecond and hands the request over to WordPress. If the request is malicious, it gets blocked instantly, saving the server from executing a single database query.

Conclusion
Application security shouldn't be an afterthought that runs at the end of your boot cycle. By leveraging PHP's low-level directives, you can protect your applications efficiently.

We built Nexura Security entirely around this philosophy—combining this early-load WAF with flat-file logging (to prevent database bloat) and a micro-batching malware scanner.

If you're a developer managing WordPress sites, I’d love for you to test out our architecture and let me know your technical feedback!

Have you ever used auto_prepend_file for security or logging? Let's discuss in the comments!

How We Built a Zero-Bloat WP Security Plugin published: true tags: wordpress, php, webdev, security

Nexura Security — Tue, 14 Jul 2026 08:49:47 +0000

If you've ever managed a WordPress site, you already know the drill. You install a popular security plugin to keep the bad guys out. A few weeks later, your wp-admin dashboard feels sluggish, your CPU usage spikes randomly, and your database size has mysteriously doubled.

As a developer, this drove me crazy. Security shouldn't come at the cost of performance.

So, my team and I decided to look under the hood of popular security plugins to see why they were so heavy, and we built Nexura Security to solve these exact problems.

Here is what we found, and how we engineered a different approach.

Problem 1: The wp_options Database Bloat
Most security plugins log everything directly into the WordPress database. Every failed login attempt, every blocked 404 request, every minor crawler—it all gets stuffed into your database, often bloating the wp_options table or creating massive custom tables.

Our Fix: Zero Database Bloat We architected Nexura to keep the database completely clean. Instead of spamming the database with transient logs that bring sites to a crawl, we optimized how and where logs are stored. The result? A completely snappy backend, even on sites that are under constant bot attacks.

Problem 2: Late Execution WAFs
A Web Application Firewall (WAF) is supposed to block malicious requests. However, many plugins initialize their WAF after WordPress core, plugins, and the active theme have already loaded. By the time the WAF blocks the SQL injection, the server has already wasted CPU and memory processing 80% of the request.

Our Fix: Early-Load WAF (auto_prepend_file) We implemented an early-load WAF that hooks in before WordPress even starts. By utilizing PHP's auto_prepend_file directive, Nexura intercepts and inspects requests at the server level. If a request contains a malicious payload, it is blocked instantly with near-zero resource consumption.

Problem 3: Server-Crashing Malware Scanners
Scanning 10,000+ files for malware in a single PHP execution is a guaranteed way to trigger a 504 Gateway Timeout or spike your hosting CPU to 100%. Traditional plugins often run heavy regex searches across the entire filesystem at once.

Our Fix: Smart Micro-Batching Scanner We wrote a custom micro-batching algorithm. Instead of trying to scan everything at once, Nexura breaks the scanning process into tiny, lightweight chunks. It scans a few files, pauses, and resumes. This keeps the server load practically non-existent. You can run a full malware scan while users are actively shopping on your WooCommerce store, and they won't feel a thing.

Security Should Be Invisible
Building Nexura Security taught us that the best security is the kind you don't even notice. Your dashboard stays fast, your database stays small, and your server breathes easy.

We recently launched, and the response from the community has been amazing (especially regarding the zero-database-bloat!).

It includes the WAF, Malware Scanner, 2FA, and Brute-force protection out of the box.

If you are a developer managing WordPress sites, I would absolutely love to hear your technical feedback.

You can check it out here: nexurasecurity.com

Let me know what you think in the comments! 🚀