Quarantine storage moves into the uploads directory and is migrated automatically. Extended Protection moves to the Pro add-on; if you use it, see the changelog before updating.<\/p>","1.1.11":"
Removes the licence client entirely. Every protection engine is unchanged.<\/p>","1.1.10":"
Licence screen wording and visibility only. No behaviour change; safe to update.<\/p>","1.1.9":"
Wording only on the licence screen. No behaviour change; safe to update.<\/p>","1.1.8":"
Documentation and packaging only. No behaviour change; safe to update.<\/p>","1.1.6":"
Declares compatibility with WordPress 7.1 and hardens the uninstall queries. No behaviour change; safe to update.<\/p>","1.1.4":"
Adds opt-in Smart 404 blocking and file permission auditing. Both are off or report-only until you enable them, so updating changes nothing on its own.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3684665,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3684665,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3684665,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3684665,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.1.12"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3684665,"resolution":"1","location":"assets","locale":"","width":2369,"height":1271},"screenshot-10.png":{"filename":"screenshot-10.png","revision":3684665,"resolution":"10","location":"assets","locale":"","width":2362,"height":1265},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3684665,"resolution":"2","location":"assets","locale":"","width":2363,"height":1267},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3684665,"resolution":"3","location":"assets","locale":"","width":2365,"height":1268},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3684665,"resolution":"4","location":"assets","locale":"","width":2370,"height":1268},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3684665,"resolution":"5","location":"assets","locale":"","width":2359,"height":1270},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3684665,"resolution":"6","location":"assets","locale":"","width":2365,"height":1264},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3684665,"resolution":"7","location":"assets","locale":"","width":2367,"height":1267},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3684665,"resolution":"8","location":"assets","locale":"","width":2360,"height":1269},"screenshot-9.png":{"filename":"screenshot-9.png","revision":3684665,"resolution":"9","location":"assets","locale":"","width":2365,"height":1256}},"screenshots":{"1":"Overview: Security Score, open incidents and the state of every protection engine on one screen.","2":"The same Overview in light mode. Appearance is per-user, so it follows whoever is signed in.","3":"Easy Setup applies a recommended local protection profile without asking you to understand every switch first.","4":"Identity Protection: brute-force lockouts, two-factor enrolment, sessions and Application Passwords. Credentials and raw IP addresses never leave the site.","5":"Integrity Protection verifies WordPress core against the official checksums and keeps SHA-256 baselines for plugins, themes, must-use plugins and drop-ins.","6":"The firewall evaluates requests against local high-confidence rules, in Protect, Learning or Off mode.","7":"The malware scanner reads files locally and resumes after a timeout. File contents never leave the server.","8":"Vulnerability inventory: what is actually installed, so you can judge what is exposed.","9":"Diagnostics are read-only. They verify the runtime, storage and security boundaries without changing any configuration.","10":"Settings: every engine is configurable, and the defaults are safe on their own."}},"plugin_section":[],"plugin_tags":[1174,173015,55021,600,9217],"plugin_category":[54],"plugin_contributors":[279560],"plugin_business_model":[],"class_list":["post-358959","plugin","type-plugin","status-publish","hentry","plugin_tags-firewall","plugin_tags-integrity","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor","plugin_category-security-and-spam-protection","plugin_contributors-nimbleplugin","plugin_committers-nimbleplugin"],"banners":{"banner":"https:\/\/ps.w.org\/nimble-security\/assets\/banner-772x250.png?rev=3684665","banner_2x":"https:\/\/ps.w.org\/nimble-security\/assets\/banner-1544x500.png?rev=3684665","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/nimble-security\/assets\/icon-128x128.png?rev=3684665","icon_2x":"https:\/\/ps.w.org\/nimble-security\/assets\/icon-256x256.png?rev=3684665","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-1.png?rev=3684665","caption":"Overview: Security Score, open incidents and the state of every protection engine on one screen."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-2.png?rev=3684665","caption":"The same Overview in light mode. Appearance is per-user, so it follows whoever is signed in."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-3.png?rev=3684665","caption":"Easy Setup applies a recommended local protection profile without asking you to understand every switch first."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-4.png?rev=3684665","caption":"Identity Protection: brute-force lockouts, two-factor enrolment, sessions and Application Passwords. Credentials and raw IP addresses never leave the site."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-5.png?rev=3684665","caption":"Integrity Protection verifies WordPress core against the official checksums and keeps SHA-256 baselines for plugins, themes, must-use plugins and drop-ins."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-6.png?rev=3684665","caption":"The firewall evaluates requests against local high-confidence rules, in Protect, Learning or Off mode."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-7.png?rev=3684665","caption":"The malware scanner reads files locally and resumes after a timeout. File contents never leave the server."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-8.png?rev=3684665","caption":"Vulnerability inventory: what is actually installed, so you can judge what is exposed."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-9.png?rev=3684665","caption":"Diagnostics are read-only. They verify the runtime, storage and security boundaries without changing any configuration."},{"src":"https:\/\/ps.w.org\/nimble-security\/assets\/screenshot-10.png?rev=3684665","caption":"Settings: every engine is configurable, and the defaults are safe on their own."}],"raw_content":"\n
Nimble Security protects a WordPress site from the login screen down to the files on disk, and it does all of it on your own server.<\/p>\n\n
There is no account to create, no cloud service to connect and no data leaving your site. The only outbound request the free version ever makes is to the official WordPress.org checksum API, and only when an integrity scan runs.<\/p>\n\n
Everything listed below is in the free version. It is not a trial, nothing here is time-limited, and no engine is held back.<\/p>\n\n
Security Score rates your posture out of 100 across hardening, identity, integrity, firewall, malware detection, software updates and recovery readiness. An open high or critical incident caps the score, so a site with an active serious problem cannot display a healthy number.<\/p>\n\n
Nimble Security does not upload your files, does not phone home, does not write executable code anywhere and does not replace backups. It protects, detects and responds; recovery comes from a backup. That is why recovery readiness counts towards the score, because remediation is far safer when a verified restore point exists.<\/p>\n\n
Nimble Security relies on exactly one external service, and on nothing else.<\/p>\n\n
WordPress.org Core Checksums API<\/strong><\/p>\n\n Nimble Security does not contact NimblePlugins, sends no telemetry and has no account, licence or activation requirement of any kind.<\/p>\n\n Security events are minimized. Raw request bodies, cookies and credentials are not stored by the event engine, and network actors are represented with keyed hashes rather than raw IP addresses in Security events.<\/p>\n\n TOTP secrets are encrypted at rest and recovery codes are stored as one-way hashes in WordPress user metadata. Authentication secrets are never included in the WordPress personal-data export. The privacy eraser anonymizes Security event references and removes the per-user appearance preference; active 2FA material is retained while the account remains active because it is required for authentication.<\/p>\n\n Quarantine payloads stay local and are encrypted with AES-256-GCM. Operations receives aggregate technical status only, not file contents, raw IP addresses, credentials, request bodies or quarantine data.<\/p>\n\n\n Easy Setup never requires a Nimble account or Threat Cloud connection and can be run again later from the Nimble Security menu.<\/p>\n\n If using Nimble Security Pro, install\/upgrade Free first, then Pro.<\/p>\n\n\n No. Nimble Security is complete on its own. It contains no licence check, no account requirement and no time limit, and it does not contact NimblePlugins.<\/p><\/dd>\n Yes. Free owns the local identity, integrity, firewall, malware, vulnerability-inventory and manual response engines.<\/p><\/dd>\n No. Integrity findings are interpreted in context. Known WordPress maintenance can be correlated automatically; unexplained file changes are presented for review rather than being labelled malware by file type alone.<\/p><\/dd>\n WordPress normally preserves wp-config.php. Site-specific cron, proxy, database or debug configuration can therefore legitimately differ from a previous baseline. Nimble Security lets an administrator explicitly mark the current recognized configuration as intentional without storing its contents.<\/p><\/dd>\n No. The Free malware scanner runs locally.<\/p><\/dd>\n Free response is manual-first. Pro contains conservative recovery-gated automation, but destructive actions remain bounded by the Free enforcement and recovery contracts.<\/p><\/dd>\n No. Security protects\/detects\/responds; backup provides recovery. Recovery readiness is intentionally part of Security Score because remediation is safer when a verified recovery point is available.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
https:\/\/api.wordpress.org\/core\/checksums\/1.0\/<\/code>. It returns the authoritative MD5 checksum set for a given WordPress release.<\/li>\nPrivacy<\/h3>\n\n
\n
\n
Do I need a licence key or an account?<\/h3><\/dt>\n
Does Free work without Pro?<\/h3><\/dt>\n
Does a changed plugin file mean malware?<\/h3><\/dt>\n
Why can wp-config.php still require review after WordPress is reinstalled?<\/h3><\/dt>\n
Does Nimble Security upload files for malware scanning?<\/h3><\/dt>\n
Can Security delete malware automatically?<\/h3><\/dt>\n
Does Nimble Security replace backups?<\/h3><\/dt>\n
1.1.12<\/h4>\n\n
\n
1.1.11<\/h4>\n\n
\n
1.1.10<\/h4>\n\n
\n
1.1.9<\/h4>\n\n
\n
1.1.8<\/h4>\n\n
\n
1.1.7<\/h4>\n\n
\n
1.1.6<\/h4>\n\n
\n
1.1.5<\/h4>\n\n
\n
1.1.4<\/h4>\n\n
\n
1.1.3<\/h4>\n\n
\n
1.1.2<\/h4>\n\n
\n
1.1.1<\/h4>\n\n
\n
1.0.1<\/h4>\n\n
\n
nimble_security_response_automation_panel<\/code>. Nimble Security Pro attaches its recovery-gated automation policy form to that hook, so with Pro active the automation panel could not render and the policy could not be moved off its default Off state.<\/li>\n1.0.0<\/h4>\n\n
\n