FPM Labs

Sentinel Shield for WordPress

Scanners ask for your .env file. Sentinel Shield answers with a ban.

Bots probe thousands of sites a day looking for leaked passwords, source code and database backups. The first time one asks for a file no visitor ever requests, its IP is blocked for 48 hours, before WordPress renders a page.

See pricing How it works
Requests to yoursite.ph
  1. GET/200
  2. GET/shop/ceramic-coating-kit/200
  3. GET/.env403 banned
  4. GET/wp-content/uploads/2026/10/hero.webp200
  5. GET/.git/config403 banned
  6. POST/cart/200
  7. GET/_profiler/phpinfo403 banned
  8. GET/book-a-service/200
  9. GET/wp-config.php.bak403 banned
Illustration. The trapped paths are real probes from our own server logs this week.

How it works

  1. A request arrives

    Sentinel Shield reads the path as WordPress starts, before your theme, page builder or database queries run.

  2. It hits a trap

    Browsers never ask for /.env or /.git/config. Only scanners do, so a match means a bot, not a customer.

  3. The IP is banned

    Every request from that address gets a 403 for 48 hours. The attempt is logged with the path, the bot's user agent and what it was trying to steal.

What it catches

Core traps ship with the plugin. A licence adds the threat feed: extra signed rules we publish from probes we see on our own servers, delivered to your site daily.

TargetExample probeWhat the bot wantedIncluded in
Secrets files/.env, /.npmrc, /.aws/Database passwords and API keysCore
Source code/.git/configYour full code historyCore
WordPress config/wp-config.phpDatabase connection detailsCore
Database dumps/backup.sqlCustomer and order recordsCore
Traversal and RCE/../../, /vendor/phpunit/Read files or run code on the serverCore
Server keys/.ssh/id_ed25519Log in to your server directlyThreat feed
Config backups/wp-config.php.bakA forgotten copy with live passwordsThreat feed
Site archives/backup.zipYour whole site in one downloadThreat feed
Web shells/wso.php, /c99.phpA backdoor from an earlier hackThreat feed

What it does not do

It is not a malware scanner, and it does not replace updates, strong passwords or backups. It runs inside WordPress, so it cannot absorb a network-level DDoS. It does one job: spotting reconnaissance early and shutting the door on the bot doing it.

Pricing

Pay yearly, or once for life. Either way the plugin keeps protecting your site; the licence is what brings the threat feed and updates.

Single site

1 live site, plus unlimited staging and local copies

$90 once

$99 per year

Billing term for Single site
  • All core traps and the attack log
  • Daily threat-feed rules
  • One-click updates inside WordPress
  • Email support from the people who wrote it

Charged in pesos through PayMongo: card, GCash, Maya or GrabPay. ₱5,250 at checkout. ₱5,750 at checkout.

Agency

10 live sites, plus unlimited staging and local copies

$120 once

$149 per year

Billing term for Agency
  • All core traps and the attack log
  • Daily threat-feed rules
  • One-click updates inside WordPress
  • Email support from the people who wrote it

Charged in pesos through PayMongo: card, GCash, Maya or GrabPay. ₱6,950 at checkout. ₱8,650 at checkout.

How the licence works

Activating
Paste your key in Sentinel Shield, then Licence. Staging, .local and .test sites do not use up a slot.
Moving sites
Deactivate on the old site and the slot is free again immediately.
When a yearly licence ends
Protection keeps running with the core traps. New feed rules and updates pause until you renew.
Lifetime
Feed rules and updates for as long as Sentinel Shield is maintained, with no renewal.

Questions

Can it block a real customer?

The traps only match file paths that browsers never request, and only the path is checked, so someone searching your shop for ".env" is never affected. Logged-in administrators are never blocked. If you ever need to, you can lift a ban with one click from the dashboard.

Will it slow my site down?

For normal visitors it is a single pattern check on the request path. For scanners it saves work: a blocked request stops before your theme and plugins run.

Do I need a licence to use it?

No. The core traps, the ban list and the attack log work without one. The licence adds the threat feed and automatic updates.

Which payment methods can I use?

Credit and debit cards, GCash, Maya and GrabPay, all through PayMongo's secure checkout. We never see your card details.

Does it work with Cloudflare and caching plugins?

Yes. It reads the visitor's real IP from Cloudflare's header, and scanner paths are never cached pages, so caching does not get in the way.